Sign in
Payment Rules

Update a payment rule

Changes the rule's name or metadata, keeping its ID and everything recorded against it. What the rule does is fixed once created, so the payments it decided keep naming the rule that decided them; use replace to change that.

patch/payment_rules/{id}

Request body

metadataobject

Custom string-to-string values for your integration. Maximum 50 keys, 40 characters per key, 500 characters per value.

namestring

A name for this rule. Up to 255 characters.

Example request

{
  "metadata": {
    "team": "risk"
  },
  "name": "Review risky cards"
}

Response

The updated rule

account_idstring required

Account ID, prefixed biz_.

action'allow' | 'block' | 'review' | 'enforce_3ds' required

What this account's rule requests when every condition matches. One applicable account-rule action wins, in this order: allow, block, review, enforce_3ds. An allow overrides this account's other rules, never Whop's own fraud controls. A review requests authorization without capture for an eligible on-session card payment through Whop Payments. Automatic capture is scheduled for 48 hours after authorization; capture or void the payment before then to decide sooner. Capture may complete later or fail. Review is skipped for unsupported methods, off-session payments, and payments already configured for manual capture. An enforce_3ds is skipped when the account rule cannot apply a challenge. Other 3DS requirements still apply.

created_atstring required

When the rule was created, as an ISO 8601 timestamp.

deleted_atstring nullable required

When the rule was deleted, as an ISO 8601 timestamp. null unless status is deleted.

idstring required

Payment rule ID, prefixed prule_.

metadataobject required

Custom string-to-string values for your integration. Maximum 50 keys, 40 characters per key, 500 characters per value.

namestring required

A name for this rule. Up to 255 characters.

status'active' | 'inactive' | 'deleted' required

Whether the rule is applied to payments. A deleted rule is kept so the payments it already decided still name it.

updated_atstring required

When the rule was last changed, as an ISO 8601 timestamp.

Example response

{
  "account_id": "biz_xxxxxxxxxxxxxx",
  "action": "block",
  "conditions": {
    "all": [
      {
        "field": "risk_score",
        "operator": "gte"
      }
    ]
  },
  "created_at": "2026-01-01T12:00:00.000Z",
  "id": "prule_xxxxxxxxxxxxxx",
  "metadata": {},
  "name": "Block high risk",
  "status": "active",
  "updated_at": "2026-01-01T12:00:00.000Z"
}

Changes