API

Card

A card: list a profile's cards, get one, update its status or permissions, or reset its PIN count.

Operations

Every route this entity exposes. Each route links to its own reference on this page.

Method Route SDK operation Returns
POST /spend/profiles/{profileId}/cards/{cardToken}/reset-pin-count create PIN count reset successfully
GET /spend/profiles/{profileId}/cards/{cardToken}/spending-permissions list Card permissions retrieved successfully
GET /spend/profiles/{profileId}/cards list List of cards retrieved successfully
GET /spend/profiles/{profileId}/cards/{cardToken} load Card details retrieved successfully
PATCH /spend/profiles/{profileId}/cards/{cardToken}/spending-permissions update Permissions updated successfully
PUT /spend/profiles/{profileId}/cards/{cardToken}/status update Card status updated successfully

Examples

One example per SDK, generated from the API model. The argument names are the parameters and fields of this entity, and the values are placeholders. The examples are not compiled or executed.

Golang

Construct client as shown in the Golang setup, then call the operations:

cards, err := client.Card(nil).List(map[string]any{"profile_id": 1}, nil)
if err != nil {
    panic(err)
}
fmt.Println(cards)
card, err := client.Card(nil).Load(map[string]any{"id": "example_id", "profile_id": 1}, nil)
if err != nil {
    panic(err)
}
fmt.Println(card)
created, err := client.Card(nil).Create(map[string]any{"card_token": "example", "profile_id": 1}, nil)
if err != nil {
    panic(err)
}
fmt.Println(created)

Lua

Construct client as shown in the Lua setup, then call the operations:

local cards, err = client:Card():list({ profile_id = 1 })
local card, err = client:Card():load({ id = "example_id", profile_id = 1 })
local created, err = client:Card():create({ card_token = "example", profile_id = 1 })

PHP

Construct client as shown in the PHP setup, then call the operations:

$cards = $client->Card()->list(["profile_id" => 1]);
$card = $client->Card()->load(["id" => "example_id", "profile_id" => 1]);
$created = $client->Card()->create(["card_token" => "example", "profile_id" => 1]);

Python

Construct client as shown in the Python setup, then call the operations:

cards = client.Card().list({"profile_id": 1})
card = client.Card().load({"id": "example_id", "profile_id": 1})
created = client.Card().create({ "card_token": "example", "profile_id": 1 })

Ruby

Construct client as shown in the Ruby setup, then call the operations:

cards = client.Card.list({ "profile_id" => 1 })
card = client.Card.load({ "id" => "example_id", "profile_id" => 1 })
created = client.Card.create({ "card_token" => "example", "profile_id" => 1 })

TypeScript

Construct client as shown in the TypeScript setup, then call the operations:

const cards = await client.Card().list({ profile_id: 1 })
const card = await client.Card().load({ id: "example_id", profile_id: 1 })
const created = await client.Card().create({ card_token: "example", profile_id: 1 })

Fields

Field Type Required Description
bankIdentificationNumber string No Bank identification number (BIN) of the card.
cardHolderName string No Name of the card holder.
cardProgram object No Card program details.
clientId string No Client ID of the partner that issued the card.
creationTime string No Time when the card was created.
expiryDate string No Date when the card will expire.
id string No Id
lastFourDigits string No Last 4 digits of the card number.
modificationTime string No Time when the card was last modified.
phoneNumber string No Phone number associated with the card.
profileId integer No Profile ID that owns this card.
status object No Current status of the card.
token string No Unique identifier for the card.
unlockSpendingPermissions string No Method with which physical card spending permissions can be unlocked.

create

POST /spend/profiles/{profileId}/cards/{cardToken}/reset-pin-count

Operation ID: cardPinCountReset.

Authentication: bearer token (UserToken).

Parameters

Parameter In Type Required Description
profileId path integer (int64) Yes The ID of the profile that owns the card.
cardToken path string (uuid) Yes The unique token identifying the card.
X-External-Correlation-Id header string (uuid) No Optional UUID for correlating requests across systems. If provided, Wise echoes it back in the response. Maximum 36 characters. Learn more.

Responses

200: PIN count reset successfully
429: Rate limit exceeded. Retry after the number of seconds specified in the Retry-After header

application/json

The response is object.

list

GET /spend/profiles/{profileId}/cards/{cardToken}/spending-permissions

Operation ID: cardPermissionsGet.

Authentication: bearer token (UserToken).

Parameters

Parameter In Type Required Description
profileId path integer (int64) Yes The ID of the profile that owns the card.
cardToken path string (uuid) Yes The unique token identifying the card.
X-External-Correlation-Id header string (uuid) No Optional UUID for correlating requests across systems. If provided, Wise echoes it back in the response. Maximum 36 characters. Learn more.

Responses

200: Card permissions retrieved successfully

application/json

Property Type Required Description
permissions array of object No List of spending permissions for this card.
permissions[].isEnabled boolean Yes Indicates if this permission type is enabled.
permissions[].isLocked boolean No Indicates if this permission is locked. If true, this permission cannot be updated.
permissions[].type enum: ECOM, POS_CHIP, POS_MAGSTRIPE, POS_CONTACTLESS, ATM_WITHDRAWAL, MOBILE_WALLETS Yes The type of transaction this permission controls. Permissions available on all cards: - ECOM - Online transactions - ATM_WITHDRAWAL - ATM withdrawals - MOBILE_WALLETS - Digital wallet payments (Apple Pay, Google Pay) Additional permissions available on physical cards: - POS_MAGSTRIPE - Physical point-of-sale transactions with magnetic stripe - POS_CONTACTLESS - Physical point-of-sale contactless transactions - POS_CHIP - Physical point-of-sale transactions with chip Virtual cards do not return physical point-of-sale permissions. Only permissions returned for the card can be updated.

Example response:

{
  "permissions": [
    {
      "isEnabled": false,
      "isLocked": false,
      "type": "ECOM"
    },
    {
      "isEnabled": true,
      "isLocked": false,
      "type": "POS_CHIP"
    },
    {
      "isEnabled": false,
      "isLocked": false,
      "type": "ATM_WITHDRAWAL"
    },
    {
      "isEnabled": true,
      "isLocked": false,
      "type": "MOBILE_WALLETS"
    },
    {
      "isEnabled": false,
      "isLocked": true,
      "type": "POS_CONTACTLESS"
    },
    {
      "isEnabled": false,
      "isLocked": true,
      "type": "POS_MAGSTRIPE"
    }
  ]
}
429: Rate limit exceeded. Retry after the number of seconds specified in the Retry-After header

application/json

The response is object.

GET /spend/profiles/{profileId}/cards

Operation ID: cardList.

Authentication: bearer token (UserToken).

Parameters

Parameter In Type Required Description
profileId path integer (int64) Yes The ID of the profile to retrieve cards for.
pageSize query integer (int64) No The maximum number of cards to return per page. Must be between 10 and 100.
pageNumber query integer (int64) No The page number to retrieve. Must be greater than or equal to 1.
X-External-Correlation-Id header string (uuid) No Optional UUID for correlating requests across systems. If provided, Wise echoes it back in the response. Maximum 36 characters. Learn more.

Responses

200: List of cards retrieved successfully

application/json

Property Type Required Description
cards array of object No Collection of cards for this profile.
cards[].bankIdentificationNumber string No Bank identification number (BIN) of the card.
cards[].cardHolderName string No Name of the card holder.
cards[].cardProgram object No Card program details.
cards[].cardProgram.cardType string No Type of the card. for example PHYSICAL or VIRTUAL.
cards[].cardProgram.defaultCurrency string No Default currency of the card.
cards[].cardProgram.name string No Name of the card program.
cards[].cardProgram.scheme enum: VISA, MASTERCARD No Card network scheme.
cards[].clientId string No Client ID of the partner that issued the card.
cards[].creationTime string (date-time) No Time when the card was created.
cards[].expiryDate string (date-time) No Date when the card will expire.
cards[].lastFourDigits string No Last 4 digits of the card number.
cards[].modificationTime string (date-time) No Time when the card was last modified.
cards[].phoneNumber string No Phone number associated with the card.
cards[].profileId integer (int64) No Profile ID that owns this card.
cards[].status object No Current status of the card.
cards[].status.value enum: ACTIVE, INACTIVE, BLOCKED, FROZEN, PARTNER_SUSPENDED, EXPIRED, ... No Status value. One of: - ACTIVE - Card is active and can be used - INACTIVE - Card is inactive and all transactions will be declined - BLOCKED - Card is blocked and cannot be reversed back to any state - FROZEN - Card is temporarily frozen; all authorization requests will be declined - PARTNER_SUSPENDED - Card is suspended by Wise temporarily (do not display to end customers) - EXPIRED - Card is expired - PURGED - Cardholder data (for example PAN, PIN) has been purged after the retention period (555 days after the card's expiry date)
cards[].token string No Unique identifier for the card.
cards[].unlockSpendingPermissions enum: WITH_PARTNER_API, WITH_FIRST_CHIP_AND_PIN_TRANSACTION, NONE No Method with which physical card spending permissions can be unlocked. One of: - WITH_PARTNER_API - Unlock via Partner API - WITH_FIRST_CHIP_AND_PIN_TRANSACTION - Unlock with first chip and PIN transaction - NONE - Not applicable (for virtual cards)
totalCount integer (int64) No The total number of cards for this profile.
429: Rate limit exceeded. Retry after the number of seconds specified in the Retry-After header

application/json

The response is object.

load

GET /spend/profiles/{profileId}/cards/{cardToken}

Operation ID: cardGet.

Authentication: bearer token (UserToken).

Parameters

Parameter In Type Required Description
profileId path integer (int64) Yes The ID of the profile that owns the card.
cardToken path string (uuid) Yes The unique token identifying the card.
X-External-Correlation-Id header string (uuid) No Optional UUID for correlating requests across systems. If provided, Wise echoes it back in the response. Maximum 36 characters. Learn more.

Responses

200: Card details retrieved successfully

application/json

Property Type Required Description
bankIdentificationNumber string No Bank identification number (BIN) of the card.
cardHolderName string No Name of the card holder.
cardProgram object No Card program details.
cardProgram.cardType string No Type of the card. for example PHYSICAL or VIRTUAL.
cardProgram.defaultCurrency string No Default currency of the card.
cardProgram.name string No Name of the card program.
cardProgram.scheme enum: VISA, MASTERCARD No Card network scheme.
clientId string No Client ID of the partner that issued the card.
creationTime string (date-time) No Time when the card was created.
expiryDate string (date-time) No Date when the card will expire.
lastFourDigits string No Last 4 digits of the card number.
modificationTime string (date-time) No Time when the card was last modified.
phoneNumber string No Phone number associated with the card.
profileId integer (int64) No Profile ID that owns this card.
status object No Current status of the card.
status.value enum: ACTIVE, INACTIVE, BLOCKED, FROZEN, PARTNER_SUSPENDED, EXPIRED, ... No Status value. One of: - ACTIVE - Card is active and can be used - INACTIVE - Card is inactive and all transactions will be declined - BLOCKED - Card is blocked and cannot be reversed back to any state - FROZEN - Card is temporarily frozen; all authorization requests will be declined - PARTNER_SUSPENDED - Card is suspended by Wise temporarily (do not display to end customers) - EXPIRED - Card is expired - PURGED - Cardholder data (for example PAN, PIN) has been purged after the retention period (555 days after the card's expiry date)
token string No Unique identifier for the card.
unlockSpendingPermissions enum: WITH_PARTNER_API, WITH_FIRST_CHIP_AND_PIN_TRANSACTION, NONE No Method with which physical card spending permissions can be unlocked. One of: - WITH_PARTNER_API - Unlock via Partner API - WITH_FIRST_CHIP_AND_PIN_TRANSACTION - Unlock with first chip and PIN transaction - NONE - Not applicable (for virtual cards)
429: Rate limit exceeded. Retry after the number of seconds specified in the Retry-After header

application/json

The response is object.

update

PATCH /spend/profiles/{profileId}/cards/{cardToken}/spending-permissions

Operation ID: cardPermissionsBulkUpdate.

Authentication: bearer token (UserToken).

Parameters

Parameter In Type Required Description
profileId path integer (int64) Yes The ID of the profile that owns the card.
cardToken path string (uuid) Yes The unique token identifying the card.
X-External-Correlation-Id header string (uuid) No Optional UUID for correlating requests across systems. If provided, Wise echoes it back in the response. Maximum 36 characters. Learn more.

Request body

application/json

Property Type Required Description
permissions array of object Yes List of permissions to update.
permissions[].isEnabled boolean Yes Indicates if this permission type is enabled.
permissions[].isLocked boolean No Indicates if this permission is locked. If true, this permission cannot be updated.
permissions[].type enum: ECOM, POS_CHIP, POS_MAGSTRIPE, POS_CONTACTLESS, ATM_WITHDRAWAL, MOBILE_WALLETS Yes The type of transaction this permission controls. Permissions available on all cards: - ECOM - Online transactions - ATM_WITHDRAWAL - ATM withdrawals - MOBILE_WALLETS - Digital wallet payments (Apple Pay, Google Pay) Additional permissions available on physical cards: - POS_MAGSTRIPE - Physical point-of-sale transactions with magnetic stripe - POS_CONTACTLESS - Physical point-of-sale contactless transactions - POS_CHIP - Physical point-of-sale transactions with chip Virtual cards do not return physical point-of-sale permissions. Only permissions returned for the card can be updated.

Example request body:

{
  "permissions": [
    {
      "isEnabled": true,
      "type": "ECOM"
    },
    {
      "isEnabled": true,
      "type": "POS_CHIP"
    }
  ]
}

Responses

200: Permissions updated successfully
400: Bad request. The requested permission type is not recognized. No permissions are updated.

application/json

Property Type Required Description
message string No Error message describing the invalid permission type.
422: Unprocessable entity. The request is syntactically valid but cannot be fulfilled because a requested permission is not supported by this card type, or the permission is locked and cannot be changed. No permissions are updated.

application/json

Property Type Required Description
message string No Error message describing why the permission update was rejected.
429: Rate limit exceeded. Retry after the number of seconds specified in the Retry-After header

application/json

The response is object.

PUT /spend/profiles/{profileId}/cards/{cardToken}/status

Operation ID: cardStatusUpdate.

Authentication: bearer token (UserToken).

Parameters

Parameter In Type Required Description
profileId path integer (int64) Yes The ID of the profile that owns the card.
cardToken path string (uuid) Yes The unique token identifying the card.
X-External-Correlation-Id header string (uuid) No Optional UUID for correlating requests across systems. If provided, Wise echoes it back in the response. Maximum 36 characters. Learn more.

Request body

application/json

Property Type Required Description
status enum: ACTIVE, FROZEN, BLOCKED Yes The status to update the card to.

Example request body:

{
  "status": "ACTIVE"
}

Responses

200: Card status updated successfully

application/json

Property Type Required Description
bankIdentificationNumber string No Bank identification number (BIN) of the card.
cardHolderName string No Name of the card holder.
cardProgram object No Card program details.
cardProgram.cardType string No Type of the card. for example PHYSICAL or VIRTUAL.
cardProgram.defaultCurrency string No Default currency of the card.
cardProgram.name string No Name of the card program.
cardProgram.scheme enum: VISA, MASTERCARD No Card network scheme.
clientId string No Client ID of the partner that issued the card.
creationTime string (date-time) No Time when the card was created.
expiryDate string (date-time) No Date when the card will expire.
lastFourDigits string No Last 4 digits of the card number.
modificationTime string (date-time) No Time when the card was last modified.
phoneNumber string No Phone number associated with the card.
profileId integer (int64) No Profile ID that owns this card.
status object No Current status of the card.
status.value enum: ACTIVE, INACTIVE, BLOCKED, FROZEN, PARTNER_SUSPENDED, EXPIRED, ... No Status value. One of: - ACTIVE - Card is active and can be used - INACTIVE - Card is inactive and all transactions will be declined - BLOCKED - Card is blocked and cannot be reversed back to any state - FROZEN - Card is temporarily frozen; all authorization requests will be declined - PARTNER_SUSPENDED - Card is suspended by Wise temporarily (do not display to end customers) - EXPIRED - Card is expired - PURGED - Cardholder data (for example PAN, PIN) has been purged after the retention period (555 days after the card's expiry date)
token string No Unique identifier for the card.
unlockSpendingPermissions enum: WITH_PARTNER_API, WITH_FIRST_CHIP_AND_PIN_TRANSACTION, NONE No Method with which physical card spending permissions can be unlocked. One of: - WITH_PARTNER_API - Unlock via Partner API - WITH_FIRST_CHIP_AND_PIN_TRANSACTION - Unlock with first chip and PIN transaction - NONE - Not applicable (for virtual cards)
429: Rate limit exceeded. Retry after the number of seconds specified in the Retry-After header

application/json

The response is object.