# Apocor Cards API

> The white-labeled API for issuing and managing cards on Apocor.

## Docs

- [Create an account](https://docs.apocor.ai/api-reference/accounts/create-an-account.md): Creates a funding account for a program. Required before card issuance — pass the returned id as account_id in POST /v1/cards.
- [Get account balance](https://docs.apocor.ai/api-reference/accounts/get-account-balance.md)
- [Get an account](https://docs.apocor.ai/api-reference/accounts/get-an-account.md)
- [List accounts](https://docs.apocor.ai/api-reference/accounts/list-accounts.md)
- [List issuer budgets](https://docs.apocor.ai/api-reference/accounts/list-issuer-budgets.md): Returns budgets from the issuer for the applicant linked to this account.
- [Transfer funds to or from an account](https://docs.apocor.ai/api-reference/accounts/transfer-funds-to-or-from-an-account.md): Funds or depletes a debit (budget) account, or routes to prepaid card transfer-in/out when type is prepaid.
- [Create an API key](https://docs.apocor.ai/api-reference/api-keys/create-an-api-key.md): Issues a new Apocor key pair. The `secret` is shown **once** in this response — store it securely.
- [List API keys](https://docs.apocor.ai/api-reference/api-keys/list-api-keys.md)
- [Revoke an API key](https://docs.apocor.ai/api-reference/api-keys/revoke-an-api-key.md)
- [Create an applicant](https://docs.apocor.ai/api-reference/applicants/create-an-applicant.md)
- [Get an applicant](https://docs.apocor.ai/api-reference/applicants/get-an-applicant.md)
- [List applicants](https://docs.apocor.ai/api-reference/applicants/list-applicants.md)
- [Refresh issuer KYC status](https://docs.apocor.ai/api-reference/applicants/refresh-issuer-kyc-status.md): Polls the issuer for the latest identity verification status. Does not submit share tokens or trigger handoff — use POST /v1/applicants/{id}/submit or POST /v1/applicants/{id}/kyc-share for that.
- [Share BYOK verification with the issuer](https://docs.apocor.ai/api-reference/applicants/share-byok-verification-with-the-issuer.md): For integrators with their own identity provider: after verifying an end-user, generate a short-lived share token (recipient from GET /v1/kyc/config) and submit it here. Apocor registers identity with the card program. Include status APPROVED to attest verification in the same request.
- [Start a hosted KYC session](https://docs.apocor.ai/api-reference/applicants/start-a-hosted-kyc-session.md): Returns a short-lived access token for the hosted identity-verification widget.
- [Submit for KYC](https://docs.apocor.ai/api-reference/applicants/submit-for-kyc.md): Polls tenant identity verification status. When approved, provisions the issuer sub-account, forwards verification to the card program (share token + initialize), and returns updated issuer KYC fields.
- [Get an access token](https://docs.apocor.ai/api-reference/authentication/get-an-access-token.md): Exchange an Apocor API key (`client_id` + `client_secret`) for a short-lived bearer access token. This is the only credential your services ever need — Apocor manages every upstream provider on your behalf. **No `Authorization` header is required** — this endpoint issues the token; it does not consu…
- [Sign in with a Dynamic token](https://docs.apocor.ai/api-reference/authentication/sign-in-with-a-dynamic-token.md): Exchange a verified Dynamic JWT for an Apocor session. Used by front-ends that authenticate end-users with Dynamic; no `Authorization` header is required.
- [Sign in with email and password](https://docs.apocor.ai/api-reference/authentication/sign-in-with-email-and-password.md): Dashboard sign-in for human users. Machine-to-machine integrations should use `POST /v1/oauth/token` instead.
- [Add manual credit](https://docs.apocor.ai/api-reference/billing/add-manual-credit.md): Adds platform credit to the caller's organization. Available in sandbox/mock mode or to platform admins — useful for topping up a sandbox balance while testing.
- [Create a deposit address](https://docs.apocor.ai/api-reference/billing/create-a-deposit-address.md): Starts a credit purchase and returns a deposit address (QR) to send stablecoin to.
- [Get billing overview](https://docs.apocor.ai/api-reference/billing/get-billing-overview.md): Returns the platform credit balance, funding wallets, pricing, and the credit ledger.
- [Get credit purchase status](https://docs.apocor.ai/api-reference/billing/get-credit-purchase-status.md)
- [Register a funding wallet](https://docs.apocor.ai/api-reference/billing/register-a-funding-wallet.md)
- [Simulate credit settlement (sandbox)](https://docs.apocor.ai/api-reference/billing/simulate-credit-settlement-sandbox.md): Sandbox-only. Forces settlement of a pending credit-purchase flow so you can test the funded state without sending real stablecoin.
- [Create a cardholder](https://docs.apocor.ai/api-reference/cardholders/create-a-cardholder.md): Turns an approved applicant into a cardholder who can be issued cards. Requires applicant status APPROVED and a provisioned issuer account (POST /v1/applicants/{id}/submit or kyc-share first).
- [Get a cardholder](https://docs.apocor.ai/api-reference/cardholders/get-a-cardholder.md): Returns the local cardholder record and, when live issuer is configured, issuer cardholder details.
- [List cardholders](https://docs.apocor.ai/api-reference/cardholders/list-cardholders.md)
- [Update a cardholder](https://docs.apocor.ai/api-reference/cardholders/update-a-cardholder.md)
- [Activate a card](https://docs.apocor.ai/api-reference/cards/activate-a-card.md)
- [Batch delete cards](https://docs.apocor.ai/api-reference/cards/batch-delete-cards.md): Deletes up to 100 cards asynchronously. Deleted cards are marked CLOSED locally.
- [Batch issue cards](https://docs.apocor.ai/api-reference/cards/batch-issue-cards.md): Issues up to 100 virtual or physical cards asynchronously. Returns issuer task_id and reference_ids for tracking. Prerequisites match single card issuance.
- [Batch set spend controls](https://docs.apocor.ai/api-reference/cards/batch-set-spend-controls.md)
- [Close a card](https://docs.apocor.ai/api-reference/cards/close-a-card.md): Permanently closes the card on the issuer and marks it CLOSED locally.
- [Create or update a spend control](https://docs.apocor.ai/api-reference/cards/create-or-update-a-spend-control.md)
- [Delete a spend control](https://docs.apocor.ai/api-reference/cards/delete-a-spend-control.md)
- [Freeze a card](https://docs.apocor.ai/api-reference/cards/freeze-a-card.md)
- [Fund a prepaid card](https://docs.apocor.ai/api-reference/cards/fund-a-prepaid-card.md)
- [Get a card](https://docs.apocor.ai/api-reference/cards/get-a-card.md)
- [Get batch task progress](https://docs.apocor.ai/api-reference/cards/get-batch-task-progress.md)
- [Get physical card shipping status](https://docs.apocor.ai/api-reference/cards/get-physical-card-shipping-status.md)
- [Issue a card](https://docs.apocor.ai/api-reference/cards/issue-a-card.md): Issues a virtual or physical card for a cardholder against a funding account. Prerequisites: applicant issuerKycReady true, funding account exists (POST /v1/accounts), cardholder exists (POST /v1/cardholders). First issuance provisions issuer budget and cardholder on the rail.
- [List cards](https://docs.apocor.ai/api-reference/cards/list-cards.md)
- [List spend controls](https://docs.apocor.ai/api-reference/cards/list-spend-controls.md): List MCC, scenario, or currency whitelist/blacklist rules for an applicant's issuer account.
- [Reveal secure card details](https://docs.apocor.ai/api-reference/cards/reveal-secure-card-details.md): Returns a short-lived reveal token used to render the PAN/CVV inside a PCI-compliant iframe. Raw card numbers never pass through your servers.
- [Set physical card PIN](https://docs.apocor.ai/api-reference/cards/set-physical-card-pin.md)
- [Ship a physical card](https://docs.apocor.ai/api-reference/cards/ship-a-physical-card.md): Submits shipping details to the issuer for a physical card.
- [Unfreeze a card](https://docs.apocor.ai/api-reference/cards/unfreeze-a-card.md)
- [Update a card](https://docs.apocor.ai/api-reference/cards/update-a-card.md): Updates the card label and/or monthly spend limit on the issuer.
- [Withdraw from a prepaid card](https://docs.apocor.ai/api-reference/cards/withdraw-from-a-prepaid-card.md)
- [KYC integration settings](https://docs.apocor.ai/api-reference/kyc/kyc-integration-settings.md): Returns whether hosted verification and BYOK share tokens are available, plus the share recipient id for generating identity share tokens.
- [Complete onboarding](https://docs.apocor.ai/api-reference/onboarding/complete-onboarding.md): Sets the admin's password and activates the account once KYC has passed.
- [Get invite details](https://docs.apocor.ai/api-reference/onboarding/get-invite-details.md)
- [Start KYC for an invite](https://docs.apocor.ai/api-reference/onboarding/start-kyc-for-an-invite.md): Kicks off identity verification for the applicant behind an onboarding invite token. Public — no access token required.
- [Create an organization](https://docs.apocor.ai/api-reference/organizations/create-an-organization.md): Requires the `APOCOR_ADMIN` role.
- [Get an organization](https://docs.apocor.ai/api-reference/organizations/get-an-organization.md)
- [List organizations](https://docs.apocor.ai/api-reference/organizations/list-organizations.md)
- [Onboard a tenant](https://docs.apocor.ai/api-reference/organizations/onboard-a-tenant.md): Creates a tenant organization and emails an onboarding invite to the admin. Requires `APOCOR_ADMIN` or `RESELLER_ADMIN`.
- [Create a program](https://docs.apocor.ai/api-reference/programs/create-a-program.md)
- [Get a program](https://docs.apocor.ai/api-reference/programs/get-a-program.md)
- [List programs](https://docs.apocor.ai/api-reference/programs/list-programs.md)
- [Simulate sandbox events](https://docs.apocor.ai/api-reference/sandbox/simulate-sandbox-events.md): Sandbox issuer only. Simulate authorization, refund, reversal, or KYC review events.
- [Get the current session](https://docs.apocor.ai/api-reference/session/get-the-current-session.md): Returns the organization and role behind the current access token.
- [Liveness check](https://docs.apocor.ai/api-reference/system/liveness-check.md)
- [Readiness check](https://docs.apocor.ai/api-reference/system/readiness-check.md)
- [List card transactions](https://docs.apocor.ai/api-reference/transactions/list-card-transactions.md): Returns issuer transaction history when live rail is configured, otherwise local ledger rows.
- [List transactions](https://docs.apocor.ai/api-reference/transactions/list-transactions.md)
- [Dynamic webhook](https://docs.apocor.ai/api-reference/webhooks/dynamic-webhook.md): Receives Dynamic events. Apocor verifies the `X-Dynamic-Signature-256` signature, responds `200` immediately, and processes the event asynchronously. This endpoint is called by Dynamic, not by integrators — it is documented here for reference.
- [Interlace webhook](https://docs.apocor.ai/api-reference/webhooks/interlace-webhook.md): Receives Interlace events. Apocor verifies the `X-Signature` signature, responds `200` immediately, and processes the event asynchronously. This endpoint is called by Interlace, not by integrators — it is documented here for reference.
- [Sumsub webhook](https://docs.apocor.ai/api-reference/webhooks/sumsub-webhook.md): Receives Sumsub events. Apocor verifies the `X-Payload-Digest` signature, responds `200` immediately, and processes the event asynchronously. This endpoint is called by Sumsub, not by integrators — it is documented here for reference.
- [Authentication](https://docs.apocor.ai/authentication.md): Apocor API keys, bearer tokens, and roles.
- [Applicants & KYC](https://docs.apocor.ai/concepts/applicants.md): Onboard end-users and verify their identity.
- [Billing & Credits](https://docs.apocor.ai/concepts/billing.md): Fund your platform balance and pay as you go.
- [Cards](https://docs.apocor.ai/concepts/cards.md): Issue, manage, and securely reveal cards.
- [Organizations](https://docs.apocor.ai/concepts/organizations.md): Tenants, resellers, and how access is scoped.
- [Programs & Accounts](https://docs.apocor.ai/concepts/programs-accounts.md): Define card products and the funding that backs them.
- [Error codes](https://docs.apocor.ai/guides/errors.md): Stable, machine-readable error codes and their HTTP status.
- [Identity verification (KYC)](https://docs.apocor.ai/guides/kyc-integration.md): How tenant KYC and issuer KYC work, and how to integrate hosted or bring-your-own verification.
- [Response format](https://docs.apocor.ai/guides/responses.md): The envelopes every endpoint returns.
- [Webhooks](https://docs.apocor.ai/guides/webhooks.md): Inbound provider callbacks and outbound Apocor events.
- [Introduction](https://docs.apocor.ai/index.md): One white-labeled API to issue and manage cards on Apocor.
- [Quickstart](https://docs.apocor.ai/quickstart.md): Go from an API key to a live card in five steps.

## OpenAPI Specs

- [openapi](https://docs.apocor.ai/openapi.json)