# Update a spending card

`PATCH /issuing/{accountID}/cards/{issuedCardID}`

API version: `v2026.10.00`. Send `X-Moov-Version: v2026.10.00` to get the behavior described here.

> AI agents: search and read all Moov docs with the docs MCP server at https://docs.moov.io/mcp (no API key). Setup: https://docs.moov.io/guides/developer-tools/mcp-ai/docs-mcp/index.md

Update a Moov issued card.

To access this endpoint using an [access token](https://docs.moov.io/api/authentication/access-tokens/)
you'll need to specify the `/accounts/{accountID}/issued-cards.write` scope.

## Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `X-Moov-Version` | header | string |  | Set this header to v2026.10.00 to use the API described in this specification. When omitted, the server defaults to v2024.01.00, the earliest supported version, which may not match the behavior documented here. An unrecognized well-formed version uses the latest supported version that is not newer than the requested version, when one exists. For example, `v2026.08.00` uses `v2026.07.00`. A malformed value, such as `2022`, returns a `404` response. Values: `v2026.10.00`. |
| `accountID` | path | string | Yes | The Moov business account for which the card was issued. |
| `issuedCardID` | path | string | Yes |  |

## Request body

Content type: `application/json`

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `state` | string |  | Updates the state of a Moov issued card. - `active`: The card is operational and authorizations can be approved. - `frozen`: The card is temporarily suspended and authorizations cannot be approved. Set the state back to `active` to reactivate it. A card can move between `frozen` and `active` as often as needed. - `closed`: The card is permanently deactivated. A card is closed by request or when it expires, and cannot be reopened. Values: `active`, `frozen`, `closed`. |
| `nickname` | string, nullable |  |  |
| `metadata` | object, nullable |  | Free-form key-value pair list. Useful for storing information that is not captured elsewhere. |
| `billingAddress` | object, nullable |  |  |
| `billingAddress.addressLine1` | string |  |  |
| `billingAddress.addressLine2` | string |  |  |
| `billingAddress.city` | string |  |  |
| `billingAddress.stateOrProvince` | string |  |  |
| `billingAddress.postalCode` | string |  |  |
| `billingAddress.country` | string |  |  |
| `controls` | object |  | Mutable spend controls for the card. |
| `controls.velocityLimits` | array of object |  | Replaces the entire set of velocity limits. Send an empty array to clear all limits. |
| `controls.velocityLimits[].amount` | integer (int64) |  | The maximum amount in cents that can be spent in a given interval. |
| `controls.velocityLimits[].count` | integer (int64) |  | The maximum number of transactions allowed in the given interval. At least one of `amount` or `count` must be set. |
| `controls.velocityLimits[].interval` | string | Yes | Specifies the time frame for a velocity limit. `per-transaction` applies to each individual authorization and never resets. Time-based intervals (where supported) reset at midnight ET. Values: `per-transaction`, `daily`, `weekly`, `monthly`. |
| `controls.merchantCategoryRestrictions` | object, nullable |  | Restricts card usage by merchant category. Set to `null` to remove all category restrictions. |
| `controls.merchantCategoryRestrictions.mode` | string |  | Whether the listed items should be allowed (`allow`) or blocked (`block`). Values: `allow`, `block`. |
| `controls.merchantCategoryRestrictions.categories` | array of string |  | Predefined category groups to allow or block. Values: `advertising`, `airlines`, `alcohol-and-bars`, `car-rental`, `education`, `electronics`, `fuel-and-gas`, `gambling`, `groceries`, `ground-transportation`, `hardware-and-home`, `healthcare`, `live-entertainment`, `lodging`, `movies`, `office-supplies`, `parking`, `personal-care`, `professional-services`, `restaurants-and-dining`, `retail-general`, `rideshare-and-taxis`, `software-and-saas`, `sports-and-recreation`, `subscriptions`, `travel-agencies`. |
| `controls.merchantCategoryRestrictions.customMCCs` | array of string |  | Individual merchant category codes (MCCs) to allow or block, for codes not covered by a predefined category. |
| `controls.merchantCategoryRestrictions.exemptMerchants` | array of object |  | Merchants that are exempt from category restrictions regardless of their category. |
| `controls.merchantCategoryRestrictions.exemptMerchants[].networkID` | string |  | The merchant's unique identifier (ISO 8583 DE42), matched exactly. |
| `controls.merchantCategoryRestrictions.exemptMerchants[].descriptorPattern` | string |  | A case-insensitive RE2 regular expression matched against the merchant descriptor (ISO 8583 DE43). |
| `controls.merchantCategoryRestrictions.exemptMerchants[].name` | string |  | An optional label for this entry. |
| `controls.merchantRestrictions` | object, nullable |  | Restricts card usage to specific merchants, independent of merchant category. Set to `null` to remove merchant restrictions. |
| `controls.merchantRestrictions.mode` | string |  | Whether the listed items should be allowed (`allow`) or blocked (`block`). Values: `allow`, `block`. |
| `controls.merchantRestrictions.merchants` | array of object |  | The merchants to allow or block. |
| `controls.merchantRestrictions.merchants[].networkID` | string |  | The merchant's unique identifier (ISO 8583 DE42), matched exactly. |
| `controls.merchantRestrictions.merchants[].descriptorPattern` | string |  | A case-insensitive RE2 regular expression matched against the merchant descriptor (ISO 8583 DE43). |
| `controls.merchantRestrictions.merchants[].name` | string |  | An optional label for this entry. |
| `controls.allowedSchedule` | object, nullable |  | Limits card usage to specific days and times. Set to `null` to remove all schedule restrictions. |
| `controls.allowedSchedule.timezone` | string |  | IANA timezone string used to evaluate window boundaries against the authorization time. |
| `controls.allowedSchedule.windows` | array of object |  | Time windows during which authorizations on the card can be approved. Any matching window allows the transaction. |
| `controls.allowedSchedule.windows[].days` | array of string | Yes | The days of the week this window applies to. Values: `monday`, `tuesday`, `wednesday`, `thursday`, `friday`, `saturday`, `sunday`. |
| `controls.allowedSchedule.windows[].startTime` | string | Yes | Inclusive window start time in 24-hour `HH:MM` format. |
| `controls.allowedSchedule.windows[].endTime` | string | Yes | Exclusive window end time in 24-hour `HH:MM` format. If earlier than `startTime`, the window wraps past midnight. |
| `controls.expiresOn` | string (date-time), nullable |  | A spend cutoff date and time. Set to `null` to remove the spend cutoff. |

## Response 200

The request completed successfully.

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `issuedCardID` | string | Yes |  |
| `brand` | string | Yes | The card brand. Values: `American Express`, `Discover`, `Mastercard`, `Visa`, `Unknown`. |
| `lastFourCardNumber` | string | Yes |  |
| `expiration` | object | Yes | The expiration date of the card or token. |
| `expiration.month` | string | Yes | Two-digit month the card expires. |
| `expiration.year` | string | Yes | Two-digit year the card expires. |
| `fundingWalletID` | string | Yes | Unique identifier for the wallet funding the card. |
| `authorizedUserAccountID` | string |  | Identifier for the account of the card's authorized user. |
| `nickname` | string |  | An optional descriptive name for the card. |
| `metadata` | object |  | Free-form key-value pair list. Useful for storing information that is not captured elsewhere. |
| `billingAddress` | object |  | Billing address associated with the card. |
| `billingAddress.addressLine1` | string | Yes |  |
| `billingAddress.addressLine2` | string |  |  |
| `billingAddress.city` | string | Yes |  |
| `billingAddress.stateOrProvince` | string | Yes |  |
| `billingAddress.postalCode` | string | Yes |  |
| `billingAddress.country` | string | Yes |  |
| `state` | string | Yes | The `state` represents the operational status of an issued card. Authorizations can only be approved while the card is `active`: - `active`: The card is operational and authorizations can be approved. - `frozen`: The card is temporarily suspended and authorizations cannot be approved. Set the state back to `active` to reactivate it. A card can move between `frozen` and `active` as often as needed. - `closed`: The card is permanently deactivated. A card is closed by request or when it expires, and cannot be reopened. Values: `active`, `frozen`, `closed`. |
| `formFactor` | string | Yes | Specifies the type of spend card to be issued. Presently supports virtual only, providing a digital number without a physical card. Values: `virtual`. |
| `controls` | object |  | Spend controls applied to an issued card, including velocity runtime state. |
| `controls.singleUse` | boolean |  | Indicates if the card is single-use. If true, the card closes after the first authorization. |
| `controls.velocityLimits` | array of object |  | The spending limits per time interval, including current runtime state. |
| `controls.merchantCategoryRestrictions` | object |  | Restricts card usage by merchant category. When not set, all categories are allowed. |
| `controls.merchantRestrictions` | object |  | Restricts card usage to specific merchants, independent of merchant category. |
| `controls.allowedSchedule` | object, nullable |  | Limits card usage to specific days and times. |
| `controls.expiresOn` | string (date-time), nullable |  | A spend cutoff date and time. When set, all authorizations after this datetime are declined regardless of other controls. |
| `createdOn` | string (date-time) | Yes |  |
| `updatedOn` | string (date-time) | Yes |  |

## Errors

| Status | Meaning |
| --- | --- |
| 400 | The server could not understand the request due to invalid syntax. |
| 401 | The request contained missing or expired authentication. |
| 403 | The user is not authorized to make the request. |
| 404 | The requested resource was not found. |
| 409 | The request conflicted with the current state of the target resource. |
| 422 | The request was well-formed, but the contents failed validation. Check the request for missing or invalid fields. |
| 429 | Request was refused due to rate limiting. |
| 500 | The request failed due to an unexpected error. |
| 504 | The request failed because a downstream service failed to respond. |

## Examples

### cURL

```bash
curl -X PATCH "https://api.moov.io/issuing/{accountID}/cards/{issuedCardID}" \
  -H "Authorization: Bearer {token}" \
  -H "X-Moov-Version: v2026.10.00"
```

### Typescript (SDK)

```typescript
import { Moov } from "@moovio/sdk";

const moov = new Moov({
  security: {
    username: "",
    password: "",
  },
});

async function run() {
  const result = await moov.cardIssuing.update({
    accountID: "44db31bc-2813-424b-9b8c-2d3f5f1300e3",
    issuedCardID: "69ca2a7e-7bbc-4176-9d0c-2a1aa7143006",
    updateIssuedCard: {
      metadata: {
        "optional": "metadata",
      },
      billingAddress: {
        addressLine1: "123 Main Street",
        addressLine2: "Apt 302",
        city: "Boulder",
        stateOrProvince: "CO",
        postalCode: "80301",
        country: "US",
      },
      controls: {
        velocityLimits: [
          {
            amount: 10000,
            interval: "daily",
          },
        ],
      },
    },
  });

  console.log(result);
}

run();
```

Full reference with SDK examples in every language: https://docs.moov.io/api/v2026.10.00/money-movement/issuing/update/