Guides Use cases API Changelog

Create a simulated authorization

Create a simulated authorization for an issued card in test mode. See our test mode guide for more information.

To access this endpoint using an access token you'll need to specify the /accounts/{accountID}/issued-cards.write scope.

POST
/issuing/simulations/{accountID}/authorizations
The request completed successfully.
application/json
Example
{
  "authorizationID": "string",
  "issuedCardID": "string",
  "lastFourCardNumber": "stri",
  "fundingWalletID": "string",
  "network": "discover",
  "authorizedAmount": "-14.89",
  "status": "pending",
  "merchantData": {
    "networkID": "string",
    "name": "Whole Body Fitness",
    "city": "San Francisco",
    "country": "US",
    "postalCode": "94107",
    "state": "CA",
    "mcc": "7298"
  },
  "createdOn": "2019-08-24T14:15:22Z",
  "cardTransactions": [
    "string"
  ],
  "declineReason": "insufficient-funds"
}

Response headers

x-request-id

string required
A unique identifier used to trace requests.
The resource was successfully accepted.
application/json
Example
{
  "authorizationID": "string"
}

Response headers

x-request-id

string required
A unique identifier used to trace requests.
The server could not understand the request due to invalid syntax.
application/json
Example
{
  "error": "string"
}

Response headers

x-request-id

string required
A unique identifier used to trace requests.
The request contained missing or expired authentication.

Response headers

x-request-id

string required
A unique identifier used to trace requests.
The user is not authorized to make the request.

Response headers

x-request-id

string required
A unique identifier used to trace requests.
The requested resource was not found.

Response headers

x-request-id

string required
A unique identifier used to trace requests.
The request conflicted with the current state of the target resource.
application/json
Example
{
  "error": "string"
}

Response headers

x-request-id

string required
A unique identifier used to trace requests.
The request was well-formed, but the contents failed validation. Check the request for missing or invalid fields.
application/json
Example
{
  "issuedCardID": "string",
  "amount": "string",
  "merchantData": {
    "networkID": "string",
    "name": "string",
    "city": "string",
    "country": "string",
    "postalCode": "string",
    "state": "string",
    "mcc": "string"
  }
}

Response headers

x-request-id

string required
A unique identifier used to trace requests.
Request was refused due to rate limiting.

Response headers

x-request-id

string required
A unique identifier used to trace requests.
The request failed due to an unexpected error.

Response headers

x-request-id

string required
A unique identifier used to trace requests.
The request failed because a downstream service failed to respond.

Response headers

x-request-id

string required
A unique identifier used to trace requests.

Headers

X-Moov-Version

string
Set this header to v2026.10.00 to use the API described in this specification. When omitted, the server defaults to v2024.01.00, the earliest supported version, which may not match the behavior documented here. An unrecognized well-formed version uses the latest supported version that is not newer than the requested version, when one exists. For example, v2026.08.00 uses v2026.07.00. A malformed value, such as 2022, returns a 404 response.
Possible values: v2026.10.00

Path parameters

accountID

string required
The Moov business account for which the card was issued.

Body

application/json

amount

string<^\d+\.\d{1,2}$> required
A decimal-formatted numerical string that represents up to 2 decimal place precision. In USD for example, 12.34 is $12.34 and 0.99 is $0.99.

issuedCardID

string required

merchantData

object
Show child attributes

city

string <=100 characters
The merchant's location.

country

string <=2 characters
Two-letter country code.

mcc

string <=4 characters
The Merchant Category Code.

name

string <=100 characters
Name of the merchant.

networkID

string <=15 characters
External identifier used to identify the merchant with the card brand.

postalCode

string <=5 characters
The merchant's five-digit postal code.

state

string <=2 characters
The merchant's two-letter state abbreviation.

Response

application/json

authorizationID

string required

authorizedAmount

string<^\d+\.\d{1,2}$> required
A decimal-formatted numerical string that represents up to 2 decimal place precision. In USD for example, 12.34 is $12.34 and 0.99 is $0.99.

createdOn

string<date-time> required

fundingWalletID

string required

issuedCardID

string required

merchantData

object required
Show child attributes

country

string required
Two-letter country code.

mcc

string required
The Merchant Category Code.

networkID

string required
External identifier used to identify the merchant with the card brand.

city

string
The merchant's location.

name

string
Name of the merchant.

postalCode

string
The merchant's five-digit postal code.

state

string
The merchant's two-letter state abbreviation.

network

string<enum> required
The name of the network a card transaction is routed through.
Possible values: discover, shazam, visa

status

string<enum> required
Status of a card issuing authorization.
Possible values: pending, declined, canceled, cleared, expired

cardTransactions

array<string>
List of card transaction IDs associated with this authorization.

declineReason

string<enum>
The reason an authorization or authorization event was declined. Only present if the authorization or event has been declined.
Possible values: insufficient-funds, card-not-active, card-expiration, spend-cutoff-reached, outside-allowed-schedule, spend-limit-exceeded, merchant-category-not-supported, merchant-category-restricted, merchant-restricted, merchant-country-not-supported, unsupported-transaction, network-stand-in, declined-by-issuer, invalid-request, system-error

lastFourCardNumber

string 4 characters
Last four digits of the card number. Omitted for authorizations recorded before this was captured.