Update this card's policy

Lets a cardholder tighten their own card: block merchant categories or countries, switch off transaction types, or set spending limits below the program’s. Only on accounts whose cards.limits.mode is custom in capabilities; on a preset account use Update card limit group.

How to make a change

1. Read the policy first with Get this card’s policy. Keep data.version; you must send it back. For each area you want to change, note its mode and effective.
2. Build the body with only the areas you’re changing. Each one is { "card": … }, the cardholder’s own layer. "card": null removes the cardholder’s setting so the card goes back to the program’s defaults.
3. Send it. The response is the whole policy in the same shape as the GET, with a new version and effective recomputed. Render from it; no second GET needed.
4. Handle two errors. 400 CARD_POLICY_VALIDATION_FAILED means the change would loosen the card; the message names the field, for example limits.card.atm.daily: 300000 exceeds program's 250000. 409 CARD_POLICY_VERSION_CONFLICT means someone changed the policy since step 1: GET again and re-apply on the fresh version.

The four areas and what card looks like in each

• mcc: merchant categories, four-digit codes ("7995" gambling, "5813" bars). card: { "allow": [], "block": ["7995"] }
• country: where the card works. card: { "countries": { "allow": [], "block": ["RU"] }, "regions": { "allow": [], "block": [] } }, with ISO country codes and regions UK and EU.
• inputOptions: transaction types by two-digit code ("00" purchase, "01" ATM cash withdrawal, "10" account funding). card: { "allow": [], "block": ["01"] } switches off ATM use.
• limits: spending caps in minor units (pence or cents), per channel. card: { "atm": {…}, "pos": {…} }, each with single, daily, weekly, monthly, annual, and a count object with daily, weekly, monthly, annual. Send all of them every time. 0 means “no limit of my own at this window”, so the program’s value applies. single is per transaction, daily, weekly and monthly are rolling totals, annual is accepted but not enforced, and count caps the number of transactions per window. If limits.mode is COMBINED, ATM and POS share one budget and the tighter value applies to both.

Options a cardholder may choose from returns the codes and labels for mcc, country and inputOptions.

Three rules the API enforces

• Which list to fill depends on mode. ALLOW_ALL_EXCEPT_BLOCKED (the usual case): put codes in block, leave allow empty. ALLOW_ONLY_SPECIFIED: put codes in allow, leave block empty. Filling the wrong one is a 400. Both keys must always be present.
• A list replaces, it doesn’t add. Send the complete list you want every time; the previous one is discarded. To add a second blocked code, send both; to remove one, send the list without it.
• You can only tighten. Compare against effective: block more, allow fewer, or set a lower amount, never the reverse. Anything the program has blocked stays blocked whatever you send.

An area with editable: false is switched off for the program; a write there is accepted but changes nothing, so hide the control. Changes reach card authorizations within about a minute.