> ## Documentation Index
> Fetch the complete documentation index at: https://docs.thedecard.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Quickstart

> The third page of Getting Started. It walks you through issuing your first virtual card in the sandbox using the step-by-step path we recommend: create the customer, apply for a KYC ticket, then apply for the virtual card.

***

## 📄 Guide

This guide gets the core endpoints working in the sandbox and issues your first virtual card, in five steps.

Sandbox base URL: `https://api.thedecard-sandbox.com`

> The examples below leave out authentication headers and field encryption. Every request must carry the four authentication headers (`X-DAPI-API-KEY` / `X-DAPI-TIMESTAMP` / `X-DAPI-NONCE` / `X-DAPI-SIGN`) and set `Content-Type: application/json`, and sensitive fields such as phone number, email and KYC data must be AES encrypted. For the rules, see [Authentication](../integration-resources/authentication).

> **Why the step-by-step path** (create customer, apply for KYC, apply for card):
>
> * **The KYC ticket is reusable**: when the same customer applies for a second card there is no need to resubmit documents, simply reuse the same `kycTicketId`.
> * **Clearer states, easier troubleshooting**: KYC and card issuing are decoupled, each with its own ticket and its own state line.

### 1. Create the customer

```http theme={null}
POST /open-api/customer/v1/create-customer
```

```json theme={null}
{ "phoneCountryCode": "SG", "phone": "+6591234567", "email": "user@example.com", "customerRef": "your-uniq-ref-001" }
```

The response returns `customerId`, which every later step needs:

```json theme={null}
{ "code": "SYS_SUCCESS", "message": "success", "messageDetail": null, "data": { "customerId": "C100001", "status": "SUCCEED" } }
```

### 2. Apply for a KYC ticket

> Upload the identity documents first: call `POST /open-api/intent-ticket/v1/generate-pre-upload-url` (`businessType=CREATE_CARD_KYC`) to get a temporary upload URL, PUT the file, then take the returned `objectKey` and pass it as `identityProofUrl` below. For the full sequence, see [Apply for KYC](../how-to-use/kyc/apply-kyc), "Option 2, step 1".

```http theme={null}
POST /open-api/kyc-ticket/v1/apply-kyc
```

```json theme={null}
{
  "kycTicketRef": "your-kyc-ref-001",
  "customerId": "C100001",
  "identifyProofList": [ { "identityProofType": "PASSPORT", "identityProofUrl": "<objectKey returned by the pre-upload call>" } ],
  "addressProofList": [],
  "kycCareerInfo": { "employmentStatus": "EMPLOYED", "occupation": "..." }
}
```

The response returns `kycTicketId`:

```json theme={null}
{ "data": { "kycTicketId": "KYC_1a2b", "kycTicketRef": "your-kyc-ref-001", "status": "PENDING" } }
```

> **Wait for the ticket to reach `PASSED`**: take the result from the `KYC_TICKET` webhook or from the query endpoint. If the status is `NEED_VERIFY`, guide the customer through liveness verification. For document fields, the state machine and rejection codes, see [How-to · Apply for KYC](../how-to-use/kyc/apply-kyc); for eligible regions and the document requirements of each region, see [Compliance and KYC](../basic-concepts/compliance-kyc-flow).

### 3. Apply for the virtual card (NORMAL mode)

Once the KYC ticket is `PASSED`, apply for the card with `kycTicketId` plus `customerId`:

```http theme={null}
POST /open-api/card-order/v1/apply-virtual
```

```json theme={null}
{
  "profileId": "your-card-profile-id",
  "cardOrderRef": "your-order-ref-001",
  "cardApplyMode": "NORMAL",
  "customerId": "C100001",
  "kycTicketId": "KYC_1a2b"
}
```

> The response returns `cardOrderId`. For any further card the same customer applies for, **just reuse the same `kycTicketId`, there is no need to resubmit KYC**.

### 4. Query the card order and wait for issuing to succeed

```http theme={null}
GET /open-api/card-order/v1/detail?cardOrderId=O100001
```

Poll until `status = COMPLETED`; the response then carries `cardId`:

```json theme={null}
{ "data": { "cardOrderId": "O100001", "status": "COMPLETED", "cardId": "CARD100001" } }
```

> Card order state line: `PENDING → CUSTOMER_PASS → KYC_PASS → CHANNEL_CUSTOMER_PASS → COMPLETED`. On `FAILED`, check `errorCode` / `errorReason` (see [Card application error codes](../how-to-use/cards/card-order-codes)).

### 5. Query the card details, the card is ready to spend

```http theme={null}
GET /open-api/card/v1/detail?cardId=CARD100001
```

```json theme={null}
{ "data": { "cardId": "CARD100001", "status": "ACTIVATED", "panFirst6": "441364", "panLast4": "1234" } }
```

> Virtual cards are **activated automatically** (physical cards must be activated). The full card number and CVV are only available through a dedicated endpoint, see [Retrieving card sensitive data](../how-to-use/cards/secure-card).
>
> Your first virtual card is now active. When the cardholder spends, DCS forwards the authorization request **to your `auth_url`** and you return Approve or Decline in real time. This is the heart of the Partner-Managed model, see [Authorization (forwarded decisions)](../how-to-use/transactions/authorization).

## Next steps

* The full card issuing flow and KYC details → [Card issuing](../how-to-use/cards/card-issuing)
* Freeze, unfreeze, replace a card, reset the PIN → [Card management](../how-to-use/cards/card-management)
* Understand how money moves → [Fund model](../basic-concepts/fund-model)