Virtual Cards
Issue and manage one-time Virtual Cards to pay merchants or suppliers.
Overview
Virtual Cards are a digital B2B payment method that allow businesses to issue one-time Virtual Cards to pay merchants or suppliers. The Virtual Card is issued from a client’s card program with a unique, digitally generated 16-digit card number. Use cases include but are not limited to online travel agencies, accounts payable, corporate travel, meetings and events, media and entertainment, and on-demand delivery.
Citi’s Virtual Cards APIs allow clients to create, manage, retrieve reporting, and receive notifications for authorizations and cleared transactions on their Virtual Card Accounts (VCAs) in JSON format, on a cloud-ready API platform.
What will this help me with?
Cash Optimization — Virtual Cards can be issued at the time of purchase, for a flexible payment option to improve working capital utilization and automate manual tasks, like invoice processing and reconciliation.
Flexibility — Virtual Cards can be generated quickly and easily for one-time or recurring use with flexibility in preferred transaction currencies, making them ideal for international transactions.
Enhanced Security — Virtual Cards can have specific transaction limits, expiration dates and usage restrictions. They come with real-time notifications for authorized and cleared transactions, which significantly reduces the risk of fraud and increases oversight across the entire payment lifecycle.
How it works
Make a request
The client makes a request to Citi’s API for Virtual Card creation, modification, or cancellation.
VCA processes API request
Citi’s Virtual Card Account (VCA) application processes the API request and creates, modifies, or cancels the VCA.
VCA transmits details (optional)
The VCA application transmits payment details and remittance information to the payment beneficiary.
Merchant collects payment
The merchant collects the payment using the VCA provided via email or with straight through processing.
Citi checks account controls
The VCA application intercepts the Virtual Account number and performs checks against the controls that were set at the time of program creation.
Availability
Formats
JSON
Reporting date ranges
- Virtual Cards Authorization Report: Obtain VCA authorized transactions data for the last 36 months (for Mastercard) and the last 180 days (for Visa) with details on billing and transaction currency, merchant and acquirer, and processing and authorization.
- Virtual Cards Clearing Report: Obtain VCA cleared transactions data for the last 36 months (for Mastercard) and the last 180 days (for Visa) with details on billing and transaction currency, and merchant and acquirer, and processing and authorization.
- Virtual Cards Clearing Exception Report: Retrieve cleared transactions that occurred on virtual cards between a specified date range where the clearing amount is greater than the cumulative limit set for the virtual card. This allows clients to review any exceptions where the clearing amount is greater than the cumulative limit and decide how to proceed. The report applies only to virtual cards that have a velocity control set for a continuous period.
- Virtual Cards Notifications: Retrieve authorized and declined transactions notifications from the past 7 days.
Card programs
Below are the card programs the endpoints integrate with (✓ = Available):
Countries
These are the countries where the Virtual Cards APIs are available (✓ = Available).
North America (6)
Latin America (4)
Asia & Pacific (12)
EU & UK (23)
Middle East & Africa (6)
Security requirements
Citi uses access tokens to authenticate and authorize API requests from your application. To receive an access token from Citi you will first send an API request to our OAuth endpoint using your API credentials: client ID and secret key. Please visit the Authentication guide for more details.
VCA Transaction Notifications
Clients onboarding to the VCA Notifications API will provide their public root certificate (and intermediate certificates if available) and will trust Citi’s public certificate for a 2-way SSL mTLS connection. Virtual Card Transaction Notification API supports both Basic Auth and mTLS authentication methods.