> ## Documentation Index > Fetch the complete documentation index at: https://docs.henrylabs.ai/llms.txt > Use this file to discover all available pages before exploring further. # Card Issue (Beta) > **Beta.** Card issuance is in beta and enabled per account. Contact support@henrylabs.ai to request access; until then this endpoint returns `403`. Issue a virtual card for one purchase, paid for by your buyer's card. Henry Labs charges the buyer's tokenized card (`fundingCardToken`) for the card's cap — off-session, using the payment method saved when the card was tokenized, so no CVC is needed — then issues a card capped at that amount and locked to the first merchant that charges it. The buyer's statement shows `HENRY* ` when you pass `merchantHost`. The response is a `cardToken` you pass to `cart.checkout.purchase` exactly like a tokenized card. Read it back with `GET /card/{cardToken}` and close it with `POST /card/{cardToken}/close`; when it closes or expires, the buyer is refunded whatever it didn't spend. Send an `Idempotency-Key` header: retries with the same key return the same card and never charge twice. Your app has a per-card maximum and an open-card limit: the summed caps of cards that haven't settled. ## OpenAPI ````yaml /v1/api-reference/openapi.documented.json post /card/issue openapi: 3.1.0 info: title: Henry Labs API version: 1.17.0 description: Playground for Henry Labs API endpoints contact: name: Henry Labs API Support email: support@henrylabs.ai servers: - url: https://api.henrylabs.ai/v1 description: Production server security: - ApiKeyAuth: [] tags: - name: Product description: Product search, details, and data enrichment - name: Cart description: Universal user shopping cart management - name: Orders description: Order management post purchase - name: Merchants description: Merchant information and status - name: Card description: Card tokenization and management paths: /card/issue: post: tags: - Card summary: Card Issue (Beta) description: >- **Beta.** Card issuance is in beta and enabled per account. Contact support@henrylabs.ai to request access; until then this endpoint returns `403`. Issue a virtual card for one purchase, paid for by your buyer's card. Henry Labs charges the buyer's tokenized card (`fundingCardToken`) for the card's cap — off-session, using the payment method saved when the card was tokenized, so no CVC is needed — then issues a card capped at that amount and locked to the first merchant that charges it. The buyer's statement shows `HENRY* ` when you pass `merchantHost`. The response is a `cardToken` you pass to `cart.checkout.purchase` exactly like a tokenized card. Read it back with `GET /card/{cardToken}` and close it with `POST /card/{cardToken}/close`; when it closes or expires, the buyer is refunded whatever it didn't spend. Send an `Idempotency-Key` header: retries with the same key return the same card and never charge twice. Your app has a per-card maximum and an open-card limit: the summed caps of cards that haven't settled. operationId: cardIssue requestBody: content: application/json: schema: type: object properties: capCents: type: integer exclusiveMinimum: 0 maximum: 9007199254740991 description: >- Lifetime spend limit in cents: the most the card can ever be charged, in total. Rounded up to the next whole dollar; must be at least 100 and, after rounding, at most your app's per-card maximum. Size it to the order total plus tax and shipping — a charge that would take total spend above the cap is declined. example: 5000 fundingCardToken: description: >- Required. The buyer's tokenized card, collected with the [Card Element](https://docs.henrylabs.ai/v1/sdk/client/elements/card-element), that pays for this one. It's charged the card's cap (rounded up to whole dollars) before the card is created; whatever the card doesn't spend is refunded to it when the card settles. Charged off-session, so your buyer must have agreed to future charges when they entered the card. example: card_live_SimDpKU9cmU7tvdUXHzOeLudtgfadQVnbof type: string merchantHost: description: >- Merchant the card is for, e.g. `zara.com`. Puts the merchant on the buyer's statement (`HENRY* ZARA`). The card itself locks to whichever merchant charges it first. example: zara.com type: string ttlDays: description: >- Days until the card expires and stops working. Defaults to your app's configured TTL. The card settles (refunding the buyer whatever it didn't spend) when it expires, or sooner if you close it. example: 7 type: integer exclusiveMinimum: 0 maximum: 90 required: - capCents responses: '200': description: Card issued content: application/json: schema: $ref: '#/components/schemas/issuedCardResponse' '400': description: Invalid request body content: application/json: schema: type: object properties: success: type: boolean status: type: string message: type: string required: - success - status - message additionalProperties: false '401': description: Invalid or missing API key content: application/json: schema: type: object properties: success: type: boolean status: type: string message: type: string required: - success - status - message additionalProperties: false '402': description: >- Not issued and nothing charged: over the per-card maximum or open-card limit, the buyer's card was declined (`stripeCode` / `declineCode` say why), or it can't be charged off-session. The message says which. content: application/json: schema: type: object properties: success: type: boolean status: type: string message: type: string required: - success - status - message additionalProperties: false '403': description: >- Card issuance is a beta feature and isn't enabled for your account. Contact support@henrylabs.ai to request access. content: application/json: schema: type: object properties: success: type: boolean status: type: string message: type: string required: - success - status - message additionalProperties: false '404': description: >- `fundingCardToken` wasn't found, or wasn't tokenized by your app. Issuance is also unavailable to sandbox apps. content: application/json: schema: type: object properties: success: type: boolean status: type: string message: type: string required: - success - status - message additionalProperties: false '409': description: >- This `Idempotency-Key` belongs to an earlier attempt whose payment was refunded. Retry with a new key. content: application/json: schema: type: object properties: success: type: boolean status: type: string message: type: string required: - success - status - message additionalProperties: false security: - ApiKeyAuth: [] x-codeSamples: - lang: JavaScript source: |- import HenrySDK from '@henrylabs/sdk'; const client = new HenrySDK({ apiKey: process.env['HENRY_SDK_API_KEY'], // This is the default and can be omitted }); const response = await client.card.issue({ capCents: 5000 }); console.log(response.data); components: schemas: issuedCardResponse: type: object properties: success: type: boolean status: type: string message: type: string data: $ref: '#/components/schemas/issuedCardData' required: - success - status - message - data additionalProperties: false issuedCardData: type: object properties: cardToken: type: string description: >- Opaque token for the issued card. Pass it to `cart.checkout.purchase` exactly like a tokenized card. example: card_live_abc123xyz cardBin: type: string description: First 6 digits example: '424242' cardLast4: type: string description: Last 4 digits example: '4242' cardBrand: type: string description: Card brand example: visa capCents: type: integer minimum: -9007199254740991 maximum: 9007199254740991 description: >- Lifetime spend cap in cents. The card declines once total spend across all charges would exceed this — it is a budget for the card's whole life, not a per-charge limit. example: 5000 expiresAt: type: string description: >- When the card expires and stops working (ISO-8601). Close it earlier to settle sooner: the buyer is refunded whatever the card didn't spend, and its cap stops counting against your open-card limit. example: '2026-09-29T00:00:00.000Z' state: type: string enum: - OPEN - PAUSED - CLOSED - UNKNOWN description: >- Live state at the issuer. `UNKNOWN` means the read failed — treat the card as possibly still open. closedAt: anyOf: - type: string - type: 'null' description: When Henry closed the card (ISO-8601), or null while open. charge: anyOf: - type: object properties: status: type: string enum: - ok - unavailable charged: type: boolean description: Any transaction at all — approved or declined. approved: type: boolean description: At least one transaction was approved by the network. count: type: integer minimum: 0 maximum: 9007199254740991 reason: type: string required: - status - charged - approved - count additionalProperties: false - type: 'null' description: >- What has hit the card so far, read live from the issuer. Null on the issue response (nothing can have happened yet). required: - cardToken - cardBin - cardLast4 - cardBrand - capCents - expiresAt - state - closedAt - charge additionalProperties: false securitySchemes: ApiKeyAuth: type: apiKey in: header name: x-api-key ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.