> ## Documentation Index
> Fetch the complete documentation index at: https://docs.qonto.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Cards

> List, create, update, and transition Qonto cards

The card tools cover the full lifecycle of debit, credit, virtual, flash, and advertising cards, plus the iframe URL used to render the full PAN, expiry, and CVV in your client.

| Tool                  | What it does                                                                                                                                                                                                                | Upstream                                                                                                                                                                                                                                                                                                                                            |
| --------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `list_cards`          | List the organization's cards (debit, credit, virtual, flash, advertising), paginated. Returns id, last digits, status, nickname, holder, card level, and bank account id.                                                  | [List cards](/api-reference/business-api/cards/list-cards)                                                                                                                                                                                                                                                                                          |
| `create_card`         | Create one card. `card_level` selects the variant (`standard` / `plus` / `metal` / `virtual` / `virtual_partner` / `flash` / `advertising`) and the required-field set. Physical cards trigger SCA.                         | [Create a card](/api-reference/business-api/cards/create-a-card)                                                                                                                                                                                                                                                                                    |
| `update_card`         | Update one of two properties on a card: `nickname` (a string) or `options` (the four flags `atm_option`, `nfc_option`, `online_option`, `foreign_option`, all required together). Physical cards reject NFC option changes. | [Update a card's nickname](/api-reference/business-api/cards/update-a-cards-nickname) / [options](/api-reference/business-api/cards/update-a-cards-options)                                                                                                                                                                                         |
| `change_card_status`  | Composite lifecycle transition. Set exactly one of `lock` (reversible), `unlock` (owners and admins only), `lost`, `stolen`, `discard` (all irreversible).                                                                  | [Lock](/api-reference/business-api/cards/lock-a-card), [Unlock](/api-reference/business-api/cards/unlock-a-card), [Report lost](/api-reference/business-api/cards/report-a-physical-card-as-lost), [Report stolen](/api-reference/business-api/cards/report-a-physical-card-as-stolen), [Discard](/api-reference/business-api/cards/discard-a-card) |
| `get_card_iframe_url` | Returns a short-lived URL that renders the card's PAN, expiry, and CVV inside an iframe. The URL is a credential; treat it like a password.                                                                                 | [Retrieve a card iframe URL](/api-reference/business-api/cards/retrieve-a-card-iframe-url)                                                                                                                                                                                                                                                          |

<Note>
  Creating a card or changing its lifecycle can trigger Strong Customer Authentication in the Qonto mobile app. Your assistant will tell you when to approve.
</Note>

**Try it**

> Lock the card nicknamed "Ads".
>
> Create a virtual card called "Subscriptions" with a €200 monthly limit, restricted to online payments.
>
> Show me the PAN of card ending 4242 so I can paste it into a form.

## Related

* Card **requests** (employees asking for a card their manager approves) live under [Requests](/mcp/tools/requests).