> ## Documentation Index > Fetch the complete documentation index at: https://docs.whop.com/llms.txt > Use this file to discover all available pages before exploring further. # Create Card > Issues a virtual card. For an individual (consumer) card issuing account, the card is issued to the account's own cardholder. For a company (business) card issuing account, pass assigned_user_id to issue the card to a company member; if that member is not yet an approved card-issuing user, the card is provisioned asynchronously or an onboarding invitation is sent (HTTP 202). Pass exactly one of account_id (a biz_ identifier) or user_id (a user_ identifier). Returns the newly created card resource. ## OpenAPI ````yaml /openapi/api-v1-native.yml post /cards openapi: 3.1.0 info: title: Whop API description: >- Hand-written V1 endpoints. Merged into the GraphqlRestProxy-generated schema at build time. version: v1 servers: - url: https://{defaultHost} variables: defaultHost: default: api.whop.com/api/v1 security: [] paths: /cards: parameters: - $ref: '#/components/parameters/ApiVersionDate' post: tags: - Cards summary: Create Card description: >- Issues a virtual card. For an individual (consumer) card issuing account, the card is issued to the account's own cardholder. For a company (business) card issuing account, pass assigned_user_id to issue the card to a company member; if that member is not yet an approved card-issuing user, the card is provisioned asynchronously or an onboarding invitation is sent (HTTP 202). Pass exactly one of account_id (a biz_ identifier) or user_id (a user_ identifier). Returns the newly created card resource. operationId: createCard parameters: [] requestBody: content: application/json: schema: type: object properties: account_id: type: string description: >- The owning account ID (a biz_ identifier). Provide this or user_id. user_id: type: string description: >- The owning user ID (a user_ identifier). Provide this or account_id. assigned_user_id: type: string description: >- The company member (a user_ identifier) to assign the card to. Required for company (business) card issuing accounts. name: type: string description: A display name for the card. spend_limit: type: number description: Spending limit amount, in dollars. spend_limit_frequency: type: string enum: - daily - weekly - monthly - one_time description: The spending limit window. transaction_limit: type: number description: Per-transaction limit amount, in dollars. required: true responses: '201': description: company card created for an assigned member content: application/json: schema: type: object properties: object: type: string enum: - card id: type: string description: Card ID, prefixed `icrd_`. name: type: - string - 'null' description: Card display name. type: type: - string - 'null' enum: - null - virtual - physical description: The card type. status: type: - string - 'null' enum: - null - active - frozen - canceled - invited description: The card status. last4: type: - string - 'null' description: >- Last four digits of the card number. `null` for pending invitation cards. expiration_month: type: - string - 'null' description: Card expiration month. expiration_year: type: - string - 'null' description: Card expiration year. user_id: type: - string - 'null' description: Cardholder user ID, prefixed `user_`, when assigned. spent_last_month: type: - integer - 'null' description: Total spend in the last 30 days, in cents. limit: type: - object - 'null' description: The spending limit configuration. properties: amount: type: number description: The limit amount in dollars. frequency: type: string description: >- Limit window, for example `per24HourPeriod` or `perAuthorization`. required: - amount - frequency billing: type: - object - 'null' description: The billing address. properties: line1: type: - string - 'null' description: Street address line 1. line2: type: - string - 'null' description: Street address line 2. city: type: - string - 'null' description: Billing city. region: type: - string - 'null' description: Billing region or state. postal_code: type: - string - 'null' description: Billing postal code. country_code: type: - string - 'null' description: Billing country code. required: - line1 - line2 - city - region - postal_code - country_code created_at: type: - string - 'null' format: date-time description: When the card was created. canceled_at: type: - string - 'null' format: date-time description: When the card was canceled. secrets: type: - object - 'null' description: >- Sensitive card details. Present only on `GET /cards/:card_id` for active cards; `null` when the card is inactive or details cannot be retrieved. properties: card_number: type: string description: Full card number. cvc: type: string description: Card verification code. name_on_card: type: - string - 'null' description: Cardholder name printed on the card. required: - card_number - cvc - name_on_card required: - object - id - name - type - status - last4 - expiration_month - expiration_year - user_id - spent_last_month - limit - billing - created_at - canceled_at '202': description: >- card not issued synchronously: provisioning started or onboarding invitation sent content: application/json: schema: oneOf: - type: object properties: object: type: string enum: - card_provisioning provisioning_job_id: type: string description: Background job ID to poll until the card is ready. required: - object - provisioning_job_id - type: object properties: object: type: string enum: - card_invitation invitation_sent: type: boolean description: >- Always true; the member must finish onboarding before the card is issued. required: - object - invitation_sent '400': $ref: '#/components/responses/InvalidParameters' description: business card issuing account without an assigned_user_id '401': $ref: '#/components/responses/Unauthorized' description: missing or invalid authentication '403': $ref: '#/components/responses/Forbidden' description: credential lacks the payout-account-update scope '404': $ref: '#/components/responses/NotFound' description: no ledger for that owner is visible to the credential security: - bearerAuth: - payout:account:update components: parameters: ApiVersionDate: name: Api-Version-Date in: header required: false schema: type: string format: date example: '2026-07-01' description: Pins the request to a dated API version. responses: InvalidParameters: description: Invalid Parameters content: application/json: schema: $ref: '#/components/schemas/V1ErrorResponse' Unauthorized: description: Unauthorized content: application/json: schema: $ref: '#/components/schemas/V1ErrorResponse' Forbidden: description: Forbidden content: application/json: schema: $ref: '#/components/schemas/V1ErrorResponse' NotFound: description: Resource not found content: application/json: schema: $ref: '#/components/schemas/V1ErrorResponse' schemas: V1ErrorResponse: type: object properties: error: type: object properties: type: type: string description: Machine-readable error code. message: type: string description: Human-readable error message. required: - type - message required: - error securitySchemes: bearerAuth: type: http scheme: bearer bearerFormat: auth-scheme description: >- An account API key, account scoped JWT, app API key, or user OAuth token. ````