Browse the docs

Assign cardholder to card

POST /v2/api-gateway/cards/{card_id}/assign-cardholder

Links the card to a cardholder identified by exactly one of cardholder_id or external_id. Returns 200 (not 201) with { message }.

Request

Authentication: your API key in the x-api-key header.

Path parameters

Field	Type	Description
`card_id` required	string, uuid	Card UUID (the card `id` returned by the card endpoints).

Headers

Field	Type	Description
`Idempotency-Key`	string	A unique string you choose, up to 255 characters, that makes this request safe to retry. If a request times out or fails in transit, send it again with the same key: the status code and body of the first attempt are returned and the operation is not performed a second time. Stored replies — including failures — are replayed for 24 hours, after which the same key starts a fresh request. Reusing a key for a different request, or sending it while the first request is still running, returns 409. Omit the header and the request behaves exactly as before. Document upload endpoints do not accept it.

Body

Field	Type	Description
`external_id`	string	Your identifier for the cardholder. Provide exactly one of `external_id` or `cardholder_id`. Canonical name for the value this route also accepts as `end_customer_id`. Send one or the other; sending both with different values is rejected.
`end_customer_id`	string	Deprecated alias of `external_id`, kept working for existing integrations. Send one or the other; sending both with different values is rejected.
`cardholder_id`	string, uuid	The Moon cardholder id (`id`, a UUID). Provide exactly one of `external_id` or `cardholder_id`.

Example request

cURL

curl --request POST \
     --url 'https://api.themooncard.com/v2/api-gateway/cards/7c9e6679-7425-40de-944b-e07fc1f90ae7/assign-cardholder' \
     --header 'x-api-key: YOUR_API_KEY' \
     --header 'content-type: application/json' \
     --data '{
       "external_id": "customer_123",
       "end_customer_id": "customer_123",
       "cardholder_id": "3f5b1c2e-8d4a-4b6f-9e2a-1c7d8e9f0a1b"
     }'

Responses

200 Success

Field	Type	Description
`message` required	string	Human-readable confirmation of what happened. The wording is fixed per route — the response description on each operation quotes it — but it is not a stable machine key: branch on the 2xx status, not on this text.

JSON

{
  "message": "Cardholder assigned to card"
}

400 Error

Validation failed (errors[] lists each offending field) or a domain rule rejected the request ({ message, code }).