Card Issuing · Developer APIs
The Developer Platform
Build & Ship in Days
One API call to issue virtual and physical cards, manage cardholders, and process transactions. Real-time webhooks, documented error codes, and a sandbox that mirrors live — so you can go from first line of code to first card issued, fast.
~ms
Avg. Response Time
%
Uptime SLA
K+
Requests / sec
The CaaS API · v3.20
One REST API to run a card program
Six resources cover the full lifecycle — define a program, issue cards, and react to every authorization. Jump straight to the reference.
Issue & manage
Build your program
Monitor & react
Quickstart
Issue your first card
Zero to a live, KYC-approved virtual card in four calls. The sandbox is free once your program is approved — KYC clears in seconds.
Ping the API
GET /ping Verify network access — no auth required.
Create a cardholder
POST /cardholders KYC is triggered automatically and runs async.
Wait for KYC approval
CARDHOLDER_KYC_APPROVED A signed webhook fires the moment it clears.
Issue a card
POST /cards Returns an active card — PAN, CVV & expiry over API.
# 1 · Ping (no auth)
curl https://api.fyatu.com/api/v3.20/ping
# 2 · Create a cardholder — KYC starts automatically
curl -X POST https://api.fyatu.com/api/v3.20/cardholders \
-H "Authorization: Bearer $FYATU_API_KEY" \
-H "Content-Type: application/json" \
-d '{
"programId": "prg_01HXYZ9876ABCDEF0000",
"firstName": "Jane",
"lastName": "Doe",
"email": "[email protected]",
"dateOfBirth": "1992-03-20",
"nationality": "US"
}'
# 3 · Wait for the CARDHOLDER_KYC_APPROVED webhook, then…
# 4 · Issue a virtual card
curl -X POST https://api.fyatu.com/api/v3.20/cards \
-H "Authorization: Bearer $FYATU_API_KEY" \
-H "Content-Type: application/json" \
-d '{
"cardholderId": "chl_01HXYZ1234ABCDEF5678",
"programId": "prg_01HXYZ9876ABCDEF0000",
"type": "VIRTUAL"
}'API Infrastructure Built for Production
No surprises when you go live. The same infrastructure that handles millions of transactions is available to you from the first API call.
Rate Limits That Scale With You
Start at 500 req/s on free tier — burst headroom included. Every response carries X-RateLimit-Remaining and X-RateLimit-Reset so your client can back off cleanly. Enterprise limits are raised via a single support ticket, no re-provisioning.
Your Server Never Touches a PAN
Card numbers are tokenized at issuance — your API responses contain a network_token, not a raw PAN. Webhook payloads are signed with HMAC-SHA256; verify the X-Fyatu-Signature header before processing. PCI DSS Level 1 certified.
Incidents Surface Before You Page On-Call
Multi-region active-active deployment with automatic failover under 30 s. Subscribe to status.fyatu.com for push alerts on any degradation. 99.9% uptime SLA with financial credits if breached.
Test Mode Is One Header Away
Sandbox uses the exact same endpoints as production — no separate base URL. Pass X-Fyatu-Mode: test to run simulated authorizations, trigger declined-card scenarios, and fire test webhooks to your local ngrok tunnel. Flip to live by removing the header.
Resources
Everything you need to ship
The API design is clean — consistent naming, predictable error shapes, and the sandbox mirrors production exactly. We went from zero to issuing live cards in under two weeks.
Lead Engineer
Card Issuing Integration · Fintech Platform