# OpenCard

> Build on OpenCard. Real-time card data, digital receipts, zero bullshit.

- [OpenCard Developers](https://developers.opencard.io/introduction/index.md): OpenCard developer hub — real-time card transactions, digital receipts, VAT, and webhooks for Expense Management Systems, card issuers, and receipt providers.
- [About OpenCard](https://developers.opencard.io/introduction/welcome.md): What OpenCard is, who uses it — EMS, card issuers, receipt providers — and what transaction, receipt, VAT, and environmental data lands in your webhooks.
- [How OpenCard works](https://developers.opencard.io/introduction/how-it-works.md): The OpenCard hierarchy — account, billing, organization, card holder, transaction, TPA — and how events flow from card issuer to your EMS webhook endpoint.
- [Environments](https://developers.opencard.io/introduction/environments.md): Compare OpenCard sandbox and production environments — API base URLs, OAuth token endpoints, signing pages, and registration links for each isolated universe.
- [Glossary](https://developers.opencard.io/introduction/glossary.md): OpenCard glossary — EMS, account, organization, billing, card holder, identity, TPA, PDPC, transaction state, card issuer, receipt provider, webhook defined.
- [Register & Setup](https://developers.opencard.io/getting-started/register.md): Register a sandbox account on OpenCard, verify your email, find your accountId, and create your first account_client OAuth client to start integrating.
- [Authentication](https://developers.opencard.io/getting-started/authentication.md): Set up OAuth2 account_client machine-to-machine credentials for your EMS integration, request bearer tokens, and pick the right scopes for OpenCard endpoints.
- [Quickstart — Zero to First Webhook](https://developers.opencard.io/getting-started/quickstart.md): End-to-end OpenCard EMS quickstart — register a sandbox account, sign a TPA, create an organization, onboard a card holder, and receive your first webhook.
- [Billing](https://developers.opencard.io/ems/model/billing.md): The OpenCard Billing model — invoice recipient for your EMS account, and how organizations with the same billing_id roll up as one line on that invoice.
- [Organization](https://developers.opencard.io/ems/model/organization.md): The OpenCard Organization model — your end-client company, the container that groups card holders, webhooks, TPA linkage, and billing for EMS partners.
- [TPA](https://developers.opencard.io/ems/model/tpa.md): The TPA model — Transaction Processing Authorization, the company-level legal agreement that allows card data to flow to your EMS via OpenCard.
- [Card holder](https://developers.opencard.io/ems/model/card-holder.md): The OpenCard Card holder model — an individual in an organization, linking cards to identities and driving transaction and receipt webhooks to your EMS.
- [Current Card Issuer Integration](https://developers.opencard.io/ems/current-card-issuer-integration.md): Integrate OpenCard when a client already has another card issuer feed — retroactive replay and deduplicating cleared transaction events.
- [Error Handling](https://developers.opencard.io/ems/error-handling.md): Reference for OpenCard HTTP status codes, validation errors, webhook delivery retries, and common integration gotchas when building on the EMS API.
- [Overview](https://developers.opencard.io/ems/customer-onboarding.md): Full EMS customer onboarding — billing, TPA, organization, webhook, and card holders — the complete flow from client signup to live transactions.
- [Card issuer setup](https://developers.opencard.io/ems/card-issuers-setup.md): One-time setup — discover card programs on OpenCard, enable them on your account, and expose them in your client marketplace before TPA onboarding.
- [TPA Flow — Full Walkthrough](https://developers.opencard.io/ems/tpa-flow.md): Complete TPA walkthrough — create the authorization, add signatories, send signing emails, and finish eID signing across Sweden, Norway, Denmark, and Finland.
- [eID Signing — 4 Countries](https://developers.opencard.io/ems/eid-signing.md): How OpenCard handles TPA and PDPC eID signing — sign and auth modes using national eID across Sweden, Norway, Denmark, and Finland.
- [Card Holder Onboarding](https://developers.opencard.io/ems/card-holders.md): Onboard card holders to your EMS via two paths — email plus eID PDPC signing, or instant creation with identity_id for people already known to OpenCard.
- [Webhook Setup](https://developers.opencard.io/ems/webhooks/setup.md): Create an OpenCard webhook, complete the verification challenge, configure authentication headers, and route events per organization for your EMS integration.
- [Webhook Event Reference](https://developers.opencard.io/ems/webhooks/events.md): Full catalog of OpenCard webhook events for TPA, card holder, transaction, receipt, and environmental impact — with X-Event headers and JSON payload samples.
- [Handling Transaction States](https://developers.opencard.io/ems/webhooks/transactions.md): Handle OpenCard transaction state webhooks — what authorized, cleared, deleted, and invoiced mean, when amounts settle, and how to post them to a ledger.
- [Digital Receipts](https://developers.opencard.io/ems/receipts.md): How OpenCard matches card transactions against merchant digital receipt networks and which webhooks deliver receipt, VAT, and line item data to your EMS.
- [Receipt Scanner (OCR)](https://developers.opencard.io/ems/receipt-scanner.md): Use the OpenCard OCR receipt scanner API to upload photo receipts and get back structured merchant, amount, date, line item, and CO₂ data synchronously.
- [Environmental Impact](https://developers.opencard.io/ems/environmental-impact.md): Subscribe to OpenCard environmental impact webhooks for per-transaction CO₂ emissions and carbon social cost data delivered alongside card transaction events.
- [Embed Plugins](https://developers.opencard.io/ems/plugins.md): Embed the ocTPA and ocPDPC JavaScript widgets on your site to run self-service TPA onboarding wizards and cardholder PDPC consent flows for OpenCard.
- [EMS Authentication](https://developers.opencard.io/api-reference/ems/authentication.md): Authenticate to the OpenCard EMS API with OAuth2 account_client credentials, request a bearer token, and scope it for the endpoints you call.
- [Get access token](https://developers.opencard.io/api-reference/ems/oauth/oauth/get-access-token.md)
- [EMS API Overview](https://developers.opencard.io/api-reference/ems/overview.md): Reference for the api.opencard.io EMS API — manage TPAs, organizations, card holders, OAuth clients, and webhooks for Expense Management Systems.
- [Get your account](https://developers.opencard.io/api-reference/ems/account/get-your-account.md)
- [Update your account](https://developers.opencard.io/api-reference/ems/account/update-your-account.md)
- [List OAuth clients](https://developers.opencard.io/api-reference/ems/oauth-clients/list-oauth-clients.md)
- [Create OAuth client](https://developers.opencard.io/api-reference/ems/oauth-clients/create-oauth-client.md)
- [Lookup company + signing combinations](https://developers.opencard.io/api-reference/ems/public-records/lookup-company-+-signing-combinations.md)
- [List TPAs](https://developers.opencard.io/api-reference/ems/tpas/list-tpas.md)
- [Create TPA](https://developers.opencard.io/api-reference/ems/tpas/create-tpa.md): Creates TPA, fetches registry data, generates legal text.
- [Get TPA](https://developers.opencard.io/api-reference/ems/tpas/get-tpa.md)
- [Delete TPA](https://developers.opencard.io/api-reference/ems/tpas/delete-tpa.md)
- [List signatories](https://developers.opencard.io/api-reference/ems/tpa-signatories/list-signatories.md)
- [Add signatory (sends email)](https://developers.opencard.io/api-reference/ems/tpa-signatories/add-signatory-sends-email.md)
- [List identities on TPA](https://developers.opencard.io/api-reference/ems/identities/list-identities-on-tpa.md): Physical persons linked to this TPA. Use `id` as `identity_id` for instant card holder onboarding.
- [Create billing profile](https://developers.opencard.io/api-reference/ems/billings/create-billing-profile.md)
- [List available issuers](https://developers.opencard.io/api-reference/ems/card-issuers/list-available-issuers.md): Platform catalog of card programs you can enable. Pick an `id`, then [enable it on your account](#tag/Card-Issuers/operation/attachCardIssuer). Optional `q` searches `name_system` (space-separated tokens).
- [List enabled issuers](https://developers.opencard.io/api-reference/ems/card-issuers/list-enabled-issuers.md): Card issuers already attached to your account (what clients can pick in onboarding). Each item includes `pivot` with when it was enabled.
- [Get enabled issuer](https://developers.opencard.io/api-reference/ems/card-issuers/get-enabled-issuer.md)
- [Enable issuer](https://developers.opencard.io/api-reference/ems/card-issuers/enable-issuer.md): Attach a card program from the [available catalog](#tag/Card-Issuers/operation/listCardIssuers) to your account. Empty body. `201` on success; `400` if already attached.
- [Disable issuer](https://developers.opencard.io/api-reference/ems/card-issuers/disable-issuer.md)
- [List organizations](https://developers.opencard.io/api-reference/ems/organizations/list-organizations.md)
- [Create organization](https://developers.opencard.io/api-reference/ems/organizations/create-organization.md)
- [Get organization](https://developers.opencard.io/api-reference/ems/organizations/get-organization.md)
- [List card holders](https://developers.opencard.io/api-reference/ems/card-holders/list-card-holders.md): Paginated list. Each item includes `identity` (`name`, `employee_id`) when linked — no separate identities call needed for display.
- [Create card holder](https://developers.opencard.io/api-reference/ems/card-holders/create-card-holder.md): Path A: `email` → PDPC email + eID. Path B: `identity_id` → instant, transactions flow immediately.
- [Update card holder](https://developers.opencard.io/api-reference/ems/card-holders/update-card-holder.md): `reference_id` is required. `email` is optional — omit to keep the current value (including null for identity-linked holders). Resends PDPC email only when unsigned/no identity, `skip_pdpc_email` is false, and an email address exists. Duplicate `reference_id` within the organization returns 400.
- [Delete card holder](https://developers.opencard.io/api-reference/ems/card-holders/delete-card-holder.md): Fires `card_holder.deleted` webhook.
- [List webhooks](https://developers.opencard.io/api-reference/ems/webhooks/list-webhooks.md)
- [Create webhook](https://developers.opencard.io/api-reference/ems/webhooks/create-webhook.md)
- [Delivery log](https://developers.opencard.io/api-reference/ems/webhooks/delivery-log.md)
- [OCR scan receipt](https://developers.opencard.io/api-reference/ems/receipt-scanner/ocr-scan-receipt.md)
- [Overview](https://developers.opencard.io/card-issuers/index.md): OpenCard integration paths for card issuers — deliver transactions to connected EMS apps, or fetch digital receipts from the merchant network.
- [How it works](https://developers.opencard.io/card-issuers/issuer-integration/index.md): Connect your card program to OpenCard — push cards and transaction states so connected EMS apps receive real-time spend data and enrichment.
- [Onboarding](https://developers.opencard.io/card-issuers/issuer-integration/onboarding.md): How issuer integration starts — TPA signing by the customer, receiving the signed agreement, and when to register cards and send transactions.
- [Authentication](https://developers.opencard.io/card-issuers/issuer-integration/authentication.md): OAuth 2.0 client credentials for the OpenCard Issuer API — obtain a bearer token and call endpoints under /api/v1/issuers/{slug}/.
- [Cards](https://developers.opencard.io/card-issuers/issuer-integration/cards.md): Register and maintain cards on the OpenCard Issuer API — create, update, list, get, and delete cards under /api/v1/issuers/{slug}/cards.
- [Transaction states](https://developers.opencard.io/card-issuers/issuer-integration/transaction-states.md): Push card transaction lifecycle events to OpenCard — authorized, cleared, invoiced, and deleted states via the Issuer API.
- [TPA delivery](https://developers.opencard.io/card-issuers/issuer-integration/tpa-integration.md): How OpenCard delivers signed (and terminated) TPAs to you as the card issuer — by email or by POST to your callback endpoint.
- [Overview](https://developers.opencard.io/card-issuers/digital-receipts/index.md): Digital receipts for card issuers — match merchant receipts to card transactions via a separate API on receipts.opencard.io.
- [Integration](https://developers.opencard.io/card-issuers/digital-receipts/integration.md): Step-by-step guide for card issuers to discover merchant publishers, submit transactions via CAID, and receive matched digital receipts on a callback URL.
- [Issuer API Overview](https://developers.opencard.io/api-reference/issuers/overview.md): Reference for the OpenCard Issuer API — register cards and push transaction states under /api/v1/issuers/{slug}/ on api.opencard.io.
- [List cards](https://developers.opencard.io/api-reference/issuers/cards/list-cards.md)
- [Create card](https://developers.opencard.io/api-reference/issuers/cards/create-card.md)
- [Get card](https://developers.opencard.io/api-reference/issuers/cards/get-card.md)
- [Update card](https://developers.opencard.io/api-reference/issuers/cards/update-card.md)
- [Delete card](https://developers.opencard.io/api-reference/issuers/cards/delete-card.md)
- [Create transaction state](https://developers.opencard.io/api-reference/issuers/transaction-states/create-transaction-state.md)
- [Digital Receipts API Overview](https://developers.opencard.io/api-reference/receipts/overview.md): Reference for receipts.opencard.io — card issuers discover publishers and submit card transactions for digital receipt matching across OpenCard merchants.
- [List active merchants](https://developers.opencard.io/api-reference/receipts/publishers/list-active-merchants.md)
- [List callback requests](https://developers.opencard.io/api-reference/receipts/callback-requests/list-callback-requests.md)
- [Create callback request](https://developers.opencard.io/api-reference/receipts/callback-requests/create-callback-request.md): Submit transaction for receipt matching. OpenCard calls your callback_url when matched.
- [Get callback request](https://developers.opencard.io/api-reference/receipts/callback-requests/get-callback-request.md)
- [Update (e.g. clearing status)](https://developers.opencard.io/api-reference/receipts/callback-requests/update-eg-clearing-status.md)
- [Delete callback request](https://developers.opencard.io/api-reference/receipts/callback-requests/delete-callback-request.md)
- [Receipt Provider Integration](https://developers.opencard.io/receipt-providers/index.md): Integration guide for receipt providers — collect receipts from merchants and POS, deliver to OpenCard, and enrich EMS transactions with VAT and line items.
- [How receipt providers work with OpenCard](https://developers.opencard.io/receipt-providers/how-it-works.md): How receipt providers fit into OpenCard — collect receipts from merchants, handle match requests, deliver receipt callbacks, and enrich EMS transaction data.
- [Callback Delivery](https://developers.opencard.io/receipt-providers/callback-delivery.md): How receipt providers POST matched receipts to OpenCard — endpoint URL, X-Event headers, HMAC-SHA256 signatures, and payload structure for callback delivery.
- [Payload Formats](https://developers.opencard.io/receipt-providers/payload-formats.md): Payload formats for receipt provider callbacks to OpenCard — required headers, HMAC signatures, and XML receipt body for resolved and deleted callback events.
- [Receipt Provider Callback API](https://developers.opencard.io/api-reference/receipt-providers/overview.md): Reference for the inbound receipt provider callback API — POST matched receipt payloads to OpenCard with HMAC-SHA256 signatures on api.opencard.io.
- [Deliver receipt enrichment](https://developers.opencard.io/api-reference/receipt-providers/callback/deliver-receipt-enrichment.md): HMAC-SHA256 via X-Data-Signature header.

## OpenAPI Specs

- [ems-api](/openapi/ems-api.json)
- [issuer-api](/openapi/issuer-api.json)
- [oauth](/openapi/oauth.json)
- [receipt-provider-callback](/openapi/receipt-provider-callback.json)
- [receipts-api](/openapi/receipts-api.json)