---
title: "Update Card"
method: PATCH
path: "/cards/{card_id}"
tags: ["Cards"]
---

# Update Card

`PATCH /cards/{card_id}`

## Request

- Base URL: `https://api.meow.com/v1`
- URL: `https://api.meow.com/v1/cards/{card_id}`
- Auth: API key in header `x-api-key`
- TypeScript: <https://skmtc.dev/meow/apis/meow-api/docs/cards/:card_id/patch.ts> (a function with typed inputs; its response is checked against the schema)

Updates an agent card, such as one you created via the API. Freeze or unfreeze it with the `status` field, replace its spend limits with `spending_controls`, or change its merchant restriction with `spending_restriction` and its allowed merchant categories. All fields are optional; omitted fields are left unchanged. Read the current limits back from Get Card Limits.

## Path parameters

- `card_id` string, uuid, required: Card to act on. Use list_cards to find one.

## Headers

- `x-entity-id` string, uuid

## Request body

- UpdateCardRequest
  - `status` 'active' | 'inactive'
  - `nickname` string, nullable: Rename the card's display name (max 30 characters).
  - `spending_controls` SpendingControls
    - `per_transaction_limit` integer, required: Per-transaction spend limit in whole dollars. It can't exceed your entity's limit for agent cards, which is $25,000 unless Meow has set a different one.
    - `daily_limit` integer, nullable: Daily spend limit in whole dollars, resetting at midnight UTC.
    - `weekly_limit` integer, nullable: Weekly spend limit in whole dollars, resetting Sunday at midnight UTC.
    - `monthly_limit` integer, nullable: Monthly spend limit in whole dollars, resetting on the 1st at midnight UTC.
    - `yearly_limit` integer, nullable: Yearly spend limit in whole dollars, resetting January 1st at midnight UTC.
    - `all_time_limit` integer, nullable: Lifetime spend limit in whole dollars. It never resets.
  - `allowed_categories` CardTransactionCategory[], nullable: Restrict the card to these merchant categories. Pass `null` to clear all category restrictions.
  - `spending_restriction` CardSpendingRestrictionRequest
    - `type` 'allow' | 'block', required
    - `merchants` string[], required: Merchant IDs from `GET /cards/merchants`. When `type` is `allow` the card authorizes only at these merchants; when `block` it is refused at them and allowed everywhere else.

## Response `200`

Successful Response

- CardResponse
  - `id` string, uuid, required: Unique card identifier.
  - `display_name` string, required: Card name or nickname.
  - `last_four` string, nullable, required: Last 4 digits of the card number. Null until the issuer assigns the card number, so pending cards have no value.
  - `status` 'pending' | 'active' | 'suspended' | 'closed' | 'failed', required
  - `is_physical` boolean, required: Whether this is a physical card.
  - `is_single_use` boolean: Whether this is a single-use card.
  - `cardholder` CardCardholder, required
    - `name` string, required: Cardholder's full name.
    - `public_id` string, uuid, nullable: Cardholder's public user ID.
  - `created_at` string, date-time, required: ISO 8601 date-time in the format `YYYY-MM-DDThh:mm:ss.nnn[Z|[+|-]hh:mm]` (per [IETF RFC 3339](https://xml2rfc.tools.ietf.org/public/rfc/html/rfc3339.html#anchor14)).
  - `expiration` string, date-time: ISO 8601 date-time in the format `YYYY-MM-DDThh:mm:ss.nnn[Z|[+|-]hh:mm]` (per [IETF RFC 3339](https://xml2rfc.tools.ietf.org/public/rfc/html/rfc3339.html#anchor14)).
  - `spending_restriction` CardSpendingRestriction
    - `type` 'allow' | 'block', required
    - `merchants` string[], required: Merchant names in the restriction list.
  - `allowed_categories` CardTransactionCategory[], nullable: Merchant categories the card is restricted to. Null means every category is allowed.

## Other responses

- `400`: The request could not be processed.
- `401`: Authentication failed.
- `403`: The API key is not authorized for this operation, or the user of a global API key is an admin or controller without approved KYC. The KYC case returns the message `KYC is required for controllers and admins.` until that user completes KYC in the Meow dashboard.
- `429`: Too many requests.

---

[API](https://skmtc.dev/meow/apis/meow-api.md) - [All operations](https://skmtc.dev/meow/apis/meow-api/llms.txt) - [OpenAPI document](https://skmtc.dev/meow/apis/meow-api/revisions/ea2d7e25b63b?raw)