curl --request POST \
  --url https://apigwuat.corpay.com/cards/created \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "customerAccountNumber": "<string>",
  "orderReference": "<string>",
  "target_url": "<string>",
  "hmac_enabled": true,
  "hmac_secret": "<string>",
  "max_retries": 123
}
'

import requests

url = "https://apigwuat.corpay.com/cards/created"

payload = {
    "customerAccountNumber": "<string>",
    "orderReference": "<string>",
    "target_url": "<string>",
    "hmac_enabled": True,
    "hmac_secret": "<string>",
    "max_retries": 123
}
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: JSON.stringify({
    customerAccountNumber: '<string>',
    orderReference: '<string>',
    target_url: '<string>',
    hmac_enabled: true,
    hmac_secret: '<string>',
    max_retries: 123
  })
};

fetch('https://apigwuat.corpay.com/cards/created', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://apigwuat.corpay.com/cards/created",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'customerAccountNumber' => '<string>',
    'orderReference' => '<string>',
    'target_url' => '<string>',
    'hmac_enabled' => true,
    'hmac_secret' => '<string>',
    'max_retries' => 123
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://apigwuat.corpay.com/cards/created"

	payload := strings.NewReader("{\n  \"customerAccountNumber\": \"<string>\",\n  \"orderReference\": \"<string>\",\n  \"target_url\": \"<string>\",\n  \"hmac_enabled\": true,\n  \"hmac_secret\": \"<string>\",\n  \"max_retries\": 123\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://apigwuat.corpay.com/cards/created")
  .header("Authorization", "Bearer <token>")
  .header("Content-Type", "application/json")
  .body("{\n  \"customerAccountNumber\": \"<string>\",\n  \"orderReference\": \"<string>\",\n  \"target_url\": \"<string>\",\n  \"hmac_enabled\": true,\n  \"hmac_secret\": \"<string>\",\n  \"max_retries\": 123\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://apigwuat.corpay.com/cards/created")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"customerAccountNumber\": \"<string>\",\n  \"orderReference\": \"<string>\",\n  \"target_url\": \"<string>\",\n  \"hmac_enabled\": true,\n  \"hmac_secret\": \"<string>\",\n  \"max_retries\": 123\n}"

response = http.request(request)
puts response.read_body

{
  "status": "created",
  "integration_key": "corpay.gfn.cards.created.customerAccountNumber.7000001565.orderReference.593153cc-7cb0-48e4-8f7c-e9bea6ce8bb9",
  "webhook_id": "744317f9-ca90-4388-bb00-f2a10f1db627"
}

{
  "errorCode": "ER-001",
  "errorDescription": "Invalid request parameters"
}

{
  "error": "Integration key already registered",
  "integration_key": "corpay.gfn.cards.created.customerAccountNumber.7000001565.orderReference.593153cc-7cb0-48e4-8f7c-e9bea6ce8bb9"
}

{
  "errorCode": "ER-012",
  "errorDescription": "The server encountered an unexpected condition and could not complete the request. Please contact Corpay Support."
}

Webhooks

Register for getting details of newly created cards.

To get newly ordered cards data from Corpay system, register for webhook using Customer Account Number and Order reference (Which was part of response of card order API). Please note, the registration needs to be done immediately after card order. If registration process has failed and consumer has missed the response, then same data can be obtained using /cards/search API. for each card order the registration needs to be done separately. if hmac_enabled is set true then hmac_secret is needed. max_retries value by default it set to 1. Upon successful card order, the newly created cards will be published to target url as array of card object. The cards created will not be activated immediately, the card will be activated once the physical card has been created and sent to card delivery address, which takes upto 2 days. The webhook would respond with created card data once the cards are activated in Corpay System, Which would take upto 24 - 36 hrs. To get the real time status of the card, register for card status updates using Card Identifier received from this webhook.

POST

cards

created

curl --request POST \
  --url https://apigwuat.corpay.com/cards/created \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "customerAccountNumber": "<string>",
  "orderReference": "<string>",
  "target_url": "<string>",
  "hmac_enabled": true,
  "hmac_secret": "<string>",
  "max_retries": 123
}
'

import requests

url = "https://apigwuat.corpay.com/cards/created"

payload = {
    "customerAccountNumber": "<string>",
    "orderReference": "<string>",
    "target_url": "<string>",
    "hmac_enabled": True,
    "hmac_secret": "<string>",
    "max_retries": 123
}
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: JSON.stringify({
    customerAccountNumber: '<string>',
    orderReference: '<string>',
    target_url: '<string>',
    hmac_enabled: true,
    hmac_secret: '<string>',
    max_retries: 123
  })
};

fetch('https://apigwuat.corpay.com/cards/created', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://apigwuat.corpay.com/cards/created",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'customerAccountNumber' => '<string>',
    'orderReference' => '<string>',
    'target_url' => '<string>',
    'hmac_enabled' => true,
    'hmac_secret' => '<string>',
    'max_retries' => 123
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://apigwuat.corpay.com/cards/created"

	payload := strings.NewReader("{\n  \"customerAccountNumber\": \"<string>\",\n  \"orderReference\": \"<string>\",\n  \"target_url\": \"<string>\",\n  \"hmac_enabled\": true,\n  \"hmac_secret\": \"<string>\",\n  \"max_retries\": 123\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://apigwuat.corpay.com/cards/created")
  .header("Authorization", "Bearer <token>")
  .header("Content-Type", "application/json")
  .body("{\n  \"customerAccountNumber\": \"<string>\",\n  \"orderReference\": \"<string>\",\n  \"target_url\": \"<string>\",\n  \"hmac_enabled\": true,\n  \"hmac_secret\": \"<string>\",\n  \"max_retries\": 123\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://apigwuat.corpay.com/cards/created")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"customerAccountNumber\": \"<string>\",\n  \"orderReference\": \"<string>\",\n  \"target_url\": \"<string>\",\n  \"hmac_enabled\": true,\n  \"hmac_secret\": \"<string>\",\n  \"max_retries\": 123\n}"

response = http.request(request)
puts response.read_body

{
  "status": "created",
  "integration_key": "corpay.gfn.cards.created.customerAccountNumber.7000001565.orderReference.593153cc-7cb0-48e4-8f7c-e9bea6ce8bb9",
  "webhook_id": "744317f9-ca90-4388-bb00-f2a10f1db627"
}

{
  "errorCode": "ER-001",
  "errorDescription": "Invalid request parameters"
}

{
  "error": "Integration key already registered",
  "integration_key": "corpay.gfn.cards.created.customerAccountNumber.7000001565.orderReference.593153cc-7cb0-48e4-8f7c-e9bea6ce8bb9"
}

{
  "errorCode": "ER-012",
  "errorDescription": "The server encountered an unexpected condition and could not complete the request. Please contact Corpay Support."
}

Authorizations

Authorization

string

header

required

Use OAuth2 client credentials to obtain a bearer token.

Token endpoint: POST <BASE_URL>/keycloak/realms/longship/protocol/openid-connect/token

Use the same base URL as the selected API server:

Test environment: https://apigwuat.corpay.com
Production environment: https://apigw.corpay.com

Example:

curl --location '<BASE_URL>/keycloak/realms/longship/protocol/openid-connect/token' \
--header 'accept: application/json' \
--data-urlencode 'grant_type=client_credentials' \
--data-urlencode 'client_id=.......' \
--data-urlencode 'client_secret=......'

Body

application/json

customerAccountNumber

string

required

orderReference

string

required

target_url

string

required

url for the system where webhook should respond to in case of event.

hmac_enabled

boolean

hmac_secret

string

max_retries

integer

Response

created

status

string

integration_key

string

webhook_id

string

⌘I