Quickstart - Reap Business Account API

There is no sandbox. Every call you make is production. Use a low spend cap on test cards and terminate them when you’re done.

The steps below are a worked example of the flow described in Get access and API keys: a new key goes to a first card in a few calls: check the key, find a cardholder, create a card, reveal it, then clean up.

Get access

Business Account API access is granted per business. See Get access and API keys for who can request it and how.

Create a key

In the Business Account dashboard, a team administrator creates an API key with the team_members:read, cards:read, cards:write and cards:read_vault scopes, and adds your server’s IP to the key’s allowlist. The secret is shown once, so store it in a secrets manager.

export REAP_API="https://api.global.direct.reap.global/2026-07-13"
export REAP_KEY="your-api-key"

Check the key

curl "$REAP_API/health" -H "x-api-key: $REAP_KEY"

A 200 means the key works. A 401 means it’s missing or invalid; a 403 with API_KEY_IP_NOT_ALLOWED means your server’s IP isn’t on the key’s allowlist.

Find a cardholder

Cards belong to team members. List them and pick one with inviteStatus: "approved":

curl "$REAP_API/team-members" -H "x-api-key: $REAP_KEY"

{
  "items": [
    {
      "userId": "user_01JZ2Q1J4Y8P7M6N5K3H2G1F0E",
      "name": "Ada Lovelace",
      "email": "ada@example.com",
      "teamGroupName": "Marketing",
      "inviteStatus": "approved"
    }
  ],
  "meta": { "totalItems": 1, "itemCount": 1, "itemsPerPage": 20, "totalPages": 1, "currentPage": 1 }
}

Keep the userId; it’s the cardholderId on the next call.

Create a test card

Create a virtual card with a small top-up budget. Send an Idempotency-Key so a retry can never create a second card.

curl -X POST "$REAP_API/cards" \
  -H "x-api-key: $REAP_KEY" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: quickstart-first-card" \
  -d '{
    "type": "virtual",
    "title": "Quickstart test card",
    "cardholderId": "user_01JZ2Q1J4Y8P7M6N5K3H2G1F0E",
    "category": "software",
    "planType": "topUp",
    "spendCap": { "amount": "10.00", "currency": "USD" }
  }'

There are three outcomes:

201 with status: "active": the card is ready. Store its id.
201 with status: "pending": created, still being set up. Poll the Location response header until it’s active.
202 with status: "pendingApproval": your business uses Approvals; an approver accepts the request in the dashboard first. See Approvals.

Show the card details

Card numbers never pass through your servers. Request a short-lived link to a Reap-hosted view instead:

curl -X POST "$REAP_API/cards/{cardId}/reveal" -H "x-api-key: $REAP_KEY"

{ "accessUrl": "https://secure.card.reap.global/api/card/show-card-info?auth=..." }

The accessUrl is valid for 1 minute. Open it to see the card number, expiry and CVV. See Card details for the rules.

Clean up

Terminate the test card:

curl -X DELETE "$REAP_API/cards/{cardId}" -H "x-api-key: $REAP_KEY"

Next steps

Use cases

End-to-end flows for team cards, advertising and Treasury funding.

Concepts

Statuses, funding plans, approvals and balances explained.

Errors

The error envelope, every error code and retry guidance.

​Next steps

Use cases

Concepts

Errors

Next steps