Update Card Limits

Update card spending limits

curl --request POST \
  --url https://api.fyatu.com/api/v3.20/cards/{id}/limits \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "daily": 100000,
  "monthly": 1000000
}
'

import requests

url = "https://api.fyatu.com/api/v3.20/cards/{id}/limits"

payload = {
    "daily": 100000,
    "monthly": 1000000
}
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: JSON.stringify({daily: 100000, monthly: 1000000})
};

fetch('https://api.fyatu.com/api/v3.20/cards/{id}/limits', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.fyatu.com/api/v3.20/cards/{id}/limits",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'daily' => 100000,
    'monthly' => 1000000
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.fyatu.com/api/v3.20/cards/{id}/limits"

	payload := strings.NewReader("{\n  \"daily\": 100000,\n  \"monthly\": 1000000\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://api.fyatu.com/api/v3.20/cards/{id}/limits")
  .header("Authorization", "Bearer <token>")
  .header("Content-Type", "application/json")
  .body("{\n  \"daily\": 100000,\n  \"monthly\": 1000000\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://api.fyatu.com/api/v3.20/cards/{id}/limits")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"daily\": 100000,\n  \"monthly\": 1000000\n}"

response = http.request(request)
puts response.read_body

{
  "success": true,
  "status": 200,
  "message": "Card limits updated",
  "data": {
    "cardId": "crd_01HXYZ5555ABCDEF1111",
    "limits": [
      {
        "type": "SPEND",
        "period": "DAILY",
        "amount": 100000
      },
      {
        "type": "SPEND",
        "period": "MONTHLY",
        "amount": 1000000
      }
    ],
    "updatedAt": "2026-07-27T04:00:00Z"
  },
  "meta": {
    "requestId": "req_a1b2c3d4e5f6a7b8c9d0e1f2",
    "platform": "Fyatu CaaS",
    "timestamp": "2026-07-27T04:00:00Z"
  }
}

POST

cards

{id}

limits

Update card spending limits

curl --request POST \
  --url https://api.fyatu.com/api/v3.20/cards/{id}/limits \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "daily": 100000,
  "monthly": 1000000
}
'

import requests

url = "https://api.fyatu.com/api/v3.20/cards/{id}/limits"

payload = {
    "daily": 100000,
    "monthly": 1000000
}
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: JSON.stringify({daily: 100000, monthly: 1000000})
};

fetch('https://api.fyatu.com/api/v3.20/cards/{id}/limits', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.fyatu.com/api/v3.20/cards/{id}/limits",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'daily' => 100000,
    'monthly' => 1000000
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.fyatu.com/api/v3.20/cards/{id}/limits"

	payload := strings.NewReader("{\n  \"daily\": 100000,\n  \"monthly\": 1000000\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://api.fyatu.com/api/v3.20/cards/{id}/limits")
  .header("Authorization", "Bearer <token>")
  .header("Content-Type", "application/json")
  .body("{\n  \"daily\": 100000,\n  \"monthly\": 1000000\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://api.fyatu.com/api/v3.20/cards/{id}/limits")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"daily\": 100000,\n  \"monthly\": 1000000\n}"

response = http.request(request)
puts response.read_body

{
  "success": true,
  "status": 200,
  "message": "Card limits updated",
  "data": {
    "cardId": "crd_01HXYZ5555ABCDEF1111",
    "limits": [
      {
        "type": "SPEND",
        "period": "DAILY",
        "amount": 100000
      },
      {
        "type": "SPEND",
        "period": "MONTHLY",
        "amount": 1000000
      }
    ],
    "updatedAt": "2026-07-27T04:00:00Z"
  },
  "meta": {
    "requestId": "req_a1b2c3d4e5f6a7b8c9d0e1f2",
    "platform": "Fyatu CaaS",
    "timestamp": "2026-07-27T04:00:00Z"
  }
}

Overview

Sets a card’s spend/velocity limits so genuine spend isn’t blocked by the network’s default velocity control (declines with the reason “Authorization declined. Velocity limit reached.”). Use this when a card with sufficient balance is being declined on larger or frequent transactions — for example a travel card that needs to authorize hotel and car-rental holds in the same day. You can set any combination of:

Limit	Meaning
`daily`	Maximum total spend per day
`monthly`	Maximum total spend per calendar month
`perTransaction`	Maximum amount for a single transaction

Amounts are in full currency units (dollars) — 100000 means $100,000, not cents. Supply at least one of daily, monthly, or perTransaction greater than 0. A limit you send replaces that limit on the card; limits you omit are not enforced by the call, so send the full set you want applied.

The card must be ACTIVE (not TERMINATED or EXPIRED) and fully provisioned.

Path Parameters

Parameter	Type	Description
`id`	string	The card ID (prefix `crd_`)

Request Body

Field	Type	Required	Description
`daily`	number	No*	Maximum total spend per day, in dollars (e.g. `100000` = $100,000)
`monthly`	number	No*	Maximum total spend per calendar month, in dollars
`perTransaction`	number	No*	Maximum amount for a single transaction, in dollars

* At least one field must be provided and greater than 0.

Example

curl -X POST https://api.fyatu.com/api/v3.20/cards/crd_01HXYZ5555ABCDEF1111/limits \
  -H "Authorization: Bearer $FYATU_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "daily": 100000, "monthly": 1000000 }'

const resp = await fetch(
  'https://api.fyatu.com/api/v3.20/cards/crd_01HXYZ5555ABCDEF1111/limits',
  {
    method: 'POST',
    headers: {
      'Authorization': `Bearer ${process.env.FYATU_API_KEY}`,
      'Content-Type': 'application/json'
    },
    body: JSON.stringify({ daily: 100000, monthly: 1000000 })
  }
);
const body = await resp.json();
console.log('Applied limits:', body.data.limits);

import os, requests

resp = requests.post(
    'https://api.fyatu.com/api/v3.20/cards/crd_01HXYZ5555ABCDEF1111/limits',
    headers={'Authorization': f'Bearer {os.environ["FYATU_API_KEY"]}'},
    json={'daily': 100000, 'monthly': 1000000}
)
print('Applied limits:', resp.json()['data']['limits'])

Success Response (200)

{
  "success": true,
  "status": 200,
  "message": "Card limits updated",
  "data": {
    "cardId": "crd_01HXYZ5555ABCDEF1111",
    "limits": [
      { "type": "SPEND", "period": "DAILY",   "amount": 100000 },
      { "type": "SPEND", "period": "MONTHLY", "amount": 1000000 }
    ],
    "updatedAt": "2026-07-27T04:00:00Z"
  },
  "meta": {
    "requestId": "req_01HXY123456ABCDEF",
    "platform": "Fyatu CaaS",
    "timestamp": "2026-07-27T04:00:00Z"
  }
}

Webhook

A CARD_LIMITS_UPDATED event fires after a successful update:

{
  "event":       "CARD_LIMITS_UPDATED",
  "eventId":     "evt_01HXY123456ABCDEF",
  "businessId":  "BUS1A2B3C4D5E6F",
  "environment": "LIVE",
  "timestamp":   "2026-07-27T04:00:00Z",
  "data": {
    "cardId": "crd_01HXYZ5555ABCDEF1111",
    "limits": [
      { "type": "SPEND", "period": "DAILY",   "amount": 100000 },
      { "type": "SPEND", "period": "MONTHLY", "amount": 1000000 }
    ],
    "timestamp": "2026-07-27T04:00:00Z"
  }
}

Error Codes

Code	HTTP	Cause
`NO_LIMITS_PROVIDED`	400	None of `daily`, `monthly`, or `perTransaction` was greater than 0
`INVALID_AMOUNT`	400	A supplied limit was negative
`CARD_NOT_FOUND`	404	Card does not exist or belongs to another business/environment
`CARD_TERMINATED`	422	Card is terminated
`CARD_EXPIRED`	422	Card has expired
`CARD_PROVISIONING_PENDING`	409	Card is still being provisioned — try again shortly
`PROVIDER_LIMITS_UPDATE_FAILED`	422	Card provider rejected the limits update
`PROVIDER_UNAVAILABLE`	503	Card provider is temporarily unavailable
`INSUFFICIENT_SCOPE`	403	Key lacks `cards:write` scope

Authorizations

Authorization

string

header

required

API key from the FYATU CaaS portal. Pass as Authorization: Bearer <key>.

Path Parameters

string

required

Body

application/json

daily

number<double>

Maximum total spend per day, in dollars.

Example:

100000

monthly

number<double>

Maximum total spend per calendar month, in dollars.

Example:

1000000

perTransaction

number<double>

Maximum amount for a single transaction, in dollars.

Example:

5000

Response

Card limits updated

The response is of type object.

Unload Card Freeze Card

Account

Products

Cardholders

Cards

Webhooks

Overview

Path Parameters

Request Body

Example

Success Response (200)

Webhook

Error Codes

Authorizations

Path Parameters

Body

Response

​Overview

​Path Parameters

​Request Body

​Example

​Success Response (200)

​Webhook

​Error Codes

Authorizations

Path Parameters

Body

Response

Overview

Path Parameters

Request Body

Example

Success Response (200)

Webhook

Error Codes