---
title: "Update one"
method: PATCH
path: "/v1/card_issuing_requests/{card_issuing_request_id}"
tags: ["Card issuing request"]
---

# Update one

`PATCH /v1/card_issuing_requests/{card_issuing_request_id}`

Updates a card issuing request. The owner, a manager, or an admin may edit the
base fields.

Certain fields are role-gated and, if present without the required role, the
whole request is rejected with `401`:

- `user_id`, `company_id`, `budget_cents`, `budget_currency` → require the
  caller to act as a **manager** (admin or `card_issuing_requests_manage`).
- `tracking_number`, `tracking_url`, `estimated_delivery_date`, and the
  milestone timestamps `printing_at` / `sent_at` / `delivered_at` →
  **Cardda staff-only**.
- `status` is only permitted for admins.

`physical` cannot be changed after creation, and shipping fields cannot be
blanked on physical CLP requests (model validations → `422`).

## Path parameters

- `card_issuing_request_id` string, uuid, required

## Parameters

- `#/paths/~1v1~1merchants/get/parameters/0` — unresolved $ref

## Request body

- CardIssuingRequestUpdate — Payload to update a card issuing request. The cardholder (or a manager with the `card_issuing_requests_manage` permission / an admin) may edit the base fields. Some fields are gated by role and rejected with `401` if present without the required role: - `user_id`, `company_id`, `budget_cents`, `budget_currency` require the caller to act as a **manager** (admin or `card_issuing_requests_manage`). - `tracking_number`, `tracking_url`, `estimated_delivery_date` and the milestone timestamps `printing_at` / `sent_at` / `delivered_at` are **Cardda staff-only**. - `status` is only accepted from an admin.
  - `name` string — Display name for the card.
  - `interval` 'monthly' | 'daily'
  - `physical` boolean — Cannot be changed after creation (validation rejects the change).
  - `purchase` 'national' | 'international' | 'both'
  - `recipient_name` string — Recipient full name. Cannot be blanked on physical CLP requests.
  - `contact_phone` string
  - `shipping_address` object — Cannot be blanked on physical CLP requests.
    - `street` string
    - `number` string
    - `municipality_id` integer
    - `complement` string
  - `user_id` string — **Manager-only.** Firebase user id of the cardholder.
  - `company_id` string, uuid — **Manager-only.** UUID of the owning company.
  - `budget_cents` integer — **Manager-only.** Requested budget in cents.
  - `budget_currency` string — **Manager-only.** ISO-4217 budget currency.
  - `status` 'pending' | 'accepted' | 'declined' | 'printing' | 'printed' | 'sent' | 'delivered' — **Admin-only.** Request lifecycle status.
  - `tracking_number` string — **Cardda staff-only.** Carrier tracking number.
  - `tracking_url` string — **Cardda staff-only.** Carrier tracking URL (must start with http:// or https://).
  - `estimated_delivery_date` string, date — **Cardda staff-only.** Estimated delivery date.

## Response `200`

The updated card issuing request.

- CardIssuingRequest — A single user's request to issue a `VendorCard`. When a user creates a card in the dashboard, a `CardIssuingRequest` is created first; once approved by Cardda staff (or auto-issued) it produces the actual card and `vendor_card_id` is set.
  - `id` string, uuid
  - `name` string, nullable — Display name requested for the card.
  - `user_id` string — Firebase user id of the future cardholder (not a UUID).
  - `company_id` string, uuid
  - `status` 'pending' | 'accepted' | 'declined' | 'printing' | 'printed' | 'sent' | 'delivered' — Lifecycle of the request. - `pending` — created, awaiting approval / issuing. - `accepted` — a card was issued and linked (`vendor_card_id` is set). - `declined` — rejected. - `printing` / `printed` — physical card in production. - `sent` — dispatched to the cardholder (admin marks this). - `delivered` — cardholder self-confirmed receipt (see `confirm_delivery`).
  - `budget_cents` integer — Requested spending budget in cents, in `budget_currency`.
  - `budget_currency` string — ISO-4217 code of the requested budget currency.
  - `interval` 'monthly' | 'daily' — Budget renewal interval for the resulting card.
  - `physical` boolean — Whether a physical (plastic) card is requested. `false` for virtual-only.
  - `purchase` 'national' | 'international' | 'both', nullable — Allowed purchase geography for the card.
  - `vendor_id` string, nullable — Issuing partner selected at approval time (e.g. `plh`, `pomelo`, `slash`).
  - `vendor_card_id` string, nullable — Id of the issued `VendorCard` once the request is accepted (vendor-prefixed string, not a UUID).
  - `type` string, nullable — STI subclass derived from `vendor_id` (e.g. `Cards::Plh::Request`).
  - `recipient_name` string, nullable — Recipient full name for physical shipments. Required for physical CLP requests.
  - `contact_phone` string, nullable — Contact phone for the physical shipment.
  - `shipping_address` object, nullable — Shipping address for physical CLP requests. `municipality_name` is enriched server-side from `municipality_id`.
    - `street` string
    - `number` string
    - `municipality_id` integer
    - `municipality_name` string
    - `complement` string, nullable
  - `shipping_municipality_name` string, nullable — Resolved municipality name for the shipping address (computed field).
  - `kyc_completed` boolean — Whether the owning company has completed KYC. Computed field. Serialized as the JSON key `kyc_completed` (the `?` Ruby predicate suffix is stripped).
  - `tracking_number` string, nullable — Carrier tracking number (staff-set). Only present for dispatched physical cards.
  - `tracking_url` string, nullable — Carrier tracking URL (staff-set).
  - `estimated_delivery_date` string, date, nullable — Estimated delivery date (staff-set).
  - `shipment_id` string, nullable — Vendor shipment identifier for physical cards.
  - `printing_at` string, date-time, nullable — When the request entered the `printing` milestone.
  - `sent_at` string, date-time, nullable — When the physical card was dispatched.
  - `delivered_at` string, date-time, nullable — When the cardholder confirmed delivery.
  - `created_at` string, date-time
  - `updated_at` string, date-time

## Other responses

- `401` — Unauthorized — a role-gated field (admin/manager/staff-only) was sent without the required role.
- `404` — Card issuing request not found (or not visible to the caller).
- `422` — Unprocessable Entity — model validation failed (e.g. changing `physical`, blanking shipping data).

---

[API](https://skmtc.dev/cardda/apis/banking-api.md) · [All operations](https://skmtc.dev/cardda/apis/banking-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/cardda/banking-api/revisions/ff1aeb3fda8b/schema)