Appearance
Issue a card
POST
/programs/{id}/cards
The primary write. Set external_ref to YOUR id for the person — it comes back on every read and in every webhook, and it is the field to join on.
Authorizations
ApiKeyBearer
A shop-scoped API key created in the dashboard and shown exactly once. An MCP tmk_ key presented here returns a 401 that names the mistake.
Type
HTTP (bearer)
Parameters
Header Parameters
Idempotency-Key
Makes a retry safe: a repeat with the same key and body replays the stored response; the same key with a different body is a 409. Keys are remembered for 24h (IDEMPOTENCY_DEDUPE_WINDOW_HOURS). A request without the header is processed normally.
Type
string
Max Length
255Path Parameters
id*
An opaque id. The API never promises an id format.
Type
Requiredstring
Request Body
application/json
JSON "holder_name": "Ada Lovelace", "holder_email": "ada@docsfixture.invalid", "external_ref": "EMP-00417", "expires_at": "2026-10-04T10:15:00.000Z", "send_email": false
{
}
Responses
Issue a card
application/json
JSON "id": "cin_docsfixture0001", "program_id": "prg_docsfixture0001", "external_ref": "EMP-00417", "holder_name": "Ada Lovelace", "holder_email": "ada@docsfixture.invalid", "expires_at": "2026-10-04T10:15:00.000Z", "install_url": "https://tesserapp.eu/install#p=prg_docsfixture0001&t=itk_docsfixture0001", "install_url_expires_at": "2026-10-04T10:15:00.000Z", "install_qr_svg": "<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 25 25" shape-rendering="crispEdges">…</svg>"
{
}
POST
/programs/{id}/cards