Card
A card: list a profile's cards, get one, update its status or permissions, or reset its PIN count.
Operations
Every route this entity exposes. Each route links to its own reference on this page.
| Method | Route | SDK operation | Returns |
|---|---|---|---|
POST |
/spend/profiles/{profileId}/cards/{cardToken}/reset-pin-count |
create |
PIN count reset successfully |
GET |
/spend/profiles/{profileId}/cards/{cardToken}/spending-permissions |
list |
Card permissions retrieved successfully |
GET |
/spend/profiles/{profileId}/cards |
list |
List of cards retrieved successfully |
GET |
/spend/profiles/{profileId}/cards/{cardToken} |
load |
Card details retrieved successfully |
PATCH |
/spend/profiles/{profileId}/cards/{cardToken}/spending-permissions |
update |
Permissions updated successfully |
PUT |
/spend/profiles/{profileId}/cards/{cardToken}/status |
update |
Card status updated successfully |
Examples
One example per SDK, generated from the API model. The argument names are the parameters and fields of this entity, and the values are placeholders. The examples are not compiled or executed.
Golang
Construct client as shown in the Golang setup, then call the operations:
cards, err := client.Card(nil).List(map[string]any{"profile_id": 1}, nil)
if err != nil {
panic(err)
}
fmt.Println(cards)
card, err := client.Card(nil).Load(map[string]any{"id": "example_id", "profile_id": 1}, nil)
if err != nil {
panic(err)
}
fmt.Println(card)
created, err := client.Card(nil).Create(map[string]any{"card_token": "example", "profile_id": 1}, nil)
if err != nil {
panic(err)
}
fmt.Println(created)
Lua
Construct client as shown in the Lua setup, then call the operations:
local cards, err = client:Card():list({ profile_id = 1 })
local card, err = client:Card():load({ id = "example_id", profile_id = 1 })
local created, err = client:Card():create({ card_token = "example", profile_id = 1 })
PHP
Construct client as shown in the PHP setup, then call the operations:
$cards = $client->Card()->list(["profile_id" => 1]);
$card = $client->Card()->load(["id" => "example_id", "profile_id" => 1]);
$created = $client->Card()->create(["card_token" => "example", "profile_id" => 1]);
Python
Construct client as shown in the Python setup, then call the operations:
cards = client.Card().list({"profile_id": 1})
card = client.Card().load({"id": "example_id", "profile_id": 1})
created = client.Card().create({ "card_token": "example", "profile_id": 1 })
Ruby
Construct client as shown in the Ruby setup, then call the operations:
cards = client.Card.list({ "profile_id" => 1 })
card = client.Card.load({ "id" => "example_id", "profile_id" => 1 })
created = client.Card.create({ "card_token" => "example", "profile_id" => 1 })
TypeScript
Construct client as shown in the TypeScript setup, then call the operations:
const cards = await client.Card().list({ profile_id: 1 })
const card = await client.Card().load({ id: "example_id", profile_id: 1 })
const created = await client.Card().create({ card_token: "example", profile_id: 1 })
Fields
| Field | Type | Required | Description |
|---|---|---|---|
bankIdentificationNumber |
string |
No | Bank identification number (BIN) of the card. |
cardHolderName |
string |
No | Name of the card holder. |
cardProgram |
object |
No | Card program details. |
clientId |
string |
No | Client ID of the partner that issued the card. |
creationTime |
string |
No | Time when the card was created. |
expiryDate |
string |
No | Date when the card will expire. |
id |
string |
No | Id |
lastFourDigits |
string |
No | Last 4 digits of the card number. |
modificationTime |
string |
No | Time when the card was last modified. |
phoneNumber |
string |
No | Phone number associated with the card. |
profileId |
integer |
No | Profile ID that owns this card. |
status |
object |
No | Current status of the card. |
token |
string |
No | Unique identifier for the card. |
unlockSpendingPermissions |
string |
No | Method with which physical card spending permissions can be unlocked. |
create
POST /spend/profiles/{profileId}/cards/{cardToken}/reset-pin-count
Operation ID: cardPinCountReset.
Authentication: bearer token (UserToken).
Parameters
| Parameter | In | Type | Required | Description |
|---|---|---|---|---|
profileId |
path |
integer (int64) |
Yes | The ID of the profile that owns the card. |
cardToken |
path |
string (uuid) |
Yes | The unique token identifying the card. |
X-External-Correlation-Id |
header |
string (uuid) |
No | Optional UUID for correlating requests across systems. If provided, Wise echoes it back in the response. Maximum 36 characters. Learn more. |
Responses
200: PIN count reset successfully
429: Rate limit exceeded. Retry after the number of seconds specified in the Retry-After header
application/json
The response is object.
list
GET /spend/profiles/{profileId}/cards/{cardToken}/spending-permissions
Operation ID: cardPermissionsGet.
Authentication: bearer token (UserToken).
Parameters
| Parameter | In | Type | Required | Description |
|---|---|---|---|---|
profileId |
path |
integer (int64) |
Yes | The ID of the profile that owns the card. |
cardToken |
path |
string (uuid) |
Yes | The unique token identifying the card. |
X-External-Correlation-Id |
header |
string (uuid) |
No | Optional UUID for correlating requests across systems. If provided, Wise echoes it back in the response. Maximum 36 characters. Learn more. |
Responses
200: Card permissions retrieved successfully
application/json
| Property | Type | Required | Description |
|---|---|---|---|
permissions |
array of object |
No | List of spending permissions for this card. |
permissions[].isEnabled |
boolean |
Yes | Indicates if this permission type is enabled. |
permissions[].isLocked |
boolean |
No | Indicates if this permission is locked. If true, this permission cannot be updated. |
permissions[].type |
enum: ECOM, POS_CHIP, POS_MAGSTRIPE, POS_CONTACTLESS, ATM_WITHDRAWAL, MOBILE_WALLETS |
Yes | The type of transaction this permission controls. Permissions available on all cards: - ECOM - Online transactions - ATM_WITHDRAWAL - ATM withdrawals - MOBILE_WALLETS - Digital wallet payments (Apple Pay, Google Pay) Additional permissions available on physical cards: - POS_MAGSTRIPE - Physical point-of-sale transactions with magnetic stripe - POS_CONTACTLESS - Physical point-of-sale contactless transactions - POS_CHIP - Physical point-of-sale transactions with chip Virtual cards do not return physical point-of-sale permissions. Only permissions returned for the card can be updated. |
Example response:
{
"permissions": [
{
"isEnabled": false,
"isLocked": false,
"type": "ECOM"
},
{
"isEnabled": true,
"isLocked": false,
"type": "POS_CHIP"
},
{
"isEnabled": false,
"isLocked": false,
"type": "ATM_WITHDRAWAL"
},
{
"isEnabled": true,
"isLocked": false,
"type": "MOBILE_WALLETS"
},
{
"isEnabled": false,
"isLocked": true,
"type": "POS_CONTACTLESS"
},
{
"isEnabled": false,
"isLocked": true,
"type": "POS_MAGSTRIPE"
}
]
}
429: Rate limit exceeded. Retry after the number of seconds specified in the Retry-After header
application/json
The response is object.
GET /spend/profiles/{profileId}/cards
Operation ID: cardList.
Authentication: bearer token (UserToken).
Parameters
| Parameter | In | Type | Required | Description |
|---|---|---|---|---|
profileId |
path |
integer (int64) |
Yes | The ID of the profile to retrieve cards for. |
pageSize |
query |
integer (int64) |
No | The maximum number of cards to return per page. Must be between 10 and 100. |
pageNumber |
query |
integer (int64) |
No | The page number to retrieve. Must be greater than or equal to 1. |
X-External-Correlation-Id |
header |
string (uuid) |
No | Optional UUID for correlating requests across systems. If provided, Wise echoes it back in the response. Maximum 36 characters. Learn more. |
Responses
200: List of cards retrieved successfully
application/json
| Property | Type | Required | Description |
|---|---|---|---|
cards |
array of object |
No | Collection of cards for this profile. |
cards[].bankIdentificationNumber |
string |
No | Bank identification number (BIN) of the card. |
cards[].cardHolderName |
string |
No | Name of the card holder. |
cards[].cardProgram |
object |
No | Card program details. |
cards[].cardProgram.cardType |
string |
No | Type of the card. for example PHYSICAL or VIRTUAL. |
cards[].cardProgram.defaultCurrency |
string |
No | Default currency of the card. |
cards[].cardProgram.name |
string |
No | Name of the card program. |
cards[].cardProgram.scheme |
enum: VISA, MASTERCARD |
No | Card network scheme. |
cards[].clientId |
string |
No | Client ID of the partner that issued the card. |
cards[].creationTime |
string (date-time) |
No | Time when the card was created. |
cards[].expiryDate |
string (date-time) |
No | Date when the card will expire. |
cards[].lastFourDigits |
string |
No | Last 4 digits of the card number. |
cards[].modificationTime |
string (date-time) |
No | Time when the card was last modified. |
cards[].phoneNumber |
string |
No | Phone number associated with the card. |
cards[].profileId |
integer (int64) |
No | Profile ID that owns this card. |
cards[].status |
object |
No | Current status of the card. |
cards[].status.value |
enum: ACTIVE, INACTIVE, BLOCKED, FROZEN, PARTNER_SUSPENDED, EXPIRED, ... |
No | Status value. One of: - ACTIVE - Card is active and can be used - INACTIVE - Card is inactive and all transactions will be declined - BLOCKED - Card is blocked and cannot be reversed back to any state - FROZEN - Card is temporarily frozen; all authorization requests will be declined - PARTNER_SUSPENDED - Card is suspended by Wise temporarily (do not display to end customers) - EXPIRED - Card is expired - PURGED - Cardholder data (for example PAN, PIN) has been purged after the retention period (555 days after the card's expiry date) |
cards[].token |
string |
No | Unique identifier for the card. |
cards[].unlockSpendingPermissions |
enum: WITH_PARTNER_API, WITH_FIRST_CHIP_AND_PIN_TRANSACTION, NONE |
No | Method with which physical card spending permissions can be unlocked. One of: - WITH_PARTNER_API - Unlock via Partner API - WITH_FIRST_CHIP_AND_PIN_TRANSACTION - Unlock with first chip and PIN transaction - NONE - Not applicable (for virtual cards) |
totalCount |
integer (int64) |
No | The total number of cards for this profile. |
429: Rate limit exceeded. Retry after the number of seconds specified in the Retry-After header
application/json
The response is object.
load
GET /spend/profiles/{profileId}/cards/{cardToken}
Operation ID: cardGet.
Authentication: bearer token (UserToken).
Parameters
| Parameter | In | Type | Required | Description |
|---|---|---|---|---|
profileId |
path |
integer (int64) |
Yes | The ID of the profile that owns the card. |
cardToken |
path |
string (uuid) |
Yes | The unique token identifying the card. |
X-External-Correlation-Id |
header |
string (uuid) |
No | Optional UUID for correlating requests across systems. If provided, Wise echoes it back in the response. Maximum 36 characters. Learn more. |
Responses
200: Card details retrieved successfully
application/json
| Property | Type | Required | Description |
|---|---|---|---|
bankIdentificationNumber |
string |
No | Bank identification number (BIN) of the card. |
cardHolderName |
string |
No | Name of the card holder. |
cardProgram |
object |
No | Card program details. |
cardProgram.cardType |
string |
No | Type of the card. for example PHYSICAL or VIRTUAL. |
cardProgram.defaultCurrency |
string |
No | Default currency of the card. |
cardProgram.name |
string |
No | Name of the card program. |
cardProgram.scheme |
enum: VISA, MASTERCARD |
No | Card network scheme. |
clientId |
string |
No | Client ID of the partner that issued the card. |
creationTime |
string (date-time) |
No | Time when the card was created. |
expiryDate |
string (date-time) |
No | Date when the card will expire. |
lastFourDigits |
string |
No | Last 4 digits of the card number. |
modificationTime |
string (date-time) |
No | Time when the card was last modified. |
phoneNumber |
string |
No | Phone number associated with the card. |
profileId |
integer (int64) |
No | Profile ID that owns this card. |
status |
object |
No | Current status of the card. |
status.value |
enum: ACTIVE, INACTIVE, BLOCKED, FROZEN, PARTNER_SUSPENDED, EXPIRED, ... |
No | Status value. One of: - ACTIVE - Card is active and can be used - INACTIVE - Card is inactive and all transactions will be declined - BLOCKED - Card is blocked and cannot be reversed back to any state - FROZEN - Card is temporarily frozen; all authorization requests will be declined - PARTNER_SUSPENDED - Card is suspended by Wise temporarily (do not display to end customers) - EXPIRED - Card is expired - PURGED - Cardholder data (for example PAN, PIN) has been purged after the retention period (555 days after the card's expiry date) |
token |
string |
No | Unique identifier for the card. |
unlockSpendingPermissions |
enum: WITH_PARTNER_API, WITH_FIRST_CHIP_AND_PIN_TRANSACTION, NONE |
No | Method with which physical card spending permissions can be unlocked. One of: - WITH_PARTNER_API - Unlock via Partner API - WITH_FIRST_CHIP_AND_PIN_TRANSACTION - Unlock with first chip and PIN transaction - NONE - Not applicable (for virtual cards) |
429: Rate limit exceeded. Retry after the number of seconds specified in the Retry-After header
application/json
The response is object.
update
PATCH /spend/profiles/{profileId}/cards/{cardToken}/spending-permissions
Operation ID: cardPermissionsBulkUpdate.
Authentication: bearer token (UserToken).
Parameters
| Parameter | In | Type | Required | Description |
|---|---|---|---|---|
profileId |
path |
integer (int64) |
Yes | The ID of the profile that owns the card. |
cardToken |
path |
string (uuid) |
Yes | The unique token identifying the card. |
X-External-Correlation-Id |
header |
string (uuid) |
No | Optional UUID for correlating requests across systems. If provided, Wise echoes it back in the response. Maximum 36 characters. Learn more. |
Request body
application/json
| Property | Type | Required | Description |
|---|---|---|---|
permissions |
array of object |
Yes | List of permissions to update. |
permissions[].isEnabled |
boolean |
Yes | Indicates if this permission type is enabled. |
permissions[].isLocked |
boolean |
No | Indicates if this permission is locked. If true, this permission cannot be updated. |
permissions[].type |
enum: ECOM, POS_CHIP, POS_MAGSTRIPE, POS_CONTACTLESS, ATM_WITHDRAWAL, MOBILE_WALLETS |
Yes | The type of transaction this permission controls. Permissions available on all cards: - ECOM - Online transactions - ATM_WITHDRAWAL - ATM withdrawals - MOBILE_WALLETS - Digital wallet payments (Apple Pay, Google Pay) Additional permissions available on physical cards: - POS_MAGSTRIPE - Physical point-of-sale transactions with magnetic stripe - POS_CONTACTLESS - Physical point-of-sale contactless transactions - POS_CHIP - Physical point-of-sale transactions with chip Virtual cards do not return physical point-of-sale permissions. Only permissions returned for the card can be updated. |
Example request body:
{
"permissions": [
{
"isEnabled": true,
"type": "ECOM"
},
{
"isEnabled": true,
"type": "POS_CHIP"
}
]
}
Responses
200: Permissions updated successfully
400: Bad request. The requested permission type is not recognized. No permissions are updated.
application/json
| Property | Type | Required | Description |
|---|---|---|---|
message |
string |
No | Error message describing the invalid permission type. |
422: Unprocessable entity. The request is syntactically valid but cannot be fulfilled because a requested permission is not supported by this card type, or the permission is locked and cannot be changed. No permissions are updated.
application/json
| Property | Type | Required | Description |
|---|---|---|---|
message |
string |
No | Error message describing why the permission update was rejected. |
429: Rate limit exceeded. Retry after the number of seconds specified in the Retry-After header
application/json
The response is object.
PUT /spend/profiles/{profileId}/cards/{cardToken}/status
Operation ID: cardStatusUpdate.
Authentication: bearer token (UserToken).
Parameters
| Parameter | In | Type | Required | Description |
|---|---|---|---|---|
profileId |
path |
integer (int64) |
Yes | The ID of the profile that owns the card. |
cardToken |
path |
string (uuid) |
Yes | The unique token identifying the card. |
X-External-Correlation-Id |
header |
string (uuid) |
No | Optional UUID for correlating requests across systems. If provided, Wise echoes it back in the response. Maximum 36 characters. Learn more. |
Request body
application/json
| Property | Type | Required | Description |
|---|---|---|---|
status |
enum: ACTIVE, FROZEN, BLOCKED |
Yes | The status to update the card to. |
Example request body:
{
"status": "ACTIVE"
}
Responses
200: Card status updated successfully
application/json
| Property | Type | Required | Description |
|---|---|---|---|
bankIdentificationNumber |
string |
No | Bank identification number (BIN) of the card. |
cardHolderName |
string |
No | Name of the card holder. |
cardProgram |
object |
No | Card program details. |
cardProgram.cardType |
string |
No | Type of the card. for example PHYSICAL or VIRTUAL. |
cardProgram.defaultCurrency |
string |
No | Default currency of the card. |
cardProgram.name |
string |
No | Name of the card program. |
cardProgram.scheme |
enum: VISA, MASTERCARD |
No | Card network scheme. |
clientId |
string |
No | Client ID of the partner that issued the card. |
creationTime |
string (date-time) |
No | Time when the card was created. |
expiryDate |
string (date-time) |
No | Date when the card will expire. |
lastFourDigits |
string |
No | Last 4 digits of the card number. |
modificationTime |
string (date-time) |
No | Time when the card was last modified. |
phoneNumber |
string |
No | Phone number associated with the card. |
profileId |
integer (int64) |
No | Profile ID that owns this card. |
status |
object |
No | Current status of the card. |
status.value |
enum: ACTIVE, INACTIVE, BLOCKED, FROZEN, PARTNER_SUSPENDED, EXPIRED, ... |
No | Status value. One of: - ACTIVE - Card is active and can be used - INACTIVE - Card is inactive and all transactions will be declined - BLOCKED - Card is blocked and cannot be reversed back to any state - FROZEN - Card is temporarily frozen; all authorization requests will be declined - PARTNER_SUSPENDED - Card is suspended by Wise temporarily (do not display to end customers) - EXPIRED - Card is expired - PURGED - Cardholder data (for example PAN, PIN) has been purged after the retention period (555 days after the card's expiry date) |
token |
string |
No | Unique identifier for the card. |
unlockSpendingPermissions |
enum: WITH_PARTNER_API, WITH_FIRST_CHIP_AND_PIN_TRANSACTION, NONE |
No | Method with which physical card spending permissions can be unlocked. One of: - WITH_PARTNER_API - Unlock via Partner API - WITH_FIRST_CHIP_AND_PIN_TRANSACTION - Unlock with first chip and PIN transaction - NONE - Not applicable (for virtual cards) |
429: Rate limit exceeded. Retry after the number of seconds specified in the Retry-After header
application/json
The response is object.