Create card
curl --request POST \
--url https://api.getlemma.com/v0/cards \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--header 'Idempotency-Key: <idempotency-key>' \
--data '
{
"bank_account_id": "<string>",
"nickname": "<string>",
"authorization_controls": {
"usage": {
"category": {},
"multi_use": {
"spending_limits": [
{
"interval": {},
"amount": 123
}
]
}
}
}
}
'import requests
url = "https://api.getlemma.com/v0/cards"
payload = {
"bank_account_id": "<string>",
"nickname": "<string>",
"authorization_controls": { "usage": {
"category": {},
"multi_use": { "spending_limits": [
{
"interval": {},
"amount": 123
}
] }
} }
}
headers = {
"Idempotency-Key": "<idempotency-key>",
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {
'Idempotency-Key': '<idempotency-key>',
Authorization: 'Bearer <token>',
'Content-Type': 'application/json'
},
body: JSON.stringify({
bank_account_id: '<string>',
nickname: '<string>',
authorization_controls: {
usage: {category: {}, multi_use: {spending_limits: [{interval: {}, amount: 123}]}}
}
})
};
fetch('https://api.getlemma.com/v0/cards', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.getlemma.com/v0/cards",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'bank_account_id' => '<string>',
'nickname' => '<string>',
'authorization_controls' => [
'usage' => [
'category' => [
],
'multi_use' => [
'spending_limits' => [
[
'interval' => [
],
'amount' => 123
]
]
]
]
]
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json",
"Idempotency-Key: <idempotency-key>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.getlemma.com/v0/cards"
payload := strings.NewReader("{\n \"bank_account_id\": \"<string>\",\n \"nickname\": \"<string>\",\n \"authorization_controls\": {\n \"usage\": {\n \"category\": {},\n \"multi_use\": {\n \"spending_limits\": [\n {\n \"interval\": {},\n \"amount\": 123\n }\n ]\n }\n }\n }\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Idempotency-Key", "<idempotency-key>")
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.getlemma.com/v0/cards")
.header("Idempotency-Key", "<idempotency-key>")
.header("Authorization", "Bearer <token>")
.header("Content-Type", "application/json")
.body("{\n \"bank_account_id\": \"<string>\",\n \"nickname\": \"<string>\",\n \"authorization_controls\": {\n \"usage\": {\n \"category\": {},\n \"multi_use\": {\n \"spending_limits\": [\n {\n \"interval\": {},\n \"amount\": 123\n }\n ]\n }\n }\n }\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.getlemma.com/v0/cards")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Idempotency-Key"] = '<idempotency-key>'
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"bank_account_id\": \"<string>\",\n \"nickname\": \"<string>\",\n \"authorization_controls\": {\n \"usage\": {\n \"category\": {},\n \"multi_use\": {\n \"spending_limits\": [\n {\n \"interval\": {},\n \"amount\": 123\n }\n ]\n }\n }\n }\n}"
response = http.request(request)
puts response.read_body{
"id": "card_Bx5nTm8hKw3pVd7c",
"created_at": "2026-07-28T18:45:00Z",
"entity_id": "entity_k7mXp2vR9nTfBw4s",
"bank_account_id": "account_maple_ridge_cigna_01",
"nickname": "Acme ops card",
"last_4": "4242",
"status": "active",
"authorization_controls": {
"usage": {
"category": "multi_use",
"multi_use": {
"spending_limits": [
{ "interval": "per_transaction", "amount": 25000, "merchant_category_codes": null },
{ "interval": "per_day", "amount": 100000, "merchant_category_codes": null },
{ "interval": "per_day", "amount": 300000, "merchant_category_codes": ["6010", "6011"] }
]
}
},
"merchant_acceptor_identifier": null,
"merchant_category_code": { "allowed": null, "blocked": ["7995", "6051"] },
"merchant_country": null
}
}
{
"statusCode": 400,
"error": "Bad Request",
"message": [
"authorization_controls.usage.multi_use.spending_limits amounts must not decrease as the interval widens (per_transaction, per_day, per_week, per_month, all_time)"
]
}
Cards
Create card
Issue a virtual debit card with custom spending limits.
POST
/
v0
/
cards
Create card
curl --request POST \
--url https://api.getlemma.com/v0/cards \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--header 'Idempotency-Key: <idempotency-key>' \
--data '
{
"bank_account_id": "<string>",
"nickname": "<string>",
"authorization_controls": {
"usage": {
"category": {},
"multi_use": {
"spending_limits": [
{
"interval": {},
"amount": 123
}
]
}
}
}
}
'import requests
url = "https://api.getlemma.com/v0/cards"
payload = {
"bank_account_id": "<string>",
"nickname": "<string>",
"authorization_controls": { "usage": {
"category": {},
"multi_use": { "spending_limits": [
{
"interval": {},
"amount": 123
}
] }
} }
}
headers = {
"Idempotency-Key": "<idempotency-key>",
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {
'Idempotency-Key': '<idempotency-key>',
Authorization: 'Bearer <token>',
'Content-Type': 'application/json'
},
body: JSON.stringify({
bank_account_id: '<string>',
nickname: '<string>',
authorization_controls: {
usage: {category: {}, multi_use: {spending_limits: [{interval: {}, amount: 123}]}}
}
})
};
fetch('https://api.getlemma.com/v0/cards', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.getlemma.com/v0/cards",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'bank_account_id' => '<string>',
'nickname' => '<string>',
'authorization_controls' => [
'usage' => [
'category' => [
],
'multi_use' => [
'spending_limits' => [
[
'interval' => [
],
'amount' => 123
]
]
]
]
]
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json",
"Idempotency-Key: <idempotency-key>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.getlemma.com/v0/cards"
payload := strings.NewReader("{\n \"bank_account_id\": \"<string>\",\n \"nickname\": \"<string>\",\n \"authorization_controls\": {\n \"usage\": {\n \"category\": {},\n \"multi_use\": {\n \"spending_limits\": [\n {\n \"interval\": {},\n \"amount\": 123\n }\n ]\n }\n }\n }\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Idempotency-Key", "<idempotency-key>")
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.getlemma.com/v0/cards")
.header("Idempotency-Key", "<idempotency-key>")
.header("Authorization", "Bearer <token>")
.header("Content-Type", "application/json")
.body("{\n \"bank_account_id\": \"<string>\",\n \"nickname\": \"<string>\",\n \"authorization_controls\": {\n \"usage\": {\n \"category\": {},\n \"multi_use\": {\n \"spending_limits\": [\n {\n \"interval\": {},\n \"amount\": 123\n }\n ]\n }\n }\n }\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.getlemma.com/v0/cards")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Idempotency-Key"] = '<idempotency-key>'
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"bank_account_id\": \"<string>\",\n \"nickname\": \"<string>\",\n \"authorization_controls\": {\n \"usage\": {\n \"category\": {},\n \"multi_use\": {\n \"spending_limits\": [\n {\n \"interval\": {},\n \"amount\": 123\n }\n ]\n }\n }\n }\n}"
response = http.request(request)
puts response.read_body{
"id": "card_Bx5nTm8hKw3pVd7c",
"created_at": "2026-07-28T18:45:00Z",
"entity_id": "entity_k7mXp2vR9nTfBw4s",
"bank_account_id": "account_maple_ridge_cigna_01",
"nickname": "Acme ops card",
"last_4": "4242",
"status": "active",
"authorization_controls": {
"usage": {
"category": "multi_use",
"multi_use": {
"spending_limits": [
{ "interval": "per_transaction", "amount": 25000, "merchant_category_codes": null },
{ "interval": "per_day", "amount": 100000, "merchant_category_codes": null },
{ "interval": "per_day", "amount": 300000, "merchant_category_codes": ["6010", "6011"] }
]
}
},
"merchant_acceptor_identifier": null,
"merchant_category_code": { "allowed": null, "blocked": ["7995", "6051"] },
"merchant_country": null
}
}
{
"statusCode": 400,
"error": "Bad Request",
"message": [
"authorization_controls.usage.multi_use.spending_limits amounts must not decrease as the interval widens (per_transaction, per_day, per_week, per_month, all_time)"
]
}
Issues a virtual debit card on a bank account, with the spending limits you specify. The card’s
authorization_controls.usage.category must be multi_use, and at least one limit is required.
Every limit matching a payment is checked and the most restrictive one applies, so a payment is declined once it exceeds the per-transaction cap, or once the day’s spend would pass the daily cap, even while the weekly and monthly caps still have room.
Card payments will be rejected when there’s insufficient balance on the bank account regardless of the limits you set.
Headers
string
required
A key that prevents issuing a duplicate card if the same request is retried.
Reusing a key returns the originally created card instead of issuing a second
one. See Idempotency.
Request body
string
required
The bank account this card draws from.
string
required
A human-readable label for this card. Between 1 and 50 characters.
object
required
Controls that restrict how this card can be used.
Show Authorization controls fields
Show Authorization controls fields
object
required
How many times this card can be used, and the controls for that usage.
Show Usage fields
Show Usage fields
enum
required
Whether the card is for a single use or multiple uses.
Show Available options
Show Available options
string
The card can be used for multiple authorizations. The only
category issuable today.
object
required
Controls for multi-use cards. Required if and only if
category is
multi_use.Show Multi-use fields
Show Multi-use fields
object[]
required
The spending limits to enforce on this card. Must contain at least
one limit and at most one limit per interval. Where several limits
apply to a transaction, the most restrictive one wins.
Show Limit object
Show Limit object
enum
required
integer
required
The cap on settled spend in this window, in cents. Must be
positive, and at least as large as the cap on every narrower
interval — a wider window capped below a narrower one can
never be reached, so it is rejected.
Response
Returns the created card object.string
Unique identifier for the card, prefixed with
card_.string
The ID of the entity that owns this card.
string
The bank account this card draws from.
string | null
The human-readable label for this card.
string
The last 4 digits of the card number.
enum
object
Every control restricting how this card can be used, including the ones Lemma
applies to every card it issues.
Show Authorization controls object
Show Authorization controls object
object
How many times this card can be used, and its controls.
Show Usage object
Show Usage object
enum
Whether the card is for a single use or multiple uses.
Show Available options
Show Available options
string
The card can be used for multiple authorizations. The only
category issuable today.
object
Controls for multi-use cards.
Show Multi-use object
Show Multi-use object
object[]
Every spending limit enforced on this card, including the ones
Lemma applies automatically.
Show Limit object
Show Limit object
enum
integer
Cap in cents.
string[] | null
Merchant category codes this limit applies to.
null applies
to all merchants.object | null
Restricts which Merchant Acceptor IDs this card may transact with.
null
when this dimension is unrestricted.object | null
Restricts which merchant categories this card may transact with, including
the categories Lemma blocks on every card it issues.
null when this
dimension is unrestricted.object | null
Restricts which merchant countries this card may transact with, as ISO
3166-1 alpha-2 codes.
null when this dimension is unrestricted.{
"id": "card_Bx5nTm8hKw3pVd7c",
"created_at": "2026-07-28T18:45:00Z",
"entity_id": "entity_k7mXp2vR9nTfBw4s",
"bank_account_id": "account_maple_ridge_cigna_01",
"nickname": "Acme ops card",
"last_4": "4242",
"status": "active",
"authorization_controls": {
"usage": {
"category": "multi_use",
"multi_use": {
"spending_limits": [
{ "interval": "per_transaction", "amount": 25000, "merchant_category_codes": null },
{ "interval": "per_day", "amount": 100000, "merchant_category_codes": null },
{ "interval": "per_day", "amount": 300000, "merchant_category_codes": ["6010", "6011"] }
]
}
},
"merchant_acceptor_identifier": null,
"merchant_category_code": { "allowed": null, "blocked": ["7995", "6051"] },
"merchant_country": null
}
}
{
"statusCode": 400,
"error": "Bad Request",
"message": [
"authorization_controls.usage.multi_use.spending_limits amounts must not decrease as the interval widens (per_transaction, per_day, per_week, per_month, all_time)"
]
}
⌘I