POST/cards/order

Create Card Order

Orders a physical Visa debit card for a managed customer. This call is synchronous — it creates the card order and returns the final result in the same request.

Validates brokering ownership, then creates the card order.

bash

curl -X POST "{{baseUrl}}/cards/order" \
  -H "session-token: {{sessionToken}}" \
  -H "Content-Type: application/json" \
  -d "{\"UserId\":\"-8202289338547523753\",\"Street\":\"Nanjing East Road\",\"BuildingNumber\":\"88\",\"ZipCode\":\"200001\",\"City\":\"Shanghai\",\"RegionOrState\":\"SH\",\"Country\":\"CN\",\"MothersMaidenName\":\"Smith\"}"

Headers

Field	Type	Required	Possible values	Description
`session-token`	string	Required	—	SessionToken obtained from the Create GMA Session endpoint. All secured endpoints require this header.

Request body

Field	Type	Required	Possible values	Description
`UserId`	string	Required	-8202289338547523753	Masked customer ID. Must pass masked-ID validation (`/^-?\d+$/`).
`Street`	string	Required	—	Shipping street.
`BuildingNumber`	string	Required	—	Shipping building number.
`ZipCode`	string	Required	—	Postal / ZIP code.
`City`	string	Required	—	Shipping city.
`RegionOrState`	string	Required	—	Region or state.
`Country`	string	Required	US \| CN \| ...	ISO country code (2–3 characters).
`MothersMaidenName`	string	Required	—	Mother's maiden name.

Example request

{
  "UserId": "-8202289338547523753",
  "Street": "Nanjing East Road",
  "BuildingNumber": "88",
  "ZipCode": "200001",
  "City": "Shanghai",
  "RegionOrState": "SH",
  "Country": "CN",
  "MothersMaidenName": "Smith"
}

{
  "UserId": "-8202289338547523753",
  "Street": "Nanjing East Road",
  "BuildingNumber": "88",
  "ZipCode": "200001",
  "City": "Shanghai",
  "RegionOrState": "SH",
  "Country": "CN",
  "MothersMaidenName": "Smith"
}

All body fields are required and must be PascalCase.

Additional info

Field	Type	Required	Possible values	Description
`400 — Invalid Customer ID`	object	Optional	—	Masked UserId failed validation.
`400 — NOT_ELIGIBLE`	object	Optional	—	Customer is not eligible for a card order (downstream error text included).
`400 — INVALID_ADDRESS`	object	Optional	—	Shipping address rejected.
`400 — ORDER_FAILED`	object	Optional	—	Card order failed. ResponseErrors includes downstream error text.
`403 — No access`	object	Optional	—	Broker does not own this customer.
`404 — Customer not found`	object	Optional	—	Masked UserId does not resolve to a customer.
`503 — Downstream unavailable`	object	Optional	—	Downstream service is unavailable.

Example— 400 — Invalid Customer ID

{
  "ResponseCode": 400,
  "ResponseMessage": "BadRequest",
  "ResponseData": null,
  "ResponseErrors": [
    {
      "Message": "Invalid Customer ID",
      "CustomMessage": "Invalid Customer ID",
      "Code": "INVALID_CUSTOMER_ID"
    }
  ]
}

{
  "ResponseCode": 400,
  "ResponseMessage": "BadRequest",
  "ResponseData": null,
  "ResponseErrors": [
    {
      "Message": "Invalid Customer ID",
      "CustomMessage": "Invalid Customer ID",
      "Code": "INVALID_CUSTOMER_ID"
    }
  ]
}

Example— 400 — NOT_ELIGIBLE

{
  "ResponseCode": 400,
  "ResponseMessage": "BadRequest",
  "ResponseData": null,
  "ResponseErrors": [
    {
      "Message": "NOT_ELIGIBLE",
      "CustomMessage": "Customer is not eligible for debit card order",
      "Code": "NOT_ELIGIBLE"
    }
  ]
}

{
  "ResponseCode": 400,
  "ResponseMessage": "BadRequest",
  "ResponseData": null,
  "ResponseErrors": [
    {
      "Message": "NOT_ELIGIBLE",
      "CustomMessage": "Customer is not eligible for debit card order",
      "Code": "NOT_ELIGIBLE"
    }
  ]
}

Example— 400 — INVALID_ADDRESS

{
  "ResponseCode": 400,
  "ResponseMessage": "BadRequest",
  "ResponseData": null,
  "ResponseErrors": [
    {
      "Message": "INVALID_ADDRESS",
      "CustomMessage": "Shipping address is invalid for card delivery",
      "Code": "INVALID_ADDRESS"
    }
  ]
}

{
  "ResponseCode": 400,
  "ResponseMessage": "BadRequest",
  "ResponseData": null,
  "ResponseErrors": [
    {
      "Message": "INVALID_ADDRESS",
      "CustomMessage": "Shipping address is invalid for card delivery",
      "Code": "INVALID_ADDRESS"
    }
  ]
}

Example— 400 — ORDER_FAILED

{
  "ResponseCode": 400,
  "ResponseMessage": "BadRequest",
  "ResponseData": null,
  "ResponseErrors": [
    {
      "Message": "ORDER_FAILED",
      "CustomMessage": "Updated Transfer failed: already ordered",
      "Code": "ORDER_FAILED"
    }
  ]
}

{
  "ResponseCode": 400,
  "ResponseMessage": "BadRequest",
  "ResponseData": null,
  "ResponseErrors": [
    {
      "Message": "ORDER_FAILED",
      "CustomMessage": "Updated Transfer failed: already ordered",
      "Code": "ORDER_FAILED"
    }
  ]
}

Example— 403 — No access

{
  "ResponseCode": 403,
  "ResponseMessage": "Broker does not have access to this customer",
  "ResponseData": null
}

{
  "ResponseCode": 403,
  "ResponseMessage": "Broker does not have access to this customer",
  "ResponseData": null
}

Example— 404 — Customer not found

{
  "ResponseCode": 404,
  "ResponseMessage": "Customer not found",
  "ResponseData": null
}

{
  "ResponseCode": 404,
  "ResponseMessage": "Customer not found",
  "ResponseData": null
}

Example— 503 — Downstream unavailable

{
  "ResponseCode": 503,
  "ResponseMessage": "Downstream service unavailable",
  "ResponseData": null
}

{
  "ResponseCode": 503,
  "ResponseMessage": "Downstream service unavailable",
  "ResponseData": null
}

Response

Field	Type	Possible values	Description
`ResponseCode`	integer	200 \| 201 \| 204 \| 301 \| 400 \| 401 \| 403 \| 404 \| 410 \| 422 \| 500 \| 503	API result code in the response envelope. Indicates success or the error category (e.g. 200 success, 400 bad request, 401 unauthorized).
`ResponseMessage`	string	Success \| Created \| NoContent \| BadRequest \| Unauthorized \| Forbidden \| NotFound \| Gone \| UnprocessableContent \| ServerError \| ResourceMoved \| ServiceUnAvailable \| UnProcessableEntity	Human-readable label paired with ResponseCode (e.g. Success, BadRequest, Unauthorized). Use with ResponseCode to interpret the outcome.
`ResponseData`	object	Please refer to below example for response body	Card order result. `Message` is included when available. `CardOrderId` is present when returned.
`ResponseData.Message`	string	—	Result message when available.
`ResponseData.CardOrderId`	string	—	Card order identifier when returned by the processor.

Example response

{
  "ResponseCode": 200,
  "ResponseMessage": "Success",
  "ResponseData": {
    "Message": "Card order created successfully",
    "CardOrderId": "ORD-20260731-00142"
  }
}

{
  "ResponseCode": 200,
  "ResponseMessage": "Success",
  "ResponseData": {
    "Message": "Card order created successfully",
    "CardOrderId": "ORD-20260731-00142"
  }
}

Requires `session-token: {SessionToken}` from Create GMA Session. Use the same client IP as authentication.