> ## Documentation Index
> Fetch the complete documentation index at: https://docs.fyatu.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Update Card Limits
> Set a card's spending/velocity limits. POST /cards/{id}/limits. Requires cards:write scope.
## Overview
Sets a card's **spend/velocity limits** so genuine spend isn't blocked by the network's
default velocity control (declines with the reason **"Authorization declined. Velocity limit reached."**).
Use this when a card with sufficient balance is being declined on larger or frequent
transactions — for example a travel card that needs to authorize hotel and car-rental
holds in the same day.
You can set any combination of:
| Limit | Meaning |
| ---------------- | --------------------------------------- |
| `daily` | Maximum total spend per day |
| `monthly` | Maximum total spend per calendar month |
| `perTransaction` | Maximum amount for a single transaction |
Amounts are in **full currency units (dollars)** — `100000` means **\$100,000**, not cents.
Supply at least one of `daily`, `monthly`, or `perTransaction` greater than `0`. A limit you
send **replaces** that limit on the card; limits you omit are not enforced by the call, so send
the full set you want applied.
The card must be `ACTIVE` (not `TERMINATED` or `EXPIRED`) and fully provisioned.
## Path Parameters
| Parameter | Type | Description |
| --------- | ------ | --------------------------- |
| `id` | string | The card ID (prefix `crd_`) |
## Request Body
| Field | Type | Required | Description |
| ---------------- | ------ | -------- | ------------------------------------------------------------------- |
| `daily` | number | No\* | Maximum total spend per day, in dollars (e.g. `100000` = \$100,000) |
| `monthly` | number | No\* | Maximum total spend per calendar month, in dollars |
| `perTransaction` | number | No\* | Maximum amount for a single transaction, in dollars |
\* At least one field must be provided and greater than `0`.
## Example
```bash cURL theme={null}
curl -X POST https://api.fyatu.com/api/v3.20/cards/crd_01HXYZ5555ABCDEF1111/limits \
-H "Authorization: Bearer $FYATU_API_KEY" \
-H "Content-Type: application/json" \
-d '{ "daily": 100000, "monthly": 1000000 }'
```
```javascript Node.js theme={null}
const resp = await fetch(
'https://api.fyatu.com/api/v3.20/cards/crd_01HXYZ5555ABCDEF1111/limits',
{
method: 'POST',
headers: {
'Authorization': `Bearer ${process.env.FYATU_API_KEY}`,
'Content-Type': 'application/json'
},
body: JSON.stringify({ daily: 100000, monthly: 1000000 })
}
);
const body = await resp.json();
console.log('Applied limits:', body.data.limits);
```
```python Python theme={null}
import os, requests
resp = requests.post(
'https://api.fyatu.com/api/v3.20/cards/crd_01HXYZ5555ABCDEF1111/limits',
headers={'Authorization': f'Bearer {os.environ["FYATU_API_KEY"]}'},
json={'daily': 100000, 'monthly': 1000000}
)
print('Applied limits:', resp.json()['data']['limits'])
```
## Success Response (200)
```json theme={null}
{
"success": true,
"status": 200,
"message": "Card limits updated",
"data": {
"cardId": "crd_01HXYZ5555ABCDEF1111",
"limits": [
{ "type": "SPEND", "period": "DAILY", "amount": 100000 },
{ "type": "SPEND", "period": "MONTHLY", "amount": 1000000 }
],
"updatedAt": "2026-07-27T04:00:00Z"
},
"meta": {
"requestId": "req_01HXY123456ABCDEF",
"platform": "Fyatu CaaS",
"timestamp": "2026-07-27T04:00:00Z"
}
}
```
## Webhook
A `CARD_LIMITS_UPDATED` event fires after a successful update:
```json theme={null}
{
"event": "CARD_LIMITS_UPDATED",
"eventId": "evt_01HXY123456ABCDEF",
"businessId": "BUS1A2B3C4D5E6F",
"environment": "LIVE",
"timestamp": "2026-07-27T04:00:00Z",
"data": {
"cardId": "crd_01HXYZ5555ABCDEF1111",
"limits": [
{ "type": "SPEND", "period": "DAILY", "amount": 100000 },
{ "type": "SPEND", "period": "MONTHLY", "amount": 1000000 }
],
"timestamp": "2026-07-27T04:00:00Z"
}
}
```
## Error Codes
| Code | HTTP | Cause |
| ------------------------------- | ---- | ------------------------------------------------------------------ |
| `NO_LIMITS_PROVIDED` | 400 | None of `daily`, `monthly`, or `perTransaction` was greater than 0 |
| `INVALID_AMOUNT` | 400 | A supplied limit was negative |
| `CARD_NOT_FOUND` | 404 | Card does not exist or belongs to another business/environment |
| `CARD_TERMINATED` | 422 | Card is terminated |
| `CARD_EXPIRED` | 422 | Card has expired |
| `CARD_PROVISIONING_PENDING` | 409 | Card is still being provisioned — try again shortly |
| `PROVIDER_LIMITS_UPDATE_FAILED` | 422 | Card provider rejected the limits update |
| `PROVIDER_UNAVAILABLE` | 503 | Card provider is temporarily unavailable |
| `INSUFFICIENT_SCOPE` | 403 | Key lacks `cards:write` scope |
## OpenAPI
````yaml v3.20/openapi.json POST /cards/{id}/limits
openapi: 3.1.0
info:
title: FYATU CaaS API v3.20
description: >-
FYATU Cards-as-a-Service API — API key authentication, Cardholder
lifecycle, Card issuance, Transactions, Webhooks, and Programs.
version: 3.20.0
contact:
name: FYATU Support
url: https://fyatu.com
email: support@fyatu.com
servers:
- url: https://api.fyatu.com/api/v3.20
description: >-
FYATU CaaS API — the environment (LIVE or SANDBOX) is determined by the
API key, not the URL
security:
- BearerAuth: []
tags:
- name: Meta
description: Liveness, account info, and supported event types
- name: Account
description: Account-level balance and funding status
- name: Programs
description: Read card program configuration
- name: Cardholders
description: Create and manage cardholder profiles
- name: Cards
description: Issue, fund, freeze, and terminate virtual cards
- name: Transactions
description: Read-only card transaction history
- name: Webhooks
description: Manage webhook endpoints for real-time event delivery
- name: Products
description: Read card product configurations
paths:
/cards/{id}/limits:
post:
tags:
- Cards
summary: Update card spending limits
description: >-
Set a card's spend/velocity limits so genuine spend is not blocked by
"Velocity limit reached". Amounts are in full currency units (dollars).
Supply any of daily, monthly, or perTransaction (at least one greater
than 0). A supplied limit replaces that limit on the card; omitted
limits are not enforced by the call.
operationId: updateCardLimits
parameters:
- name: id
in: path
required: true
schema:
type: string
example: crd_01HXYZ5555ABCDEF1111
requestBody:
required: true
content:
application/json:
schema:
type: object
properties:
daily:
type: number
format: double
description: Maximum total spend per day, in dollars.
example: 100000
monthly:
type: number
format: double
description: Maximum total spend per calendar month, in dollars.
example: 1000000
perTransaction:
type: number
format: double
description: Maximum amount for a single transaction, in dollars.
example: 5000
example:
daily: 100000
monthly: 1000000
responses:
'200':
description: Card limits updated
content:
application/json:
schema:
type: object
example:
success: true
status: 200
message: Card limits updated
data:
cardId: crd_01HXYZ5555ABCDEF1111
limits:
- type: SPEND
period: DAILY
amount: 100000
- type: SPEND
period: MONTHLY
amount: 1000000
updatedAt: '2026-07-27T04:00:00Z'
meta:
requestId: req_a1b2c3d4e5f6a7b8c9d0e1f2
platform: Fyatu CaaS
timestamp: '2026-07-27T04:00:00Z'
'400':
$ref: '#/components/responses/ValidationError'
'401':
$ref: '#/components/responses/Unauthorized'
'403':
$ref: '#/components/responses/Forbidden'
'404':
$ref: '#/components/responses/NotFound'
'422':
description: Provider rejected the limits update
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
example:
success: false
status: 422
message: Card limits update failed at provider
error:
code: PROVIDER_LIMITS_UPDATE_FAILED
detail: Card limits update failed at provider
meta:
requestId: req_a1b2c3d4e5f6a7b8c9d0e1f2
platform: Fyatu CaaS
timestamp: '2026-07-27T04:00:00Z'
'429':
$ref: '#/components/responses/RateLimitExceeded'
'500':
$ref: '#/components/responses/InternalError'
components:
responses:
ValidationError:
description: Request validation failed
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
example:
success: false
status: 422
message: Validation failed
error:
code: VALIDATION_ERROR
detail: dateOfBirth must be in YYYY-MM-DD format
meta:
requestId: req_a1b2c3d4e5f6a7b8c9d0e1f2
platform: Fyatu CaaS
timestamp: '2026-05-22T15:00:00Z'
Unauthorized:
description: Missing or invalid API key
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
examples:
missing:
summary: API key missing
value:
success: false
status: 401
message: API key is required
error:
code: AUTH_TOKEN_MISSING
detail: API key is required
meta:
requestId: req_a1b2c3d4e5f6a7b8c9d0e1f2
platform: Fyatu CaaS
timestamp: '2026-05-22T15:00:00Z'
invalid:
summary: API key invalid
value:
success: false
status: 401
message: Invalid API key
error:
code: AUTH_TOKEN_INVALID
detail: Invalid API key
meta:
requestId: req_a1b2c3d4e5f6a7b8c9d0e1f2
platform: Fyatu CaaS
timestamp: '2026-05-22T15:00:00Z'
Forbidden:
description: Scope denied or business suspended
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
example:
success: false
status: 403
message: Scope denied
error:
code: INSUFFICIENT_SCOPE
detail: This endpoint requires the cards:write scope
meta:
requestId: req_a1b2c3d4e5f6a7b8c9d0e1f2
platform: Fyatu CaaS
timestamp: '2026-05-22T15:00:00Z'
NotFound:
description: Resource not found or does not belong to your business
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
RateLimitExceeded:
description: Rate limit exceeded
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
example:
success: false
status: 429
message: Rate limit exceeded
error:
code: RATE_LIMIT_EXCEEDED
detail: Too many requests
meta:
requestId: req_a1b2c3d4e5f6a7b8c9d0e1f2
platform: Fyatu CaaS
timestamp: '2026-05-22T15:00:00Z'
InternalError:
description: Unexpected server error
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
example:
success: false
status: 500
message: Internal error
error:
code: INTERNAL_ERROR
detail: An unexpected error occurred
meta:
requestId: req_a1b2c3d4e5f6a7b8c9d0e1f2
platform: Fyatu CaaS
timestamp: '2026-05-22T15:00:00Z'
schemas:
Error:
type: object
properties:
success:
type: boolean
example: false
status:
type: integer
example: 422
message:
type: string
example: Human readable message
error:
$ref: '#/components/schemas/ErrorBody'
meta:
$ref: '#/components/schemas/Meta'
ErrorBody:
type: object
properties:
code:
type: string
example: VALIDATION_ERROR
detail:
type: string
example: dateOfBirth must be in YYYY-MM-DD format
Meta:
type: object
properties:
requestId:
type: string
example: req_a1b2c3d4e5f6a7b8c9d0e1f2
platform:
type: string
example: Fyatu CaaS
timestamp:
type: string
format: date-time
example: '2026-05-22T15:00:00Z'
securitySchemes:
BearerAuth:
type: http
scheme: bearer
description: >-
API key from the FYATU CaaS portal. Pass as `Authorization: Bearer
`.
````