Issue a card against a credit line

POST/api/v1/credit/cards

Mints a card with spend controls enforced at the network — ceiling, interval, per-transaction cap, and a merchant-category allowlist. Card credentials never transit DayZero.

Operation ID: issue_card_api_v1_credit_cards_post·View as markdown·OpenAPI slice

Authentication

Bearer token authentication. Pass your DayZero API token in the Authorization header and the target business UUID in x-business-id.

Request body

Schema: CardIssueRequest

credit_line_idstringrequired
display_namestring
card_typestring: One of: virtual, physical
spend_limit_centsinteger: Authorisation ceiling. Defaults to the line's credit limit.
spend_intervalstring: One of: TOTAL, DAILY, WEEKLY, MONTHLY, QUARTERLY, YEARLY, ANNUAL
transaction_limit_centsinteger
cardholder_provider_user_idstring: Issuer-side user the card is issued to.
allowed_mcc_codesarray · string: Defaults to the program's allowlist.
blocked_mcc_codesarray · string
auto_lock_datestring · date
idempotency_keystring: Prevents a duplicate issue on retry.

Responses

201Successful Response

Schema: SuccessEnvelope_IssuedCardResponse_

successboolean
messagestring
codestring
dataIssuedCardResponse

400Bad Request - Invalid input

401Unauthorized - Authentication required

403Forbidden - Insufficient permissions

404Not Found - Resource does not exist

422Validation Error

Schema: HTTPValidationError

detailarray · ValidationErrorValidationError

5 fields

locarray · string | integerrequired
msgstringrequired
typestringrequired
inputobject
ctxobject

Code samples

POST/api/v1/credit/cards

bash

curl -X POST 'https://api.ondayzero.com/api/v1/credit/cards' \
  -H 'Authorization: Bearer dz_your_token' \
  -H 'x-business-id: YOUR_BUSINESS_ID' \
  -H 'Content-Type: application/json' \
  -d '{
  "credit_line_id": "string"
}'