Organization Creation, Single-Call Card Issuing & Card Access Links

This release adds a self-service Organization Creation API, single-call card and cardholder issuing, Card Access Links for lightweight card-detail viewing, and a set of enum, field, and callback updates. It also introduces one breaking change: SEPA Credit Transfer becomes the default and only supported transfer method for EUR external transfers.

🚧
Early access
The Organization Creation API, single-call card and cardholder issuing, and Card Access Link are in early access. Interested partners should reach out to their contact person at Pliant.

Early access

Organization Creation API

Partners can now onboard a new organization directly via the API instead of a manual lead handoff.

New endpoint

POST /api/organizations

Request

Requires an Idempotency-Key header (16 to 256 characters). Reusing a key with a different body returns 409.

Required body fields: name, country, currency, billingAddress, legalForm, tradeRegisterNumber, foundationDate, and partnerOrganizationId.

An optional leadData block carries commercial context: accountType, industry, yearlyRevenue, numberOfEmployees, plannedNumberOfCards, customerAcquisitionChannel, contacts, and more.

Response

201 with the created organization.
422 ORGANIZATION_CANNOT_BE_ONBOARDED if the organization cannot be onboarded.

Availability: early access. Reach out to your contact person at Pliant if you are interested.

Single-call card issuing and Card Access Link

Two related capabilities for lighter-weight card issuing and viewing flows.

(1) Issue Card with Cardholder

Partners can now issue a card and create its cardholder in a single request, specifying the cardholder's role and type up front.

New and updated fields on the embedded cardholder object:

Field	Values	Notes
`cardholderType`	`EMBEDDED`, `NON_EMBEDDED`	Required. `EMBEDDED` is managed entirely through the partner's own interface; `NON_EMBEDDED` gets access to Pliant's web app and app.
`roles`	`CARDHOLDER`, `GUEST`	Array. Default `CARDHOLDER`.
`salutation`	`MR`, `MRS`
`firstName`		Required
`lastName`		Required
`email`		Required
`phoneNumber`		Required
`language`		Required

If the submitted email already belongs to an existing cardholder, the request reuses that cardholder's existing data instead of creating a new one.

Affected endpoints: POST /api/cards/{cardholderId}, POST /api/cards/{cardholderId}/instant, POST /cards/{cardholderId}/instant-pci (the standard Issue Card endpoint and its two instant variants)

(2) Card Access Link

Partners can now request a short-lived, no-signup link that grants limited access to a cardholder's virtual card details, and revoke it early if needed.

New endpoints

POST   /api/cards/{cardId}/access-link
DELETE /api/cards/{cardId}/access-link

Endpoint	Purpose	Notes
`POST /api/cards/{cardId}/access-link`	Request an access link	Body: `sendEmail`, `expiryDate`. Returns `202` with `accessLink` and `expiryDate`.
`DELETE /api/cards/{cardId}/access-link`	Revoke active access links for the card

New callback: CARD_ACCESS_LINK_REQUESTED delivers the same payload for partners who want to relay or refresh the link themselves. Subscribe via the existing CardSubscriptionRequest.

Availability: both capabilities are in early access. Reach out to your contact person at Pliant if you are interested.

Breaking changes

EUR external transfers now require SEPA Credit Transfer

SEPA_CREDIT_TRANSFER is now the default and only supported transferMethod for EUR external transfers. INSTANT_CREDIT_TRANSFER is no longer valid for EUR.

The VoP (Verification of Payee) requirement, previously tied to INSTANT_CREDIT_TRANSFER, now applies to SEPA_CREDIT_TRANSFER. Responses include a new vop object:

vopResult: one of MATCH, CLOSE_MATCH, NO_MATCH, UNAVAILABLE
vopExternalVerificationId
vopExpiresAt

Affected endpoints: GET /api/external-transfers, POST /api/external-transfers, PUT api/external-transfers/{id}

Migration: partners sending EUR transfers with INSTANT_CREDIT_TRANSFER must switch to SEPA_CREDIT_TRANSFER and handle the new vop response fields.

New features

Same-currency transfer support for additional currencies

Same-currency external transfers are now supported for more currencies. The transferMethod to use depends on the currency:

Currency	`transferMethod`
EUR	`SEPA_CREDIT_TRANSFER` (default and only supported)
SEK, DKK	`INSTANT_CREDIT_TRANSFER`
AED, HUF, NOK, PLN, RON, CZK	omit the field entirely

Affected endpoints: GET /api/external-transfers, POST /api/external-transfers, PUT /api/external-transfers/{id}, POST /api/beneficiaries/{beneficiaryId}/payment-details, GET /api/beneficiaries/{beneficiaryId}/payment-details

Card Available Balance Changed callback

Partners can now subscribe to real-time notifications when a card's available balance changes, including its initial value.

New event type: CARD_AVAILABLE_BALANCE_CHANGED
Payload fields: organizationId, cardholderId, cardId, cardAccountId, availableBalance (value, currency)
Subscribe via: the existing CardSubscriptionRequest.

Cardholder registration completed callback

A new webhook event, CARDHOLDER_REGISTRATION_COMPLETED, fires the moment a cardholder finishes first login: a verified MFA factor (phone number) plus terms acceptance. This is exactly the point at which card issuance becomes possible, so partners should key card issuance on this event going forward.

Fires when the cardholder completes their first login, including MFA verification, phone number verification, and acceptance of the terms. It does not fire when the member is created as part of the onboarding submission.

Improvements

Additional Limit currency scope

Additional card limits can now be scoped to a specific transaction currency, independent of the card account's billing currency.

New field: scope.currency on additional limits. When set, it must differ from the card account's billing currency, and additionalLimits.limit.value's currency must match scope.currency.

Affected endpoints: POST /api/cards, POST /api/cards/requests, POST /api/cards/limits/requests, PUT /api/cards/limits/{cardId}, GET /api/cards/{cardId}, GET /api/cards/details

Card validity period no longer limited to travel cards

validFrom, validTo, and validTimezone can now be set on any card, not just TRAVEL and TRAVEL_CC cards. The "Update Travel Card Validity Period" endpoint has been renamed to "Update Card Validity Period" to reflect the broader scope.

Note: the earliest possible date for validTo is now the current date.

Custom field visibility

Custom fields can now be hidden from cardholders while remaining visible to admins, or hidden entirely.

New field: visibility (ADMIN_AND_CARDHOLDER, ADMIN_ONLY, NOWHERE), default ADMIN_AND_CARDHOLDER.

Affected endpoints: POST /api/transactions/custom-fields, PUT /api/transactions/custom-fields/{customFieldId}, GET /api/transactions/custom-fields

Onboarding submission: phone number no longer mandatory

Phone number fields for authorized signatories and UBOs in onboarding submissions are now optional instead of mandatory. Partners submitting onboarding files without phone numbers will no longer receive a validation rejection.

US entity fields for onboarding submissions

Onboarding submissions now support additional US-specific fields:

A full US state enum on addresses
businessDescription and otherDescription on entities
ein (US EIN) and ssn (US Social Security Number) on individuals
A new VERIFF identity-verification-provider option