Create cards

After you create an account holder and a balance account, you can start issuing cards. Cards can either be virtual or physical. Cards also have to be associated with a Visa or Mastercard pre-approved use case, called a scheme program. By default, Adyen handles the scheme program for you in the background.

PCI compliance

The scope for PCI compliance depends on your use case—the type of cards you'll issue and how the cards will be used. To know whether PCI compliance requirements apply to your use case, reach out to your Adyen contact.

Visual design for physical cards

Before you can create physical cards in the live environment, you must have a design for the card itself and the mailer it is sent in. Each card design must be approved by Visa or Mastercard.

Your Adyen contact will help you to complete and specify the designs.

Create a card

To issue a card, create a paymentInstrument resource. In the request, specify whether the card is:

• Virtual: A card that has no physical form. You receive the card details in the API response.
• Physical: A card that is printed and shipped to the user. You do not receive the card details in the API response. Sending a request to create a physical card also starts an order to manufacture the card.

Assign authorized users to an issued card

If the account holder is a company, they may want to assign multiple employees as authorized users for the issued company cards they create. If a card has multiple users, all users of a card must be identified when the card(s) is created. We refer to these individuals as authorized users.

Requirements

Before you begin, take into account the following requirements, limitations, and preparations.

To create and assign an authorized user to an issued card:

1. Create a legal entity for the user by making a POST /legalEntities request. The following information must be provided for each authorized user:

   • First and last name
   • Date of birth (in YYYY-MM-DD format)
   • Country of residence

   You need to request the authorisedPaymentInstrumentUser capability for the user by adding the capabilities array to your request. For an existing legal entity, make a PATCH /legalEntities/{id} request with the capabilities array in the request body. The initial status of the capability is pending.

   The user must pass verification checks and be allowed to use the authorisedPaymentInstrumentUser capability. It can take up to 48 hours for a legal entity to pass all verification checks. Thereforee, we recommend that you wait at least 48 hours to check the status of the legal entity before you assign them as an authorized user.

2. To check the user's verificationStatus, make a GET /legalEntities/{id} request, specifying the id as a path parameter. You must resolve any errors before assigning the legal entity as an authorized user of the card. All users must have the authorisedPaymentInstrumentUser allowed to be able to use the card.

   If the status is invalid, you need to provide additional information to pass the verification checks. If the status is rejected, this is final and the user cannot use the card.

   Note that Adyen performs daily sanction checks against the legal entities of your cards' assigned authorized users. If their capability status changes to invalid or rejected, the card status is suspended and it cannot be used.

3. Create a physical or virtual card.

4. Assign authorized users to the card by making a POST /paymentInstruments/{id}/AuthorisedCardUsers request with the ID of the payment instrument in the path. Include the id of the authorized users you want to assign in your request.

   Only the corresponding 204 HTTP response code is returned if the request is successful.

5. (Optional) To see the authorized card users for a card, make a GET /paymentInstruments/{id}/AuthorisedCardUsers request with the ID of the payment instrument in the path.

To update the authorized users for a card, make a PATCH /paymentInstruments/{id}/AuthorisedCardUsers request with the ID of the payment instrument in the path. Note that this request replaces the entire list of authorized users for the card. For example, to remove one user from the list, include an updated list of users in your PATCH request. Only the corresponding 204 HTTP response code is returned if the request is successful.

To delete all users for a card, make a DELETE /paymentInstruments/{id}/AuthorisedCardUsers request with the ID of the payment instrument in the path. Only the corresponding 204 HTTP response code is returned if the request is successful.

Physical cards in live environment

Before you can create live physical cards, you must have a design for the card itself and the mailer.

After you create a card, it is personalized, printed, and shipped with the information that you provided. If you need to stop a card from being personalized, update the status before it is sent to the manufacturer. Reach out to your Adyen contact to know the schedule for your balance platform.