# Create a card

`POST https://evohub.io/api/v1/board/lists/{listID}/cards`

Part of the [Board API](https://docs.evohub.io/board.md) reference · operationId `createCard`.

Adds a card to the list. `title` is required (at most 200
characters); `description` may be up to 20,000 characters. Without
`placement` the card goes to the bottom. The card gets the next
`number` on its board, which with the board's prefix is its reference
(`PLT-119`). `list_id` in the body is ignored: the list is the one in
the path.

Requires the `board:card:write` scope.

## Authorization

Any one of:

- `bearerKey`
- `headerKey`

Where:

- `bearerKey`: HTTP Bearer — An EvoHub API key (`evohub_…`) as a bearer token.
- `headerKey`: API key in the header `X-API-Key` — An EvoHub API key (`evohub_…`).

## Path parameters

- `listID` (string, required, example `lst_2b3c4d5e6f7a48b9c0d1e2f3a4b5c6d7`): The list's ID.

## Request body (required)

Content type: `application/json`

Type: `object`

- `title` (string, required, max length 200)
- `description` (string, max length 20000)
- `list_id` (string): Ignored.
- `placement` (Placement)
  - `after` (string): The ID of the item it should follow. Empty means the top.
  - `before` (string): The ID of the item it should precede. Empty means the bottom.
  - `to` (string, one of `top`, `bottom`): An end of the list. Any other value is ignored.

## Responses

### 201 — The card was created.

Content type: `application/json`

Type: `CardEnvelope`

- `data` (object)
  - `card` (Card)
    - `id` (string, example `crd_9f2e4d6c8b0a1e3f5d7c9b1a3e5f7d90`)
    - `board_id` (string)
    - `list_id` (string)
    - `number` (integer): The card's number on its board, from 1. With the board's `card_prefix` it is the card's reference.
    - `title` (string, max length 200)
    - `description` (string, max length 20000)
    - `color` (string): A hex colour, or `""` for none.
    - `due_at` (string (date-time)): Absent when the card has no due date.
    - `review` (Review)
      - `state` (string, one of `pending`, `approved`)
      - `approved_by` (string)
      - `approved_at` (string (date-time))
    - `completed_at` (string (date-time)): When the card entered a done list. Absent while it is not in one.
    - `created_by` (string)
    - `created_at` (string (date-time))
    - `updated_at` (string (date-time))
    - `version` (integer): Goes up by one on every edit of the title or description.
    - `assignee_ids` (array of string | null): Who the card is on. Filled in when a board or list is read; `null` when one card is read on its own.
    - `label_ids` (array of string | null): The labels the card carries. Filled in when a board or list is read; `null` when one card is read on its own.

### 400 — The body is not JSON for this endpoint, or carries a field it does not know (`INVALID_BODY`), or a field breaks a rule (`VALIDATION_ERROR`; the message says which).

Content type: `application/json`

Type: `Error`

- `error` (object, required)
  - `code` (string, required, example `NOT_FOUND`)
  - `message` (string, required, example `not found`)
  - `request_id` (string)

### 401 — No API key was sent, or it is unknown, revoked or expired (`UNAUTHORIZED`).

Content type: `application/json`

Type: `Error`

- `error` (object, required)
  - `code` (string, required, example `NOT_FOUND`)
  - `message` (string, required, example `not found`)
  - `request_id` (string)

### 403 — The key lacks the scope this endpoint needs (`FORBIDDEN`).

Content type: `application/json`

Type: `Error`

- `error` (object, required)
  - `code` (string, required, example `NOT_FOUND`)
  - `message` (string, required, example `not found`)
  - `request_id` (string)

### 404 — It does not exist, or it is on a board the caller cannot see (`NOT_FOUND`).

Content type: `application/json`

Type: `Error`

- `error` (object, required)
  - `code` (string, required, example `NOT_FOUND`)
  - `message` (string, required, example `not found`)
  - `request_id` (string)

### 409 — The neighbours named in `placement` are no longer next to each other (`STALE_PLACEMENT`). Read the board again and retry.

Content type: `application/json`

Type: `Error`

- `error` (object, required)
  - `code` (string, required, example `NOT_FOUND`)
  - `message` (string, required, example `not found`)
  - `request_id` (string)

### 429 — Too many requests (`RATE_LIMITED`). Wait for `Retry-After` seconds.

Headers:

- `Retry-After` (integer): Seconds to wait before retrying.

Content type: `application/json`

Type: `Error`

- `error` (object, required)
  - `code` (string, required, example `NOT_FOUND`)
  - `message` (string, required, example `not found`)
  - `request_id` (string)

### 500 — Something went wrong on EvoHub's side (`INTERNAL_ERROR`). Retry later.

Content type: `application/json`

Type: `Error`

- `error` (object, required)
  - `code` (string, required, example `NOT_FOUND`)
  - `message` (string, required, example `not found`)
  - `request_id` (string)

## Example request

```bash
curl -X POST 'https://evohub.io/api/v1/board/lists/lst_2b3c4d5e6f7a48b9c0d1e2f3a4b5c6d7/cards' \
  -H 'Content-Type: application/json' \
  -H 'Authorization: Bearer <TOKEN>' \
  -d '{
  "title": "Renew the TLS certificate for the API",
  "placement": {
    "to": "top"
  },
  "description": "Expires on 2026-12-05."
}'
```