---
title: "Update Card"
method: PATCH
path: "/cards/{card_id}"
tags: ["Cards"]
---

# Update Card

`PATCH /cards/{card_id}`

Updates an issued card. All fields are optional; only the fields you pass are changed. Updates the card name, billing address, and spending limits in one call, sets a new PIN, freezes or unfreezes the card, or cancels it. Pass canceled: true alone to cancel the card — cancellation is permanent and a canceled card cannot be uncanceled. Pass exactly one of account_id (a biz_ identifier) or user_id (a user_ identifier). Assigned cardholders without the payout:account:update scope can update the PIN and freeze state of their own card. The PIN can only be changed on a card assigned to the acting user. Returns the updated card resource. For a card in the invited status, the invited user completes card onboarding by passing only a billing address: their verified identity is registered with the card issuer and card provisioning starts (the card is returned and can be polled until issued). The invited user must have an approved identity verification on their Whop account. No other fields can be updated until the card is issued.

## Request body

- object
  - `account_id` string — The owning account ID (a biz_ identifier). Provide this or user_id.
  - `billing` object — New billing address. Requires line1, city, region, postal_code, and country_code. On an invited card, passing billing alone (as the invited user) completes onboarding and starts card provisioning.
    - `city` string, required — Billing city.
    - `country_code` string, required — Billing country code, ISO 3166-1 alpha-2.
    - `line1` string, required — Street address line 1.
    - `line2` string — Street address line 2.
    - `postal_code` string, required — Billing postal code.
    - `region` string, required — Billing region or state.
  - `canceled` boolean — Pass `true` to permanently cancel the card. A canceled card cannot be uncanceled. Cannot be combined with other fields.
  - `frozen` boolean — Pass `true` to freeze the card, `false` to unfreeze it.
  - `name` string — A display name for the card.
  - `pin` string — New 4-digit PIN. Can only be set on a card assigned to the acting user.
  - `remove_limit` boolean — Pass `true` to remove the spending limit (make the card unlimited).
  - `spend_limit` number — Spending limit amount, in dollars.
  - `spend_limit_frequency` 'daily' | 'weekly' | 'monthly' | 'one_time' — The spending limit window.
  - `transaction_limit` number — Per-transaction limit amount, in dollars.
  - `user_id` string — The owning user ID (a user_ identifier). Provide this or account_id.

## Response `200`

invited card onboarding completed: card provisioning started

- object
  - `billing` object, nullable, required — The billing address.
    - `city` string, nullable, required — Billing city.
    - `country_code` string, nullable, required — Billing country code.
    - `line1` string, nullable, required — Street address line 1.
    - `line2` string, nullable, required — Street address line 2.
    - `postal_code` string, nullable, required — Billing postal code.
    - `region` string, nullable, required — Billing region or state.
  - `canceled_at` string, date-time, nullable, required — When the card was canceled.
  - `created_at` string, date-time, nullable, required — When the card was created.
  - `expiration_month` string, nullable, required — Card expiration month.
  - `expiration_year` string, nullable, required — Card expiration year.
  - `id` string, required — Card ID, prefixed `icrd_`.
  - `last4` string, nullable, required — Last four digits of the card number. `null` for pending invitation cards.
  - `limit` object, nullable, required — The spending limit configuration.
    - `amount` number, required — The limit amount in dollars.
    - `frequency` string, required — Limit window, for example `per24HourPeriod` or `perAuthorization`.
  - `name` string, nullable, required — Card display name.
  - `object` 'card', required
  - `secrets` object, nullable — Sensitive card details. Present only on `GET /cards/:card_id` for active cards; `null` when the card is inactive or details cannot be retrieved.
    - `card_number` string, required — Full card number.
    - `cvc` string, required — Card verification code.
    - `name_on_card` string, nullable, required — Cardholder name printed on the card.
    - `pin` string, nullable, required — The card PIN. Only returned when the request is authenticated as the user the card is assigned to; `null` for all other callers, including account API keys.
  - `spent_last_month` integer, nullable, required — Total spend in the last 30 days, in cents.
  - `status` 'null' | 'active' | 'frozen' | 'canceled' | 'invited', nullable, required — The card status.
  - `type` 'null' | 'virtual' | 'physical', nullable, required — The card type.
  - `user_id` string, nullable, required — Cardholder user ID, prefixed `user_`, when assigned.

## Other responses

- `400` — Invalid Parameters
- `403` — Forbidden
- `404` — Resource not found

## Changes

- **2026-07-26** `60bbb4a6ffbc` — 1 info
  - added the required property `secrets/pin` to the response with the `200` status

[Change history](https://skmtc.dev/whop/apis/whop-api/changes/cards/:card_id/patch.md)

---

[API](https://skmtc.dev/whop/apis/whop-api.md) · [All operations](https://skmtc.dev/whop/apis/whop-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/whop/whop-api/revisions/60bbb4a6ffbc/schema)