# Create Card - Using DPAN or MPAN

## **Overview**

The CMP Create Card API supports storing digital wallet cards, including Apple Pay Device PANs (DPANs) and Merchant PANs (MPANs), alongside traditional physical cards (PANs).

Cards classified as `dpan` or `mpan` from Apple Pay do not trigger downstream services such as Account Updater, Network Token provisioning, even if the account is configured for [onCreate enrollment type](https://docs.verygoodsecurity.com/cmp/platform/cmp-account#on-create-enrollment). Cards stored in this way behave similarly to traditional cards but are tagged with Apple Pay metadata.

To store an decrypted Apple Pay DPAN or MPAN, include the wallet token in the `pan` field of the Create Card request. Additionally, specify the following in the card object:

* `wallet_type`: apple\_pay
* `token_type`: dpan / mpan

It’s important that merchants pass these values in **lowercase only**, as incorrect formatting will cause validation errors.

**Note:** 

* Apple Pay wallet tokens are only retrievable through `GET /cards/{id}`. They are clearly marked as DPAN or MPAN and are **not included in notifications**.
* Apple Pay DPAN/MPAN cards **do not trigger downstream services** such as Account Updater, Network Token provisioning or 3DS.
* This applies even if the account is configured for `onCreate` enrollment.
* Tokenized wallet cards are retrievable via  [`GET /cards/{id}`](https://docs.verygoodsecurity.com/cmp/developer-resources/api/cards#get-cards-card_id) .

#### Validation Rules when Creating a Card with DPAN/MPAN

* If creating a DPAN or MPAN from Apple Pay, the `wallet_type` field **must** be included. Omitting it will return a **422 Unprocessable Entity** error.
* For physical PANs, `wallet_type` and `token_type` are optional, but `token_type` is always returned in the response as `pan`.
* Both `wallet_type` and `token_type` must be lowercase. For example: `"Apple Pay"` or `"apple_Pay"` will fail validation. Similarly, `"DPAN"` or `"MPAN"` in uppercase will also fail, returning **400 Bad Request**.

You can see a sample request and response for Apple Pay cards here: **VGS Card Management API –** [**Create a Card**](https://docs.verygoodsecurity.com/cmp/api-dev/cards#post-cards).

#### Retrieve Card (GET /cards/{id})

When retrieving an Apple Pay card, the response includes `wallet_type` and `token_type` in the card object. These values match the ones sent during creation (`wallet_type: apple_pay`, `token_type: dpan/mpan`) and clearly indicate that the card is an Apple Pay DPAN or MPAN.

Sample response: **VGS Card Management API –** [**Get a Card**](https://docs.verygoodsecurity.com/cmp/api-dev/cards#get-cards-card_id).

#### Onboarding Requirements

No extra steps are needed. Customers already using CMP for card creation can immediately store Apple Pay cards without additional setup.