# Create a spending card

`POST /issuing/{accountID}/cards`

API version: `v2026.10.00`. Send `X-Moov-Version: v2026.10.00` to get the behavior described here.

> AI agents: search and read all Moov docs with the docs MCP server at https://docs.moov.io/mcp (no API key). Setup: https://docs.moov.io/guides/developer-tools/mcp-ai/docs-mcp/index.md

Request a virtual card be issued.

To access this endpoint using an [access token](https://docs.moov.io/api/authentication/access-tokens/) 
you'll need to specify the `/accounts/{accountID}/issued-cards.write` scope.

## Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `X-Moov-Version` | header | string |  | Set this header to v2026.10.00 to use the API described in this specification. When omitted, the server defaults to v2024.01.00, the earliest supported version, which may not match the behavior documented here. An unrecognized well-formed version uses the latest supported version that is not newer than the requested version, when one exists. For example, `v2026.08.00` uses `v2026.07.00`. A malformed value, such as `2022`, returns a `404` response. Values: `v2026.10.00`. |
| `accountID` | path | string | Yes | The Moov business account for which the card is to be issued. |

## Request body

Content type: `application/json`

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `authorizedUserAccountID` | string |  |  |
| `nickname` | string |  |  |
| `metadata` | object |  | Free-form key-value pair list. Useful for storing information that is not captured elsewhere. |
| `billingAddress` | object |  |  |
| `billingAddress.addressLine1` | string | Yes |  |
| `billingAddress.addressLine2` | string |  |  |
| `billingAddress.city` | string | Yes |  |
| `billingAddress.stateOrProvince` | string | Yes |  |
| `billingAddress.postalCode` | string | Yes |  |
| `billingAddress.country` | string | Yes |  |
| `expiration` | object |  | The expiration date of the card or token. |
| `expiration.month` | string | Yes | Two-digit month the card expires. |
| `expiration.year` | string | Yes | Two-digit year the card expires. |
| `controls` | object |  | Mutable spend controls for the card. |
| `controls.singleUse` | boolean |  | Indicates if the card is single-use. If true, the card closes after the first authorization. |
| `controls.velocityLimits` | array of object |  | Sets the spending limit per time interval. Only one limit per interval is supported. |
| `controls.velocityLimits[].amount` | integer (int64) |  | The maximum amount in cents that can be spent in a given interval. |
| `controls.velocityLimits[].count` | integer (int64) |  | The maximum number of transactions allowed in the given interval. At least one of `amount` or `count` must be set. |
| `controls.velocityLimits[].interval` | string | Yes | Specifies the time frame for a velocity limit. `per-transaction` applies to each individual authorization and never resets. Time-based intervals (where supported) reset at midnight ET. Values: `per-transaction`, `daily`, `weekly`, `monthly`. |
| `controls.merchantCategoryRestrictions` | object |  | Restricts card usage by merchant category. When not set, all categories are allowed. |
| `controls.merchantCategoryRestrictions.mode` | string | Yes | Whether the listed items should be allowed (`allow`) or blocked (`block`). Values: `allow`, `block`. |
| `controls.merchantCategoryRestrictions.categories` | array of string |  | Predefined category groups to allow or block. Values: `advertising`, `airlines`, `alcohol-and-bars`, `car-rental`, `education`, `electronics`, `fuel-and-gas`, `gambling`, `groceries`, `ground-transportation`, `hardware-and-home`, `healthcare`, `live-entertainment`, `lodging`, `movies`, `office-supplies`, `parking`, `personal-care`, `professional-services`, `restaurants-and-dining`, `retail-general`, `rideshare-and-taxis`, `software-and-saas`, `sports-and-recreation`, `subscriptions`, `travel-agencies`. |
| `controls.merchantCategoryRestrictions.customMCCs` | array of string |  | Individual merchant category codes (MCCs) to allow or block, for codes not covered by a predefined category. |
| `controls.merchantCategoryRestrictions.exemptMerchants` | array of object |  | Merchants that are exempt from category restrictions regardless of their category. |
| `controls.merchantCategoryRestrictions.exemptMerchants[].networkID` | string |  | The merchant's unique identifier (ISO 8583 DE42), matched exactly. |
| `controls.merchantCategoryRestrictions.exemptMerchants[].descriptorPattern` | string |  | A case-insensitive RE2 regular expression matched against the merchant descriptor (ISO 8583 DE43). |
| `controls.merchantCategoryRestrictions.exemptMerchants[].name` | string |  | An optional label for this entry. |
| `controls.merchantRestrictions` | object |  | Restricts card usage to specific merchants, independent of merchant category. |
| `controls.merchantRestrictions.mode` | string | Yes | Whether the listed items should be allowed (`allow`) or blocked (`block`). Values: `allow`, `block`. |
| `controls.merchantRestrictions.merchants` | array of object | Yes | The merchants to allow or block. |
| `controls.merchantRestrictions.merchants[].networkID` | string |  | The merchant's unique identifier (ISO 8583 DE42), matched exactly. |
| `controls.merchantRestrictions.merchants[].descriptorPattern` | string |  | A case-insensitive RE2 regular expression matched against the merchant descriptor (ISO 8583 DE43). |
| `controls.merchantRestrictions.merchants[].name` | string |  | An optional label for this entry. |
| `controls.allowedSchedule` | object, nullable |  | Limits card usage to specific days and times. |
| `controls.allowedSchedule.timezone` | string | Yes | IANA timezone string used to evaluate window boundaries against the authorization time. |
| `controls.allowedSchedule.windows` | array of object | Yes | Time windows during which authorizations on the card can be approved. Any matching window allows the transaction. |
| `controls.allowedSchedule.windows[].days` | array of string | Yes | The days of the week this window applies to. Values: `monday`, `tuesday`, `wednesday`, `thursday`, `friday`, `saturday`, `sunday`. |
| `controls.allowedSchedule.windows[].startTime` | string | Yes | Inclusive window start time in 24-hour `HH:MM` format. |
| `controls.allowedSchedule.windows[].endTime` | string | Yes | Exclusive window end time in 24-hour `HH:MM` format. If earlier than `startTime`, the window wraps past midnight. |
| `controls.expiresOn` | string (date-time), nullable |  | A spend cutoff date and time. When set, all authorizations after this datetime are declined regardless of other controls. Set to `null` for no cutoff. |

## Response 200

The request completed successfully.

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `issuedCardID` | string | Yes |  |
| `brand` | string | Yes | The card brand. Values: `American Express`, `Discover`, `Mastercard`, `Visa`, `Unknown`. |
| `lastFourCardNumber` | string | Yes |  |
| `expiration` | object | Yes | The expiration date of the card or token. |
| `expiration.month` | string | Yes | Two-digit month the card expires. |
| `expiration.year` | string | Yes | Two-digit year the card expires. |
| `fundingWalletID` | string | Yes | Unique identifier for the wallet funding the card. |
| `authorizedUserAccountID` | string |  | Identifier for the account of the card's authorized user. |
| `nickname` | string |  | An optional descriptive name for the card. |
| `metadata` | object |  | Free-form key-value pair list. Useful for storing information that is not captured elsewhere. |
| `billingAddress` | object |  | Billing address associated with the card. |
| `billingAddress.addressLine1` | string | Yes |  |
| `billingAddress.addressLine2` | string |  |  |
| `billingAddress.city` | string | Yes |  |
| `billingAddress.stateOrProvince` | string | Yes |  |
| `billingAddress.postalCode` | string | Yes |  |
| `billingAddress.country` | string | Yes |  |
| `state` | string | Yes | The `state` represents the operational status of an issued card. Authorizations can only be approved while the card is `active`: - `active`: The card is operational and authorizations can be approved. - `frozen`: The card is temporarily suspended and authorizations cannot be approved. Set the state back to `active` to reactivate it. A card can move between `frozen` and `active` as often as needed. - `closed`: The card is permanently deactivated. A card is closed by request or when it expires, and cannot be reopened. Values: `active`, `frozen`, `closed`. |
| `formFactor` | string | Yes | Specifies the type of spend card to be issued. Presently supports virtual only, providing a digital number without a physical card. Values: `virtual`. |
| `controls` | object |  | Spend controls applied to an issued card, including velocity runtime state. |
| `controls.singleUse` | boolean |  | Indicates if the card is single-use. If true, the card closes after the first authorization. |
| `controls.velocityLimits` | array of object |  | The spending limits per time interval, including current runtime state. |
| `controls.merchantCategoryRestrictions` | object |  | Restricts card usage by merchant category. When not set, all categories are allowed. |
| `controls.merchantRestrictions` | object |  | Restricts card usage to specific merchants, independent of merchant category. |
| `controls.allowedSchedule` | object, nullable |  | Limits card usage to specific days and times. |
| `controls.expiresOn` | string (date-time), nullable |  | A spend cutoff date and time. When set, all authorizations after this datetime are declined regardless of other controls. |
| `createdOn` | string (date-time) | Yes |  |
| `updatedOn` | string (date-time) | Yes |  |

## Errors

| Status | Meaning |
| --- | --- |
| 400 | The server could not understand the request due to invalid syntax. |
| 401 | The request contained missing or expired authentication. |
| 403 | The user is not authorized to make the request. |
| 404 | The requested resource was not found. |
| 422 | The request was well-formed, but the contents failed validation. Check the request for missing or invalid fields. |
| 429 | Request was refused due to rate limiting. |
| 500 | The request failed due to an unexpected error. |
| 504 | The request failed because a downstream service failed to respond. |

## Examples

### cURL

```bash
curl -X POST "https://api.moov.io/issuing/{accountID}/cards" \
  -H "Authorization: Bearer {token}" \
  -H "X-Moov-Version: v2026.10.00"
```

### Typescript (SDK)

```typescript
import { Moov } from "@moovio/sdk";

const moov = new Moov({
  security: {
    username: "",
    password: "",
  },
});

async function run() {
  const result = await moov.cardIssuing.request({
    accountID: "d9ac71ae-fccb-4dfc-9fed-710ca654e3ed",
    requestCard: {
      metadata: {
        "optional": "metadata",
      },
      billingAddress: {
        addressLine1: "123 Main Street",
        addressLine2: "Apt 302",
        city: "Boulder",
        stateOrProvince: "CO",
        postalCode: "80301",
        country: "US",
      },
      expiration: {
        month: "01",
        year: "21",
      },
      controls: {
        velocityLimits: [
          {
            amount: 10000,
            interval: "per-transaction",
          },
        ],
      },
    },
  });

  console.log(result);
}

run();
```

Full reference with SDK examples in every language: https://docs.moov.io/api/v2026.10.00/money-movement/issuing/create/