UPP Docs
Card

Create a cardholder

POST
/cardholders

Registers a cardholder for a customer and submits it to the card issuer for review in the background. The response has status: pending; get the result from GET /cardholders/{cardholderId} or the cardholder.status_changed webhook. When the issuer does not need cardholders and only the product's application conditions require one, the cardholder is registered in UPP only and returned as approved.

  • The customer must already have an approved verification of the product's cardholder_verification_usage usage (default basic). Name, ID document and photos come from that verification and are not sent in the request.
  • When the product has requirements (cardholder_requirement_id is not null), field names are the issuer's field names (they may contain dots, such as kycVerification.referenceId; use them as-is as keys in fields, do not nest them). customer_id is optional, in which case the cardholder is not linked to a customer. The issuer decides whether a customer verification is needed and which fields the customer or verification can supply: when linked to a customer, name, ID document and photos usually come from the customer's verification and submitted values do not override it; when not linked, fill in cardholder_fields, using file IDs from the Files API for fields of type file. Cardholders registered only in UPP are validated against cardholder_fields only.
  • See the product's cardholder_fields for fields and formats. Only fields the product requires are stored; extra fields are ignored. Validation error keys are fields.<field name>.
  • A customer can have only one cardholder that has not failed per card product.

Authorization

merchantApiKeymerchantTimestampmerchantNoncemerchantSignature
headerX-API-KEY<token>

Merchant API key (starts with upk_, also accepts api-key); signing headers are also required

headerX-Timestamp<token>

Unix timestamp in seconds, within 300 seconds of server time

headerX-Nonce<token>

Unique per request; cannot be reused with the same credential during the timestamp validity window

headerX-Signature<token>

Hex HMAC-SHA256 signature (either letter case) of the method, full path, timestamp, nonce and body digest

Request Body

application/json
  1. body
customer_id?|

Customer ID (starts with cus_) with an approved verification of the usage the product requires (default basic). Optional when the product has requirements, in which case the cardholder is not linked to a customer and the issuer decides whether a verification is needed

card_product_id*string

ID of a card product that requires cardholders

fields*

Field name => value; see the product's cardholder_fields for fields and formats

Response Body

Registered, awaiting the issuer's review

application/json
  1. response
id*string

Cardholder ID (starts with chd_)

customer_id*|

Customer ID; null when the cardholder is not linked to a customer

card_product_id*|

Card product ID used at registration

first_name*|

From the customer's identity verification; when the product has requirements, derived by the issuer from the verification or submitted fields; null for cardholders registered only in UPP

last_name*string|null
status*CardholderStatus
  • pending: registered, being submitted or awaiting the issuer's review
  • approved: approved; you can apply for cards
  • rejected: rejected by the issuer (resubmitting with changes is not supported yet)
  • failed: not accepted by the issuer (invalid information, for example); you can register again for this customer
Value in"pending""approved""rejected""failed"
failure_reason*|

Reason when rejected / failed

created_at*string
Formatdate-time
updated_at*string
Formatdate-time
Example Request
curl -X POST 'https://sandbox.getupp.net/api/v1/cardholders' \  -H 'Content-Type: application/json' \  -d '{  "customer_id": "cus_01m5erdr5qkats44wcfnc5sfbf",  "card_product_id": "cpd_01JBXA3M6N8Q2R4T6V8W0Y2Z4H",  "fields": {    "email": "[email protected]",    "area_code": "+60",    "mobile": "123456789",    "birthday": "1992-04-18",    "gender": "F",    "nationality": "MY",    "document_issued_at": "2021-03-02",    "country": "MY",    "town": "Kuala Lumpur",    "address": "12 Jalan Ampang",    "post_code": "50450",    "ip_address": "203.0.113.10"  }}'
Example Response
{  "id": "chd_01m5ergfs354xnjeazkx60hgwv",  "customer_id": "cus_01m5erdr5qkats44wcfnc5sfbf",  "card_product_id": "cpd_01JBXA3M6N8Q2R4T6V8W0Y2Z4H",  "first_name": "Aisyah",  "last_name": "Rahman",  "status": "pending",  "failure_reason": null,  "created_at": "2026-10-21T08:16:12.000000Z",  "updated_at": "2026-10-21T08:16:12.000000Z"}