Single-Call Card Issuing & Card Access Links

This release adds a single-call card and cardholder issuing, Card Access Links for lightweight card-detail viewing, and a set of enum, field, and callback updates. It also introduces one breaking change: SEPA Credit Transfer becomes the default and only supported transfer method for EUR external transfers.

🚧
Early access
The single-call card and cardholder issuing, and Card Access Link are in early access. Interested API consumers should reach out to their contact person at Pliant.

Early access

Single-call card issuing and Card Access Link

Two related capabilities for lighter-weight card issuing and viewing flows.

Issue Card with Cardholder

API consumers can now issue a card and create its cardholder in a single request, specifying the cardholder's role and type up front.

New and updated fields on the embedded cardholder object:

Field	Values	Notes
`cardholderType`	`EMBEDDED`, `NON_EMBEDDED`	Required. `EMBEDDED` is managed entirely through the partner's own interface; `NON_EMBEDDED` gets access to Pliant's webapp and app.
`roles`	`CARDHOLDER`, `GUEST`	Array. Default `CARDHOLDER`.
`salutation`	`MR`, `MRS`
`firstName`		Required
`lastName`		Required
`email`		Required
`phoneNumber`		Required
`language`		Required

If the submitted email already belongs to an existing cardholder, the request reuses that cardholder's existing data instead of creating a new one.

Affected endpoints: POST /api/cards/{cardholderId}, POST /api/cards/{cardholderId}/instant, POST /cards/{cardholderId}/instant-pci (the standard Issue Card endpoint and its two instant variants)

Card Access Link

API consumers can now request a short-lived, no-signup link that grants limited access to a cardholder's virtual card details, and revoke it early if needed.

New endpoints

POST   /api/cards/{cardId}/access-link
DELETE /api/cards/{cardId}/access-link

Endpoint	Purpose	Notes
`POST /api/cards/{cardId}/access-link`	Request an access link	Body: `sendEmail`, `expiryDate`. Returns `202` with `accessLink` and `expiryDate`.
`DELETE /api/cards/{cardId}/access-link`	Revoke active access links for the card

New callback: CARD_ACCESS_LINK_REQUESTED delivers the same payload for consumers who want to relay or refresh the link themselves.

Availability: both capabilities are in early access. Reach out to your contact person at Pliant if you are interested.

Breaking changes

EUR external transfers now require SEPA Credit Transfer

SEPA_CREDIT_TRANSFER is now the default and only supported transferMethod for EUR external transfers. INSTANT_CREDIT_TRANSFER is no longer valid for EUR.

The VoP (Verification of Payee) requirement, previously tied to INSTANT_CREDIT_TRANSFER, now applies to SEPA_CREDIT_TRANSFER. Responses include a new vop object:

vopResult: one of MATCH, CLOSE_MATCH, NO_MATCH, UNAVAILABLE
vopExternalVerificationId
vopExpiresAt

Migration: partners sending EUR transfers with INSTANT_CREDIT_TRANSFER must switch to SEPA_CREDIT_TRANSFER and handle the new vop response fields.

New features

Same-currency transfer support for additional currencies

Same-currency external transfers are now supported for more currencies. The transferMethod to use depends on the currency:

Currency	`transferMethod`
EUR	`SEPA_CREDIT_TRANSFER` (default and only supported)
SEK, DKK	`INSTANT_CREDIT_TRANSFER`
AED, HUF, NOK, PLN, RON, CZK	omit the field entirely

Affected endpoints: GET /api/external-transfers, POST /api/external-transfers, PUT /api/external-transfers/{id}

Card Available Balance Changed callback

API consumers can now subscribe to real-time notifications when a card's available balance changes, including its initial value.

New event type: CARD_AVAILABLE_BALANCE_CHANGED
Payload fields: organizationId, cardholderId, cardId, cardAccountId, availableBalance (value, currency)
Subscribe via: the existing CardSubscriptionRequest.

Improvements

Additional Limit currency scope

Additional card limits can now be scoped to a specific transaction currency, independent of the card account's billing currency.

New field: scope.currency on additional limits. When set, it must differ from the card account's billing currency, and limit.value's currency must match scope.currency.

Affected endpoints: POST /api/cards, POST /api/cards/requests, POST /api/cards/limits/requests, PUT /api/cards/limits/{cardId}, GET /api/cards/{cardId}, GET /api/cards/details

Card validity period no longer limited to travel cards

validFrom, validTo, and validTimezone can now be set on any card, not just TRAVEL and TRAVEL_CC cards. The "Update Travel Card Validity Period" endpoint has been renamed to "Update Card Validity Period" to reflect the broader scope.

Note: the earliest possible date for validTo is now the current date.

Custom field visibility

Custom fields can now be hidden from cardholders while remaining visible to admins, or hidden entirely.

New field: visibility (ADMIN_AND_CARDHOLDER, ADMIN_ONLY, NOWHERE), default ADMIN_AND_CARDHOLDER.

Affected endpoints: POST /api/transactions/custom-fields, PUT /api/transactions/custom-fields/{customFieldId}, GET /api/transactions/custom-fields