Create VCN (Coming soon)

🚧 Coming soon — this endpoint is not yet available in Sandbox or Production. The documentation is published so you can prepare your integration; we'll announce in the changelog when it goes live.

Issues a virtual card (VCN) for a hotel or air booking.

Authentication: in addition to the API key/secret (which identifies the client), this endpoint requires mTLS at the transport layer.

Returns PAN, CVV and expiration synchronously. The CVV is never persisted.

Send hotelBooking when type is HOTEL and flightBooking when it is AIR — never both at once.

Resending with the same Idempotency-Key returns the same VCN; reusing the key with a different payload returns 409.

curl -X POST "https://api-sandbox.contasimples.com/credit-cards/v1/vcns" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: example_string" \
  -H "X-Origin: ACME_TRAVEL" \
  -H "Authorization: Bearer YOUR_API_TOKEN" \
  -d '{
  "type": "HOTEL",
  "amount": {
    "rate": 1200,
    "taxes": 280,
    "currency": "BRL"
  },
  "hotelBooking": {
    "checkIn": "2026-06-01",
    "checkOut": "2026-06-05",
    "guests": 1,
    "rooms": 1,
    "hotelName": "Ibis Styles Palmas",
    "confirmationId": "000001"
  },
  "customFields": [
    {
      "key": "CENTRO DE CUSTO",
      "value": "Engenharia"
    }
  ],
  "bookingId": "ACME-RES-998877"
}'

import requests
import json

url = "https://api-sandbox.contasimples.com/credit-cards/v1/vcns"
headers = {
  "Content-Type": "application/json",
  "Idempotency-Key": "example_string",
  "X-Origin": "ACME_TRAVEL",
  "Authorization": "Bearer YOUR_API_TOKEN"
}
data = {
  "type": "HOTEL",
  "amount": {
    "rate": 1200,
    "taxes": 280,
    "currency": "BRL"
  },
  "hotelBooking": {
    "checkIn": "2026-06-01",
    "checkOut": "2026-06-05",
    "guests": 1,
    "rooms": 1,
    "hotelName": "Ibis Styles Palmas",
    "confirmationId": "000001"
  },
  "customFields": [
    {
      "key": "CENTRO DE CUSTO",
      "value": "Engenharia"
    }
  ],
  "bookingId": "ACME-RES-998877"
}

response = requests.post(url, headers=headers, json=data)
print(response.json())

const response = await fetch("https://api-sandbox.contasimples.com/credit-cards/v1/vcns", {
  method: "POST",
  headers: {
  "Content-Type": "application/json",
  "Idempotency-Key": "example_string",
  "X-Origin": "ACME_TRAVEL",
  "Authorization": "Bearer YOUR_API_TOKEN"
},
  body: JSON.stringify({
  "type": "HOTEL",
  "amount": {
    "rate": 1200,
    "taxes": 280,
    "currency": "BRL"
  },
  "hotelBooking": {
    "checkIn": "2026-06-01",
    "checkOut": "2026-06-05",
    "guests": 1,
    "rooms": 1,
    "hotelName": "Ibis Styles Palmas",
    "confirmationId": "000001"
  },
  "customFields": [
    {
      "key": "CENTRO DE CUSTO",
      "value": "Engenharia"
    }
  ],
  "bookingId": "ACME-RES-998877"
})
});

const data = await response.json();
console.log(data);

package main

import (
    "fmt"
    "net/http"
    "bytes"
    "encoding/json"
)

func main() {
    data := []byte(`{
  "type": "HOTEL",
  "amount": {
    "rate": 1200,
    "taxes": 280,
    "currency": "BRL"
  },
  "hotelBooking": {
    "checkIn": "2026-06-01",
    "checkOut": "2026-06-05",
    "guests": 1,
    "rooms": 1,
    "hotelName": "Ibis Styles Palmas",
    "confirmationId": "000001"
  },
  "customFields": [
    {
      "key": "CENTRO DE CUSTO",
      "value": "Engenharia"
    }
  ],
  "bookingId": "ACME-RES-998877"
}`)

    req, err := http.NewRequest("POST", "https://api-sandbox.contasimples.com/credit-cards/v1/vcns", bytes.NewBuffer(data))
    if err != nil {
        panic(err)
    }

    req.Header.Set("Content-Type", "application/json")
    req.Header.Set("Idempotency-Key", "example_string")
    req.Header.Set("X-Origin", "ACME_TRAVEL")
    req.Header.Set("Authorization", "Bearer YOUR_API_TOKEN")

    client := &http.Client{}
    resp, err := client.Do(req)
    if err != nil {
        panic(err)
    }
    defer resp.Body.Close()

    fmt.Println("Response Status:", resp.Status)
}

require 'net/http'
require 'json'

uri = URI('https://api-sandbox.contasimples.com/credit-cards/v1/vcns')
http = Net::HTTP.new(uri.host, uri.port)
http.use_ssl = true

request = Net::HTTP::Post.new(uri)
request['Content-Type'] = 'application/json'
request['Idempotency-Key'] = 'example_string'
request['X-Origin'] = 'ACME_TRAVEL'
request['Authorization'] = 'Bearer YOUR_API_TOKEN'
request.body = '{
  "type": "HOTEL",
  "amount": {
    "rate": 1200,
    "taxes": 280,
    "currency": "BRL"
  },
  "hotelBooking": {
    "checkIn": "2026-06-01",
    "checkOut": "2026-06-05",
    "guests": 1,
    "rooms": 1,
    "hotelName": "Ibis Styles Palmas",
    "confirmationId": "000001"
  },
  "customFields": [
    {
      "key": "CENTRO DE CUSTO",
      "value": "Engenharia"
    }
  ],
  "bookingId": "ACME-RES-998877"
}'

response = http.request(request)
puts response.body

{
  "vcnId": "21624502",
  "bookingId": "ACME-AIR-554433",
  "type": "AIR",
  "card": {
    "pan": "4656350026056026",
    "cvv": "411",
    "expirationDate": "06/31",
    "holderName": "EXAMPLE COMPANY LTD"
  },
  "controls": {
    "spendLimit": {
      "value": 101,
      "currency": "BRL"
    },
    "maxTransactions": 2,
    "validity": {
      "start": "2026-06-09",
      "end": "2026-06-10"
    },
    "merchantCategory": "AIR"
  },
  "status": "ACTIVE",
  "createdAt": "2026-06-09T15:55:10Z"
}

{
  "error": "Bad Request",
  "message": "One or more request parameters are invalid.",
  "code": 400,
  "requestId": "123e4567-e89b-12d3-a456-426614174000",
  "details": [
    "The example field must have a value between 5 and 100.",
    "Dates must be in YYYY-MM-DD format."
  ]
}