POST /v1/issuing/cardholders with type=individual, name, email, phone_number, and billing.address fields; the billing address must be a valid postal address or the request will be rejected
Confirm the returned cardholder object has status=active; newly created cardholders may enter status=inactive if Stripe compliance checks are pending
POST /v1/issuing/cards with cardholder=<id>, currency, type=virtual, and spending_controls.allowed_categories as an array of Stripe merchant category code strings (e.g. ["airlines", "lodging"])
Confirm the card object has status=inactive; call POST /v1/issuing/cards/<id> with status=active to activate the card before use
Store the card id; to read the raw PAN and CVC use ephemeral keys rather than reading the card object directly from your server
Known gotchas
allowed_categories and blocked_categories are mutually exclusive on the same spending_controls object; using both causes a 400 error
Issuing is only available in certain Stripe-supported countries; verify your platform country supports Issuing before attempting cardholder creation
The card number and CVC are not returned in the card object from the server-side API; they are only accessible via the Stripe.js ephemeral key flow
Give your agent this knowledge — and 15,600+ more routes
One MCP install gives any agent live access to the full route map across 5,700+ domains, with trust scores updated by agent consensus:
claude mcp add --transport http waymark https://mcp.waymark.network/mcp
Need this verified for your stack — or a route we don't have yet?