Update a spending card
Update a Moov issued card.
To access this endpoint using an access token
you'll need to specify the /accounts/{accountID}/issued-cards.write scope.
PATCH
/issuing/{accountID}/cards/{issuedCardID}
curl -X PATCH "https://api.moov.io/issuing/{accountID}/cards/{issuedCardID}" \
-H "Authorization: Bearer {token}" \
-H "X-Moov-Version: v2026.07.00"mc, _ := moov.NewClient()
var accountID string
var issuedCardID string
closed := moov.UpdateIssuedCardState_Closed
mc.UpdateIssuedCard(ctx, accountID, issuedCardID, moov.UpdateIssuedCard{
State: &closed,
})
import { Moov } from "@moovio/sdk";
const moov = new Moov({
security: {
username: "",
password: "",
},
});
async function run() {
const result = await moov.cardIssuing.update({
accountID: "44db31bc-2813-424b-9b8c-2d3f5f1300e3",
issuedCardID: "69ca2a7e-7bbc-4176-9d0c-2a1aa7143006",
updateIssuedCard: {
metadata: {
"optional": "metadata",
},
billingAddress: {
addressLine1: "123 Main Street",
addressLine2: "Apt 302",
city: "Boulder",
stateOrProvince: "CO",
postalCode: "80301",
country: "US",
},
controls: {
velocityLimits: [
{
amount: 10000,
interval: "daily",
},
],
},
},
});
console.log(result);
}
run();declare(strict_types=1);
require 'vendor/autoload.php';
use Moov\MoovPhp;
use Moov\MoovPhp\Models\Components;
$sdk = MoovPhp\Moov::builder()
->setSecurity(
new Components\Security(
username: '',
password: '',
)
)
->build();
$updateIssuedCard = new Components\UpdateIssuedCard(
metadata: [
'optional' => 'metadata',
],
billingAddress: new Components\BillingAddress(
addressLine1: '123 Main Street',
addressLine2: 'Apt 302',
city: 'Boulder',
stateOrProvince: 'CO',
postalCode: '80301',
country: 'US',
),
controls: new Components\UpdateIssuingControls(
velocityLimits: [
new Components\IssuingVelocityLimit(
amount: 10000,
interval: Components\IssuingIntervalLimit::Daily,
),
],
),
);
$response = $sdk->cardIssuing->update(
accountID: '44db31bc-2813-424b-9b8c-2d3f5f1300e3',
issuedCardID: '69ca2a7e-7bbc-4176-9d0c-2a1aa7143006',
updateIssuedCard: $updateIssuedCard
);
if ($response->issuedCard !== null) {
// handle response
}package hello.world;
import io.moov.sdk.Moov;
import io.moov.sdk.models.components.*;
import io.moov.sdk.models.errors.GenericError;
import io.moov.sdk.models.errors.UpdateIssuedCardError;
import io.moov.sdk.models.operations.UpdateIssuedCardResponse;
import java.lang.Exception;
import java.util.List;
import java.util.Map;
public class Application {
public static void main(String[] args) throws GenericError, UpdateIssuedCardError, Exception {
Moov sdk = Moov.builder()
.security(Security.builder()
.username("")
.password("")
.build())
.build();
UpdateIssuedCardResponse res = sdk.cardIssuing().update()
.accountID("44db31bc-2813-424b-9b8c-2d3f5f1300e3")
.issuedCardID("69ca2a7e-7bbc-4176-9d0c-2a1aa7143006")
.updateIssuedCard(UpdateIssuedCard.builder()
.metadata(Map.ofEntries(
Map.entry("optional", "metadata")))
.billingAddress(BillingAddress.builder()
.addressLine1("123 Main Street")
.addressLine2("Apt 302")
.city("Boulder")
.stateOrProvince("CO")
.postalCode("80301")
.country("US")
.build())
.controls(UpdateIssuingControls.builder()
.velocityLimits(List.of(
IssuingVelocityLimit.builder()
.interval(IssuingIntervalLimit.DAILY)
.amount(10000L)
.build()))
.build())
.build())
.call();
if (res.issuedCard().isPresent()) {
System.out.println(res.issuedCard().get());
}
}
}from moovio_sdk import Moov
from moovio_sdk.models import components
with Moov(
security=components.Security(
username="",
password="",
),
) as moov:
res = moov.card_issuing.update(account_id="44db31bc-2813-424b-9b8c-2d3f5f1300e3", issued_card_id="69ca2a7e-7bbc-4176-9d0c-2a1aa7143006", metadata={
"optional": "metadata",
}, billing_address={
"address_line1": "123 Main Street",
"address_line2": "Apt 302",
"city": "Boulder",
"state_or_province": "CO",
"postal_code": "80301",
"country": "US",
}, controls=components.UpdateIssuingControls(
velocity_limits=[
components.IssuingVelocityLimit(
amount=10000,
interval=components.IssuingIntervalLimit.DAILY,
),
],
))
# Handle response
print(res)require 'moov_ruby'
Models = ::Moov::Models
s = ::Moov::Client.new(
security: Models::Components::Security.new(
username: '',
password: ''
)
)
res = s.card_issuing.update(account_id: '44db31bc-2813-424b-9b8c-2d3f5f1300e3', issued_card_id: '69ca2a7e-7bbc-4176-9d0c-2a1aa7143006', update_issued_card: Models::Components::UpdateIssuedCard.new(
metadata: {
'optional' => 'metadata',
},
billing_address: Models::Components::BillingAddress.new(
address_line1: '123 Main Street',
address_line2: 'Apt 302',
city: 'Boulder',
state_or_province: 'CO',
postal_code: '80301',
country: 'US'
),
controls: Models::Components::UpdateIssuingControls.new(
velocity_limits: [
Models::Components::IssuingVelocityLimit.new(
amount: 10_000,
interval: Models::Components::IssuingIntervalLimit::DAILY
),
]
)
))
unless res.issued_card.nil?
# handle response
endusing Moov.Sdk;
using Moov.Sdk.Models.Components;
using System.Collections.Generic;
var sdk = new MoovClient(security: new Security() {
Username = "",
Password = "",
});
var res = await sdk.CardIssuing.UpdateAsync(
accountID: "44db31bc-2813-424b-9b8c-2d3f5f1300e3",
issuedCardID: "69ca2a7e-7bbc-4176-9d0c-2a1aa7143006",
body: new UpdateIssuedCard() {
Metadata = new Dictionary<string, string>() {
{ "optional", "metadata" },
},
BillingAddress = new BillingAddress() {
AddressLine1 = "123 Main Street",
AddressLine2 = "Apt 302",
City = "Boulder",
StateOrProvince = "CO",
PostalCode = "80301",
Country = "US",
},
Controls = new UpdateIssuingControls() {
VelocityLimits = new List<IssuingVelocityLimit>() {
new IssuingVelocityLimit() {
Amount = 10000,
Interval = IssuingIntervalLimit.Daily,
},
},
},
}
);
// handle responseThe request completed successfully.
{
"issuedCardID": "string",
"brand": "Visa",
"lastFourCardNumber": "string",
"expiration": {
"month": "01",
"year": "21"
},
"fundingWalletID": "string",
"authorizedUserAccountID": "string",
"nickname": "string",
"metadata": {
"optional": "metadata"
},
"billingAddress": {
"addressLine1": "123 Main Street",
"addressLine2": "Apt 302",
"city": "Boulder",
"stateOrProvince": "CO",
"postalCode": "80301",
"country": "US"
},
"state": "active",
"formFactor": "virtual",
"controls": {
"singleUse": true,
"velocityLimits": [
{
"amount": 10000,
"count": 0,
"interval": "per-transaction",
"amountUsed": 0,
"amountRemaining": 0,
"countUsed": 0,
"countRemaining": 0,
"resetsOn": "2019-08-24T14:15:22Z"
}
],
"merchantCategoryRestrictions": {
"mode": "allow",
"categories": [
"advertising"
],
"customMCCs": [
"string"
],
"exemptMerchants": [
{
"mid": "string",
"descriptorPattern": "string",
"name": "string"
}
]
},
"merchantRestrictions": {
"mode": "allow",
"merchants": [
{
"mid": "string",
"descriptorPattern": "string",
"name": "string"
}
]
},
"allowedSchedule": {
"timezone": "string",
"windows": [
{
"days": [
"monday"
],
"startTime": "string",
"endTime": "string"
}
]
},
"expiresOn": "2019-08-24T14:15:22Z"
},
"createdOn": "2019-08-24T14:15:22Z",
"updatedOn": "2019-08-24T14:15:22Z"
}Response headers
x-request-id
string
required
A unique identifier used to trace requests.
The server could not understand the request due to invalid syntax.
{
"error": "string"
}Response headers
x-request-id
string
required
A unique identifier used to trace requests.
The request contained missing or expired authentication.
Response headers
x-request-id
string
required
A unique identifier used to trace requests.
The user is not authorized to make the request.
Response headers
x-request-id
string
required
A unique identifier used to trace requests.
The requested resource was not found.
Response headers
x-request-id
string
required
A unique identifier used to trace requests.
The request conflicted with the current state of the target resource.
{
"error": "string"
}Response headers
x-request-id
string
required
A unique identifier used to trace requests.
The request was well-formed, but the contents failed validation. Check the request for missing or invalid fields.
{
"state": "string",
"nickname": "string",
"metadata": "string",
"billingAddress": {
"addressLine1": "string",
"addressLine2": "string",
"city": "string",
"stateOrProvince": "string",
"postalCode": "string",
"country": "string"
},
"controls": {
"velocityLimits": {
"property1": {
"amount": "string",
"count": "string",
"interval": "string"
},
"property2": {
"amount": "string",
"count": "string",
"interval": "string"
}
},
"merchantCategoryRestrictions": {
"mode": "string",
"categories": {
"0": "first element failed validation..."
},
"customMCCs": {
"0": "first element failed validation..."
},
"exemptMerchants": {
"property1": {
"mid": "string",
"descriptorPattern": "string"
},
"property2": {
"mid": "string",
"descriptorPattern": "string"
}
}
},
"merchantRestrictions": {
"mode": "string",
"merchants": {
"property1": {
"mid": "string",
"descriptorPattern": "string"
},
"property2": {
"mid": "string",
"descriptorPattern": "string"
}
}
},
"allowedSchedule": {
"timezone": "string",
"windows": {
"property1": {
"days": "string",
"startTime": "string",
"endTime": "string"
},
"property2": {
"days": "string",
"startTime": "string",
"endTime": "string"
}
}
},
"expiresOn": "string"
}
}Response headers
x-request-id
string
required
A unique identifier used to trace requests.
Request was refused due to rate limiting.
Response headers
x-request-id
string
required
A unique identifier used to trace requests.
The request failed due to an unexpected error.
Response headers
x-request-id
string
required
A unique identifier used to trace requests.
The request failed because a downstream service failed to respond.
Response headers
x-request-id
string
required
A unique identifier used to trace requests.
Headers
X-Moov-Version
string
Set this header to v2026.07.00 to use the API described in this specification. When omitted, the server defaults to v2024.01.00, which may not match the behavior documented here.
Possible values:
v2026.07.00
Path parameters
accountID
string
required
The Moov business account for which the card was issued.
issuedCardID
string
required
Body
application/json
billingAddress
object
| null
Show child attributes
addressLine1
string
<=60 characters
Pattern
addressLine2
string
<=32 characters
Pattern
city
string
<=32 characters
Pattern
country
string
<=2 characters
postalCode
string
<=5 characters
stateOrProvince
string
<=2 characters
controls
object
Mutable spend controls for the card.
Mutable spend controls. Each field replaces the entire corresponding value.
Show child attributes
allowedSchedule
object
| null
Replaces the allowed schedule. Set to
null to remove all schedule restrictions.
Limits card usage to specific days and times.
Show child attributes
timezone
string
IANA timezone string used to evaluate window boundaries against the authorization time.
windows
array<object>
Time windows during which the card may authorize. Any matching window allows the transaction.
Show child attributes
days
array<string>
The days of the week this window applies to.
Possible values:
monday,
tuesday,
wednesday,
thursday,
friday,
saturday,
sunday
endTime
string
Exclusive window end time in 24-hour
HH:MM format. If earlier than startTime, the window wraps past midnight.
startTime
string
Inclusive window start time in 24-hour
HH:MM format.
expiresOn
string<date-time>
| null
A spend cutoff date and time. Set to
null to remove the cutoff.
merchantCategoryRestrictions
object
| null
Replaces the merchant category restrictions. Set to
null to remove.
Restricts card usage by merchant category.
Show child attributes
categories
array<string>
Predefined category groups to allow or block.
Possible values:
advertising,
airlines,
alcohol-and-bars,
car-rental,
education,
electronics,
fuel-and-gas,
gambling,
groceries,
ground-transportation,
hardware-and-home,
healthcare,
live-entertainment,
lodging,
movies,
office-supplies,
parking,
personal-care,
professional-services,
restaurants-and-dining,
retail-general,
rideshare-and-taxis,
software-and-saas,
sports-and-recreation,
subscriptions,
travel-agencies
customMCCs
array<string>
Individual merchant category codes (MCCs) to allow or block, for codes not covered by a predefined category.
exemptMerchants
array<object>
Merchants that are exempt from category restrictions regardless of their category.
Show child attributes
descriptorPattern
string
A case-insensitive RE2 regular expression matched against the merchant descriptor (ISO 8583 DE43).
mid
string
The merchant's unique identifier (ISO 8583 DE42), matched exactly.
name
string
An optional label for this entry.
mode
string
Whether the listed categories are the only ones allowed, or the ones to block.
Whether the listed items are the only ones allowed (
allow) or the ones to block (block).
Possible values:
allow,
block
merchantRestrictions
object
| null
Replaces the merchant restrictions. Set to
null to remove.
Restricts card usage to specific merchants, independent of merchant category.
Show child attributes
merchants
array<object>
The merchants to allow or block.
Show child attributes
descriptorPattern
string
A case-insensitive RE2 regular expression matched against the merchant descriptor (ISO 8583 DE43).
mid
string
The merchant's unique identifier (ISO 8583 DE42), matched exactly.
name
string
An optional label for this entry.
mode
string
Whether the listed merchants are the only ones allowed, or the ones to block.
Whether the listed items are the only ones allowed (
allow) or the ones to block (block).
Possible values:
allow,
block
velocityLimits
array<object>
Replaces the entire set of velocity limits. Send an empty array to clear all limits.
Show child attributes
amount
integer<int64>
The maximum amount in cents that can be spent in a given interval.
count
integer<int64>
The maximum number of transactions allowed in the given interval. At least one of
amount or count must be set.
interval
string<enum>
Specifies the time frame for a velocity limit.
per-transaction applies to each individual authorization and never resets. Time-based intervals (where supported) reset at midnight ET.
Possible values:
per-transaction,
daily,
weekly,
monthly
metadata
object
| null
Free-form key-value pair list. Useful for storing information that is not captured elsewhere.
nickname
string
| null
state
string<enum>
Updates the state of a Moov issued card.
closed: The card is permanently deactivated and cannot approve authorizations. A card can be closed by request or when it expires.
Possible values:
closed
Response
brand
string<enum>
required
The card brand.
Possible values:
American Express,
Discover,
Mastercard,
Visa,
Unknown
createdOn
string<date-time>
required
expiration
object
required
The expiration date of the card or token.
Show child attributes
month
string
2 characters
required
Two-digit month the card expires.
year
string
2 characters
required
Two-digit year the card expires.
formFactor
string<enum>
required
Specifies the type of spend card to be issued. Presently supports virtual only, providing a digital number without a physical card.
Possible values:
virtual
fundingWalletID
string
required
Unique identifier for the wallet funding the card.
issuedCardID
string
required
lastFourCardNumber
string
required
state
string<enum>
required
The state represents the operational status of an issued card. A card can only approve incoming authorizations if it is in an active state.
active: The card is operational and can approve authorizations.closed: The card is permanently deactivated and cannot approve authorizations. A card can be closed by request or when it expires.
Possible values:
active,
closed
updatedOn
string<date-time>
required
authorizedUserAccountID
string
Identifier for the account of the card's authorized user.
billingAddress
object
Billing address associated with the card.
Show child attributes
addressLine1
string
<=60 characters
required
Pattern
addressLine2
string
<=32 characters
Pattern
city
string
<=32 characters
required
Pattern
country
string
<=2 characters
required
postalCode
string
<=5 characters
required
stateOrProvince
string
<=2 characters
required
controls
object
Spend controls applied to an issued card, including velocity runtime state.
Show child attributes
allowedSchedule
object
| null
Limits card usage to specific days and times.
Limits card usage to specific days and times.
Show child attributes
timezone
string
required
IANA timezone string used to evaluate window boundaries against the authorization time.
windows
array<object>
required
Time windows during which the card may authorize. Any matching window allows the transaction.
Show child attributes
days
array<string>
The days of the week this window applies to.
Possible values:
monday,
tuesday,
wednesday,
thursday,
friday,
saturday,
sunday
endTime
string
Exclusive window end time in 24-hour
HH:MM format. If earlier than startTime, the window wraps past midnight.
startTime
string
Inclusive window start time in 24-hour
HH:MM format.
expiresOn
string<date-time>
| null
A spend cutoff date and time. When set, all authorizations after this datetime are declined regardless of other controls.
merchantCategoryRestrictions
object
Restricts card usage by merchant category. When not set, all categories are allowed.
Restricts card usage by merchant category.
Show child attributes
categories
array<string>
Predefined category groups to allow or block.
Possible values:
advertising,
airlines,
alcohol-and-bars,
car-rental,
education,
electronics,
fuel-and-gas,
gambling,
groceries,
ground-transportation,
hardware-and-home,
healthcare,
live-entertainment,
lodging,
movies,
office-supplies,
parking,
personal-care,
professional-services,
restaurants-and-dining,
retail-general,
rideshare-and-taxis,
software-and-saas,
sports-and-recreation,
subscriptions,
travel-agencies
customMCCs
array<string>
Individual merchant category codes (MCCs) to allow or block, for codes not covered by a predefined category.
exemptMerchants
array<object>
Merchants that are exempt from category restrictions regardless of their category.
Show child attributes
descriptorPattern
string
A case-insensitive RE2 regular expression matched against the merchant descriptor (ISO 8583 DE43).
mid
string
The merchant's unique identifier (ISO 8583 DE42), matched exactly.
name
string
An optional label for this entry.
mode
string
required
Whether the listed categories are the only ones allowed, or the ones to block.
Whether the listed items are the only ones allowed (
allow) or the ones to block (block).
Possible values:
allow,
block
merchantRestrictions
object
Restricts card usage to specific merchants, or blocks specific merchants.
Restricts card usage to specific merchants, independent of merchant category.
Show child attributes
merchants
array<object>
required
The merchants to allow or block.
Show child attributes
descriptorPattern
string
A case-insensitive RE2 regular expression matched against the merchant descriptor (ISO 8583 DE43).
mid
string
The merchant's unique identifier (ISO 8583 DE42), matched exactly.
name
string
An optional label for this entry.
mode
string
required
Whether the listed merchants are the only ones allowed, or the ones to block.
Whether the listed items are the only ones allowed (
allow) or the ones to block (block).
Possible values:
allow,
block
singleUse
boolean
Indicates if the card is single-use. If true, the card closes after the first authorization.
velocityLimits
array<object>
The spending limits per time interval, including current runtime state.
Show child attributes
amount
integer<int64>
The maximum amount in cents that can be spent in a given interval.
amountRemaining
integer<int64>
The amount in cents remaining in the current interval.
amountUsed
integer<int64>
The amount in cents already spent in the current interval.
count
integer<int64>
The maximum number of transactions allowed in the given interval.
countRemaining
integer<int64>
The number of transactions remaining in the current interval.
countUsed
integer<int64>
The number of transactions already made in the current interval.
interval
string<enum>
Specifies the time frame for a velocity limit.
per-transaction applies to each individual authorization and never resets. Time-based intervals (where supported) reset at midnight ET.
Possible values:
per-transaction,
daily,
weekly,
monthly
resetsOn
string<date-time>
When the current interval resets. Absent for per-transaction limits.
metadata
object
Free-form key-value pair list. Useful for storing information that is not captured elsewhere.
nickname
string
An optional descriptive name for the card.