---
title: "Update a single card permission"
method: PATCH
path: "/v3/spend/profiles/{profileId}/cards/{cardToken}/spending-permissions"
tags: ["card"]
deprecated: true
---

# Update a single card permission

`PATCH /v3/spend/profiles/{profileId}/cards/{cardToken}/spending-permissions`

> **Deprecated.**

Enable or disable a single spending permission on a card.

{% admonition type="warning" %}
This endpoint is deprecated. Please use the [v4 endpoint](/api-reference/card/cardpermissionsbulkupdate) instead.
{% /admonition %}

## Path parameters

- `profileId` integer, required
- `cardToken` string, uuid, required

## Headers

- `X-External-Correlation-Id` string, uuid

## Request body

- Permission — Spending permission configuration for a card.
  - `type` 'ECOM' | 'POS_CHIP' | 'POS_MAGSTRIPE' | 'POS_CONTACTLESS' | 'ATM_WITHDRAWAL' | 'MOBILE_WALLETS', required — The type of transaction this permission controls. Permissions available on all cards: - `ECOM` - Online transactions - `ATM_WITHDRAWAL` - ATM withdrawals - `MOBILE_WALLETS` - Digital wallet payments (Apple Pay, Google Pay) Additional permissions available on physical cards: - `POS_MAGSTRIPE` - Physical point-of-sale transactions with magnetic stripe - `POS_CONTACTLESS` - Physical point-of-sale contactless transactions - `POS_CHIP` - Physical point-of-sale transactions with chip Virtual cards do not return physical point-of-sale permissions. Only permissions returned for the card can be updated.
  - `isEnabled` boolean, required — Indicates if this permission type is enabled.
  - `isLocked` boolean — Indicates if this permission is locked. If `true`, this permission cannot be updated.

## Response `200`

Permission updated successfully.

## Other responses

- `400` — Bad request. The requested permission type is not recognized. No permission is updated.
- `422` — Unprocessable entity. The request is syntactically valid but cannot be fulfilled because a requested permission is not supported by this card type, or the permission is locked and cannot be changed. No permission is updated.
- `429` — Rate limit exceeded. Retry after the number of seconds specified in the `Retry-After` header.

## Changes

- **2026-07-09** `d961426856ab` — 2 info
  - added the non-success response with the status `400`
  - added the non-success response with the status `422`

[Change history](https://skmtc.dev/wise/apis/platform-api/changes/v3/spend/profiles/:profileId/cards/:cardToken/spending-permissions/patch.md)

---

[API](https://skmtc.dev/wise/apis/platform-api.md) · [All operations](https://skmtc.dev/wise/apis/platform-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/wise/platform-api/revisions/4907a1d269ab/schema)