# Create card

Creates a new card.
The spend_controls field is required when limit_type = CARD.
The mailing_address field is required for physical cards and is the shipping address used to send the card; it is not the same as the billing and mailing address used for online purchases.
The first 2 lines of this address must be under 60 characters long. Each user can only have up to 10 active physical cards.
For Empower accounts, this endpoint requires budget management. If your account does not have access to budget management features, a 403 response status will be returned. 
If this is the case and you want to gain access to this endpoint, please contact Brex support.

Endpoint: POST /v2/cards
Version: 1.0
Security: OAuth2

## Header parameters:

  - `Idempotency-Key` (string, required)

## Request fields (application/json):

  - `owner` (object, required)

  - `card_name` (string, required)

  - `card_type` (string, required)
    Enum: "VIRTUAL", "PHYSICAL"

  - `limit_type` (string, required)
    limit_type = CARD for vendor cards. Vendor cards must have a card_type of VIRTUAL 
and do not rely on the user specific limit. 

For corporate cards, limit_type = USER.

Learn more about different card types [here](https://support.brex.com/what-are-the-different-types-of-cards-i-can-get/).
    Enum: "CARD", "USER"

  - `spend_controls` (object,null)
    When limit_type = CARD, spend_controls must be set. When limit type = USER, spend_controls must be null.

  - `spend_controls.spend_limit` (object, required)
    Money fields can be signed or unsigned. Fields are signed (an unsigned value will be interpreted as positive). The amount of money will be represented in the smallest denomination
of the currency indicated. For example, USD 7.00 will be represented in cents with an amount of 700.

  - `spend_controls.spend_limit.amount` (integer, required)
    The amount of money, in the smallest denomination of the currency indicated by currency. For example, when currency is USD, amount is in cents.
    Example: 700

  - `spend_controls.spend_limit.currency` (string,null)
    The type of currency, in ISO 4217 format.
    Example: "USD"

  - `spend_controls.spend_duration` (string, required)
    Spend limit refresh frequency
    - MONTHLY: The spend limit refreshes every month
    - QUARTERLY: The spend limit refreshes every quarter
    - YEARLY: The spend limit refreshes every year
    - ONE_TIME: The limit does not refresh
    Enum: "MONTHLY", "QUARTERLY", "YEARLY", "ONE_TIME"

  - `spend_controls.reason` (string,null)

  - `spend_controls.lock_after_date` (string,null)

  - `spend_controls.parent_budget_id` (string,null)
    If using the Empower platform, a new budget will be created for this card. You can specify a parent_budget that your new
budget will be nested under. If parent_budget_id is null, we will nest the new budget under the top-level account budget.

  - `spend_controls.policy_id` (string,null)

  - `spend_controls.allowed_merchant_details` (array,null)
    List of merchants where card transactions are allowed. Cannot be used together with blocked_merchant_details. Maximum 50 
merchant details.
    Example: "[{\"name\": \"Github\"}, {\"name\": \"AWS\"}]"

  - `spend_controls.allowed_merchant_details.name` (string, required)
    The name of the merchant.
    Example: "Github"

  - `spend_controls.blocked_merchant_details` (array,null)
    List of merchants where card transactions are blocked. Cannot be used together with allowed_merchant_details. Maximum 50 
merchant details.
    Example: "[{\"name\": \"Apple\"}, {\"name\": \"Amazon\"}]"

  - `mailing_address` (object,null)
    Company business address (must be in the US; no PO box or virtual/forwarding addresses allowed).

  - `mailing_address.line1` (string,null)
    Address line 1, no PO Box.

  - `mailing_address.line2` (string,null)
    Address line 2 (e.g., apartment, suite, unit, or building).

  - `mailing_address.city` (string,null)
    City, district, suburb, town, or village.

  - `mailing_address.state` (string,null)
    For US-addressed the 2-letter State abbreviation. For international-addresses the county, providence, or region.

  - `mailing_address.country` (string,null)
    Two-letter country code (ISO 3166-1 alpha-2).

  - `mailing_address.postal_code` (string,null)
    ZIP or postal code.

  - `mailing_address.phone_number` (string,null)
    Phone number.

  - `metadata` (object,null)
    Set of key value pairs associated with this object. Please do not store any personally identifiable or sensitive information here.
Limitations: maximum of 50 keys, keys cannot exceed 40 characters, values cannot exceed 500 characters.

  - `card_attribute_preferences` (object,null)

  - `card_attribute_preferences.three_domain_secure_enabled_preference` (string,null)
    Whether to enable 3-D secure protocol on this card.
    Enum: "THREE_DOMAIN_SECURE_ENABLED", "THREE_DOMAIN_SECURE_DISABLED"

## Response 200 fields (application/json):

  - `id` (string, required)

  - `owner` (object, required)

  - `status` (string,null)
    Enum: "ACTIVE", "SHIPPED", "LOCKED", "TERMINATED"

  - `last_four` (string, required)

  - `card_name` (string, required)

  - `card_type` (string,null)
    Enum: "VIRTUAL", "PHYSICAL"

  - `limit_type` (string, required)
    limit_type = CARD for vendor cards. Vendor cards must have a card_type of VIRTUAL 
and do not rely on the user specific limit. 

For corporate cards, limit_type = USER.

Learn more about different card types [here](https://support.brex.com/what-are-the-different-types-of-cards-i-can-get/).
    Enum: "CARD", "USER"

  - `spend_controls` (object,null)

  - `spend_controls.spend_limit` (object,null)
    Money fields can be signed or unsigned. Fields are signed (an unsigned value will be interpreted as positive). The amount of money will be represented in the smallest denomination
of the currency indicated. For example, USD 7.00 will be represented in cents with an amount of 700.

  - `spend_controls.spend_limit.amount` (integer, required)
    The amount of money, in the smallest denomination of the currency indicated by currency. For example, when currency is USD, amount is in cents.
    Example: 700

  - `spend_controls.spend_limit.currency` (string,null)
    The type of currency, in ISO 4217 format.
    Example: "USD"

  - `spend_controls.spend_available` (object,null)
    Money fields can be signed or unsigned. Fields are signed (an unsigned value will be interpreted as positive). The amount of money will be represented in the smallest denomination
of the currency indicated. For example, USD 7.00 will be represented in cents with an amount of 700.

  - `spend_controls.spend_duration` (string,null)
    Spend limit refresh frequency
    - MONTHLY: The spend limit refreshes every month
    - QUARTERLY: The spend limit refreshes every quarter
    - YEARLY: The spend limit refreshes every year
    - ONE_TIME: The limit does not refresh
    Enum: "MONTHLY", "QUARTERLY", "YEARLY", "ONE_TIME"

  - `spend_controls.reason` (string,null)

  - `spend_controls.lock_after_date` (string,null)
    The lock_after_date is in UTC.

  - `spend_controls.allowed_merchant_details` (array,null)
    List of merchant details where card transactions are allowed. Empty if no allowed merchant details are configured.
    Example: "[{\"name\": \"Github\"}, {\"name\": \"AWS\"}]"

  - `spend_controls.allowed_merchant_details.name` (string, required)
    The name of the merchant.
    Example: "Github"

  - `spend_controls.blocked_merchant_details` (array,null)
    List of merchant details where card transactions are blocked. Empty if no blocked merchant details are configured.
    Example: "[{\"name\": \"Apple\"}, {\"name\": \"Amazon\"}]"

  - `billing_address` (object, required)
    Company business address (must be in the US; no PO box or virtual/forwarding addresses allowed).

  - `billing_address.line1` (string,null)
    Address line 1, no PO Box.

  - `billing_address.line2` (string,null)
    Address line 2 (e.g., apartment, suite, unit, or building).

  - `billing_address.city` (string,null)
    City, district, suburb, town, or village.

  - `billing_address.state` (string,null)
    For US-addressed the 2-letter State abbreviation. For international-addresses the county, providence, or region.

  - `billing_address.country` (string,null)
    Two-letter country code (ISO 3166-1 alpha-2).

  - `billing_address.postal_code` (string,null)
    ZIP or postal code.

  - `billing_address.phone_number` (string,null)
    Phone number.

  - `mailing_address` (object,null)
    Company business address (must be in the US; no PO box or virtual/forwarding addresses allowed).

  - `expiration_date` (object, required)
    Card expiration year and month. Cards expire on the last day of the expiration month.

The expiration date is in UTC for cards starting with 555671, 428803 and 485932.
And the expiration date is in PST for cards starting with 511572.

  - `expiration_date.month` (integer, required)

  - `expiration_date.year` (integer, required)

  - `has_been_transferred` (boolean)
    Indicates whether a card has been transferred. Transferred cards have a spending restriction: we only allow transactions \
at online vendors where this card was previously used before the transfer.

  - `metadata` (object,null)
    Set of key value pairs associated with this object. Please do not store any personally identifiable or sensitive information here.
Limitations: maximum of 50 keys, keys cannot exceed 40 characters, values cannot exceed 500 characters.

  - `budget_id` (string,null)