Card issuing API

Last updated October 2026

The API is available to approved business accounts. Open a business account to get sandbox credentials immediately and live credentials after a quick review.

What you can build

Issue virtual cards on demand — VISA / Mastercard products with per-card limits.
Top up, freeze, unfreeze and block cards; read balances and card details.
Fund your wallet through our payment partner (checkout flow) and read the immutable ledger.
Quote fees before charging — the preview endpoint uses the same pricing the charge uses.
Receive webhooks for card events, signed with your own secret, with automatic retries.
Test first in sandbox — instant simulated funding, test BIN, failure simulation, zero real money.
Fraud protection built in — abusive spend patterns are blocked automatically.

Authentication

Every request carries your client credentials as headers:

X-Client-ID: wz_xxxxxxxxxxxx
X-Client-Secret: wzsk_xxxxxxxxxxxxxxxx
Accept: application/json

Secrets are stored hashed and shown only once when generated. Rotate them any time from the panel; webhook payloads are signed with a separate secret.

Quick start

# 1. see the products you can issue
curl -H "X-Client-ID: $ID" -H "X-Client-Secret: $SECRET" \
     https://weezzz.com/api/v1/cards/products

# 2. quote the fee for a $100 card
curl -H "X-Client-ID: $ID" -H "X-Client-Secret: $SECRET" \
     "https://weezzz.com/api/v1/fees/preview?fee_type=creation&amount=100&currency=USD"

# 3. issue the card (idempotent with the header)
curl -X POST https://weezzz.com/api/v1/cards \
     -H "X-Client-ID: $ID" -H "X-Client-Secret: $SECRET" \
     -H "X-Idempotency-Key: order-1042" -H "Content-Type: application/json" \
     -d '{"product_code":"W02111036","amount":100,"currency":"USD","first_name":"ACME","last_name":"LTD"}'

Endpoints

`GET`	`/api/v1/cards/products`	Product catalogue (min/max, currency)
`POST`	`/api/v1/cards`	Issue a card
`GET`	`/api/v1/cards`	List cards
`GET`	`/api/v1/cards/{id}/details`	Card details (PAN/CVV)
`POST`	`/api/v1/cards/{id}/topup`	Top up a card
`POST`	`/api/v1/cards/{id}/freeze`	Freeze / unfreeze a card
`POST`	`/api/v1/cards/{id}/block`	Block a card
`GET`	`/api/v1/cards/{id}/transactions`	Card transactions
`GET`	`/api/v1/balance`	Wallet balance
`POST`	`/api/v1/wallet/fundings`	Create a funding (top-up) intent
`GET`	`/api/v1/wallet/fundings`	Funding history
`GET`	`/api/v1/wallet/ledger`	Immutable ledger
`GET`	`/api/v1/fees`	Your price list
`GET`	`/api/v1/fees/preview`	Quote a fee before you charge
`GET`	`/api/v1/webhooks`	Webhook configuration
`POST`	`/api/v1/webhooks/test`	Send a test event

All endpoints are versioned under /api/v1 and return JSON.

Webhooks

Configure your endpoint in the panel and we will POST card events (created, top-up, transaction, block, fraud flag). Each request is signed — verify X-Weezzz-Signature = HMAC-SHA256 of <timestamp>.<raw body> with your webhook secret, and reject stale timestamps.

Fraud rules

Attempting to spend far beyond the wallet balance (for example a $5 balance with a $50 attempt) or repeatedly attempting operations without balance triggers an automatic response: the first offence temporarily freezes the card, repeat offences block it permanently. Build an idempotency/retry strategy that respects 403 card_blocked and 422 insufficient_funds.

Errors

401 invalid credentials · 403 scope/IP/card blocked · 422 validation or insufficient funds · 429 rate limited. All error bodies are JSON: {"success":false,"message":"…","code":"…"}.

See pricing and terms. The full partner guide ships with the platform (docs/CARD_API.md) and inside your panel under API docs.