Ramp Fund-Backed Virtual Card Workflow

Overview

Create the spend authority first, then issue or expose the card through the supported delivery surface. Prefer Ramp's embedded iframe when a person needs to see card details; use the Vault API only for an approved server-side payment flow.

Prerequisites

• Identify the Ramp application, environment, business entities, affected data and workflows, accountable owner, and rollback boundary.
• Read references/official-docs.md and re-check endpoint schemas, scopes, limits, and support status before a live operation.
• Use synthetic fixtures or Ramp sandbox until production access and business effects are explicitly approved.
• Prepare approved secret storage and a sanitized evidence location.

Current Contract

• Current virtual cards are backed by Funds and governed by spend controls; legacy Cards management endpoints are being deprecated.
• Embedded Cards sends card details directly from a Ramp-hosted iframe to the user's browser, keeping the application server out of the card-data plane.
• The Vault API returns PAN, CVV, and expiration to a backend and requires Ramp production approval plus materially stronger PCI controls.
• New embedded integrations use the business-specific iframe URL and an exactly matching, verified HTTPS parent origin.