> ## Documentation Index
> Fetch the complete documentation index at: https://docs.fastpaybrasil.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Register a card

> Registers a new credit card for a customer. The card is stored securely
in the token vault and can be used for recurring charges.

By default (`validateCard=true`), a small test transaction (up to R$ 2.00)
is made to validate the card. The customer must verify this amount on their
statement and use the `/cards/{id}/activate` endpoint to activate the card.



## OpenAPI

````yaml /api-reference/openapi.yaml post /v1/cards
openapi: 3.0.0
info:
  title: FastPay API
  version: 1.0.0
  description: >-
    API for creating and managing payment charges.


    ## Authentication


    This API uses **Basic Authentication** for direct API access, such as
    creating charges.

    Use your API key as the username and an empty string as password.

    The header should be formatted as:


    `Authorization: Basic {base64(apiKey:)}`.


    For example:


    ```

    Authorization: Basic YWxleG91dG9uOiIi

    ```


    ## Webhooks


    FastPay sends webhooks to notify your application about charge status
    changes in real-time.

    Webhooks are sent via HTTP POST requests to your configured webhook
    endpoints.


    ### Webhook Events


    The following webhook events are available for charges:


    - `charge.created` - Sent when a new charge is created

    - `charge.pending` - Sent when a charge is pending payment

    - `charge.paid` - Sent when a charge is successfully paid

    - `charge.updated` - Sent when a charge is updated


    ### Webhook Payload Structure


    All webhook payloads follow this structure:


    ```json

    {
      "id": "webhook_event_id",
      "event": "charge.paid",
      "data": {
        // Complete charge object
      }
    }

    ```


    ### Webhook Delivery


    - Webhooks are sent via HTTP POST requests

    - Content-Type: `application/json`

    - Retry logic is implemented for failed deliveries

    - Webhook events are stored in the database for audit purposes

    - Delivery logs are maintained for debugging and monitoring


    ### Webhook Security


    - Webhooks are sent to pre-configured endpoints

    - Endpoints can be enabled/disabled per merchant

    - Event filtering is supported (only receive specific events)

    - Failed deliveries are retried with exponential backoff
servers:
  - url: https://api-global.fastpaybrasil.com
    description: Produção e Sandbox (diferenciados pela API key)
security: []
paths:
  /v1/cards:
    post:
      tags:
        - Cards
      summary: Register a card
      description: >-
        Registers a new credit card for a customer. The card is stored securely

        in the token vault and can be used for recurring charges.


        By default (`validateCard=true`), a small test transaction (up to R$
        2.00)

        is made to validate the card. The customer must verify this amount on
        their

        statement and use the `/cards/{id}/activate` endpoint to activate the
        card.
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/RegisterCard'
      responses:
        '201':
          description: Card registered successfully
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RegisterCardResponse'
        '400':
          description: Invalid card data or registration failed
          content:
            application/json:
              schema:
                type: object
                properties:
                  statusCode:
                    type: integer
                    example: 400
                  message:
                    type: string
                    example: Failed to register card
        '401':
          description: Unauthorized - invalid credentials
          content:
            application/json:
              schema:
                type: object
                properties:
                  statusCode:
                    type: integer
                    example: 401
                  message:
                    type: string
                    example: Unauthorized
      security:
        - basic: []
components:
  schemas:
    RegisterCard:
      type: object
      required:
        - customerId
        - number
        - holderName
        - expirationMonth
        - expirationYear
        - cvv
      properties:
        customerId:
          type: string
          description: Customer ID who owns the card
          example: 2RhQg9M7ZCg3X3nMb9W1kX8Q
        number:
          type: string
          description: Card number
          example: '4111111111111111'
        holderName:
          type: string
          description: Name printed on card
          example: JOHN DOE
        expirationMonth:
          type: string
          minLength: 2
          maxLength: 2
          description: Expiration month (01-12)
          example: '12'
        expirationYear:
          type: string
          minLength: 4
          maxLength: 4
          description: Expiration year (YYYY)
          example: '2028'
        cvv:
          type: string
          minLength: 3
          description: Security code
          example: '123'
        alias:
          type: string
          description: Optional alias for the card
          example: My Visa Card
        validateCard:
          type: boolean
          default: true
          description: >-
            Whether to validate the card with a test transaction.

            When true, a small amount (up to R$ 2.00) is charged and must be
            confirmed

            via the /cards/{id}/activate endpoint.
          example: true
    RegisterCardResponse:
      type: object
      properties:
        id:
          type: string
          description: Card token ID
          example: 2RhQg9M7ZCg3X3nMb9W1kX8Q
        token:
          type: string
          description: Card token for future reference
          example: tok_abc123xyz
        maskedNumber:
          type: string
          nullable: true
          description: Masked card number (last 4 digits)
          example: '****1111'
        status:
          type: string
          enum:
            - pending_validation
            - active
          description: Card status
          example: pending_validation
        pendingActivation:
          type: boolean
          description: Whether card requires activation
          example: true
        activation:
          type: object
          nullable: true
          description: Activation instructions (only when validateCard=true)
          properties:
            required:
              type: boolean
              example: true
            message:
              type: string
              example: >-
                Verifique o valor da transacao de teste na fatura do cartao e
                use o endpoint /cards/:id/activate
  securitySchemes:
    basic:
      type: http
      scheme: basic
      description: |-
        HTTP Basic authentication. Use your secret key as the
        username and an empty string as password. The API key
        should be base64 encoded in the format 'username:' when
        sending the Authorization header.

````