> ## Documentation Index > Fetch the complete documentation index at: https://rain-sandbox-trial.mintlify.site/llms.txt > Use this file to discover all available pages before exploring further. # Create a scoped card for a user > Creates a virtual card scoped to a single transaction, optimized for AI agent usage. This endpoint is protected and requires tenant-level access—contact Rain to enable it during onboarding. The card is created with a lifetime spending limit, an optional expiry, and optional merchant-category (`allowedMccs`) and merchant-name (`allowedMerchants`) allow-lists and returns encrypted card details (PAN and CVC) in the response. By default, a 1.2x ceiling is applied to the spending limit to buffer for authorization holds; this buffer percentage can be configured during onboarding. Requires the `sessionid` header containing an encrypted session ID for retrieving the encrypted card details. **User-level limits** (default values shown; all limits are configurable during onboarding): - Maximum 10 active scoped cards per user - Maximum 10 scoped cards created per user within a rolling 24-hour window - Maximum $5,000 approved spend across all of a user's scoped cards within a rolling 24-hour window Contact Rain's team during onboarding to configure custom limits for active cards, creation velocity, daily spend, and the authorization hold buffer. Card creation fails with a 400 error if the active card limit or creation velocity limit is reached. The daily spend limit is enforced at authorization time—transactions that would exceed the limit are declined with reason `scoped_daily_spend_limit_exceeded`. ## OpenAPI ````yaml post /issuing/users/{userId}/cards/scoped openapi: 3.0.3 info: title: Issuing API description: This is the specification for Rain's Issuing API. termsOfService: https://www.rain.xyz/legal/authorized-user-terms contact: email: support@rain.xyz version: 1.3.0 servers: - url: https://api-dev.rain.xyz/v1 description: Sandbox server - url: https://api.rain.xyz/v1 description: Production server security: [] tags: - name: paymentRoutes description: >- **Endpoint Migration:** The `/v1/automations` endpoints have been renamed to `/v1/payment-routes`. The old `/v1/automations` paths remain available as deprecated aliases during migration. Update your integrations to use `/v1/payment-routes` as the deprecated endpoints will be removed in a future release. - name: simulate description: >- Transaction simulation endpoints for testing integration flows in non-production environments. These endpoints let you trigger transaction events programmatically to automate integration tests and verify webhook handling without depending on external systems or staging real deposits. **Sandbox only** — all simulation endpoints return `404 Not Found` in production. - name: raindrops description: >- Rewards and points management endpoints. Custom API keys need `raindrops:read`/`raindrops:write` for general rewards endpoints and `raindrops-travel:read`/`raindrops-travel:write` for travel redemption endpoints. x-group: rewards paths: /issuing/users/{userId}/cards/scoped: post: tags: - cards summary: Create a scoped card for a user description: >- Creates a virtual card scoped to a single transaction, optimized for AI agent usage. This endpoint is protected and requires tenant-level access—contact Rain to enable it during onboarding. The card is created with a lifetime spending limit, an optional expiry, and optional merchant-category (`allowedMccs`) and merchant-name (`allowedMerchants`) allow-lists and returns encrypted card details (PAN and CVC) in the response. By default, a 1.2x ceiling is applied to the spending limit to buffer for authorization holds; this buffer percentage can be configured during onboarding. Requires the `sessionid` header containing an encrypted session ID for retrieving the encrypted card details. **User-level limits** (default values shown; all limits are configurable during onboarding): - Maximum 10 active scoped cards per user - Maximum 10 scoped cards created per user within a rolling 24-hour window - Maximum $5,000 approved spend across all of a user's scoped cards within a rolling 24-hour window Contact Rain's team during onboarding to configure custom limits for active cards, creation velocity, daily spend, and the authorization hold buffer. Card creation fails with a 400 error if the active card limit or creation velocity limit is reached. The daily spend limit is enforced at authorization time—transactions that would exceed the limit are declined with reason `scoped_daily_spend_limit_exceeded`. operationId: createIssuingScopedCard parameters: - name: sessionid in: header description: Encrypted session ID for retrieving the encrypted card details required: true schema: type: string minLength: 1 - name: userId in: path description: ID of the user to create a scoped card for required: true schema: type: string format: uuid requestBody: description: Scoped card configuration content: application/json: schema: type: object required: - amountInUSDCents properties: amountInUSDCents: type: integer minimum: 1 description: >- The desired spending limit in USD cents. By default, a 1.2x ceiling is applied to buffer for authorization holds (configurable during onboarding). bufferPercentage: type: integer minimum: 0 maximum: 20 description: >- Spend headroom over amountInUSDCents, in whole percent. Omit for the default of 20. Set 0 to disable the buffer so the card's limit equals the amount exactly. binType: type: string enum: - consumer - commercial description: >- BIN the card is issued on. Defaults to consumer. commercial requires corporate card issuance to be enabled for your tenant. expiresAt: type: string format: date-time description: >- Optional absolute expiry (ISO-8601 with UTC offset, at most 365 days in the future). After this time Rain declines new authorizations on the card; refunds and other credits are exempt. allowedMccs: type: array minItems: 1 uniqueItems: true items: type: string pattern: ^[0-9]{4}$ description: >- Optional merchant-category allow-list of four-digit MCCs. Authorizations at merchants outside the list are declined with reason scoped_card_mcc_not_allowed; refunds and other credits are exempt. allowedMerchants: type: array minItems: 1 maxItems: 25 uniqueItems: true items: type: string minLength: 1 maxLength: 64 description: >- Optional merchant allow-list of up to 25 merchant names (each at most 64 characters after trimming; no duplicates or blank entries). Rain matches each authorization's merchant name against the list and declines non-matching merchants with reason merchant_scope_mismatch. Matching is a best-effort name match, and refunds, other credits, and $0 account verifications are exempt. responses: '200': description: Successful operation content: application/json: schema: type: object required: - id - encryptedPan - encryptedCvc - last4 - expirationMonth - expirationYear - status properties: id: type: string format: uuid description: >- The card ID. Can be used to retry the `/issuing/cards/{cardId}/secrets` endpoint if the initial encrypted details retrieval fails. encryptedPan: type: object description: The encrypted PAN required: - iv - data properties: iv: type: string description: The initialization vector data: type: string description: The encrypted data encryptedCvc: type: object description: The encrypted CVC required: - iv - data properties: iv: type: string description: The initialization vector data: type: string description: The encrypted data last4: type: string description: The last 4 digits of the card number expirationMonth: type: string description: The card's expiration month expirationYear: type: string description: The card's expiration year status: $ref: '#/components/schemas/IssuingCardStatus' '400': description: >- Invalid request. Returns specific error messages when user-level limits are reached (limit values shown are defaults; actual limits depend on tenant configuration): - `User has reached the maximum number of active agent cards: {limit}` - Active card limit exceeded - `User has created the maximum number of agent cards in the last 24 hours: {limit}` - Creation velocity limit exceeded '401': description: Invalid authorization '403': description: >- Forbidden - tenant not enabled for scoped card creation or card issuance disabled '404': description: User not found or feature not enabled '500': description: Internal server error security: - ApiKeyAuth: [] components: schemas: IssuingCardStatus: type: string enum: - notActivated - active - locked - canceled securitySchemes: ApiKeyAuth: type: apiKey name: Api-Key in: header ````