Sign in
Payment Rules

Update a payment rule

Changes the rule's name or metadata, keeping its ID and everything recorded against it. What the rule does is fixed once created, so the payments it decided keep naming the rule that decided them; use replace to change that.

patch/payment_rules/{id}

Request body

metadataobject

Custom string-to-string values for your integration. Maximum 50 keys, 40 characters per key, 500 characters per value.

namestring

A name for this rule. Up to 255 characters.

Example request

{
  "metadata": {
    "team": "risk"
  },
  "name": "Review risky cards"
}

Response

The updated rule

account_idstring required

Account ID, prefixed biz_.

action'allow' | 'block' | 'review' | 'enforce_3ds' required

What this account's rule requests when every condition matches. One applicable account-rule action wins, in this order: allow, block, review, enforce_3ds. An allow overrides this account's other rules, never Whop's own fraud controls. A review requests authorization without capture for an eligible on-session card payment through Whop Payments. Automatic capture is scheduled for 48 hours after authorization; capture or void the payment before then to decide sooner. Capture may complete later or fail. Review is skipped for unsupported methods, off-session payments, and payments already configured for manual capture. An enforce_3ds is skipped when the account rule cannot apply a challenge. Other 3DS requirements still apply.

created_atstring required

When the rule was created, as an ISO 8601 timestamp.

deleted_atstring nullable required

When the rule was deleted, as an ISO 8601 timestamp. null unless status is deleted.

idstring required

Payment rule ID, prefixed prule_.

metadataobject required

Custom string-to-string values for your integration. Maximum 50 keys, 40 characters per key, 500 characters per value.

namestring required

A name for this rule. Up to 255 characters.

status'active' | 'inactive' | 'deleted' required

Whether the rule is applied to payments. A deleted rule is kept so the payments it already decided still name it.

updated_atstring required

When the rule was last changed, as an ISO 8601 timestamp.

Example response

{
  "account_id": "biz_xxxxxxxxxxxxxx",
  "action": "block",
  "conditions": {
    "all": [
      {
        "field": "risk_score",
        "operator": "gte"
      }
    ]
  },
  "created_at": "2026-01-01T12:00:00.000Z",
  "id": "prule_xxxxxxxxxxxxxx",
  "metadata": {},
  "name": "Block high risk",
  "status": "active",
  "updated_at": "2026-01-01T12:00:00.000Z"
}

Changes

Changed in 3 of the 74 revisions of this API.51

  • 78e1ed7366cd1See the full diff
    • ●

      added the new card_bin enum value to the /// response property for the response status

      response-property-enum-value-added

  • ef86d14ef6914See the full diff
    • ●

      added the new amount_in_usd enum value to the /// response property for the response status

      response-property-enum-value-added

    • ●

      added the new in_cidr enum value to the /// response property for the response status

      response-property-enum-value-added

    • ●

      added the new ip_address enum value to the /// response property for the response status

      response-property-enum-value-added

    • ●

      added the new review enum value to the response property for the response status

      response-property-enum-value-added

    This revision also has 1 change that name no endpoint, such as unreferenced schemas being removed. See the revision's changelog

  • ff3a765735631See the full diff
    • ○

      endpoint added

      endpoint-added

Of the 74 revisions, 1 has no diff computed.