Update Card

TypeScript

import { WhopClient } from "@whop/sdk";

const client = new WhopClient({ token: "YOUR_TOKEN", apiVersionDate: "2026-08-21-1", idempotencyKey: "YOUR_IDEMPOTENCY_KEY" });
await client.cards.update({
    id: "id"
});

curl --request PATCH \
  --url https://api.whop.com/api/v1/cards/{id} \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "account_id": "biz_xxxxxxxxxxxxxx",
  "canceled": true,
  "cardholder": {
    "email": "marcus@shinetime.example",
    "first_name": "Tanya",
    "last_name": "Cole",
    "phone": "+xxxxxxxxxxx"
  },
  "frozen": true,
  "name": "Detailing supplies",
  "pin": "1234",
  "remove_limit": true,
  "spend_limit": 2500,
  "spend_limit_frequency": "monthly",
  "transaction_limit": 500,
  "user_id": "user_xxxxxxxxxxxxxx"
}
'

import requests

url = "https://api.whop.com/api/v1/cards/{id}"

payload = {
    "account_id": "biz_xxxxxxxxxxxxxx",
    "canceled": True,
    "cardholder": {
        "email": "marcus@shinetime.example",
        "first_name": "Tanya",
        "last_name": "Cole",
        "phone": "+xxxxxxxxxxx"
    },
    "frozen": True,
    "name": "Detailing supplies",
    "pin": "1234",
    "remove_limit": True,
    "spend_limit": 2500,
    "spend_limit_frequency": "monthly",
    "transaction_limit": 500,
    "user_id": "user_xxxxxxxxxxxxxx"
}
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.patch(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'PATCH',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: JSON.stringify({
    account_id: 'biz_xxxxxxxxxxxxxx',
    canceled: true,
    cardholder: {
      email: 'marcus@shinetime.example',
      first_name: 'Tanya',
      last_name: 'Cole',
      phone: '+xxxxxxxxxxx'
    },
    frozen: true,
    name: 'Detailing supplies',
    pin: '1234',
    remove_limit: true,
    spend_limit: 2500,
    spend_limit_frequency: 'monthly',
    transaction_limit: 500,
    user_id: 'user_xxxxxxxxxxxxxx'
  })
};

fetch('https://api.whop.com/api/v1/cards/{id}', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.whop.com/api/v1/cards/{id}",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "PATCH",
  CURLOPT_POSTFIELDS => json_encode([
    'account_id' => 'biz_xxxxxxxxxxxxxx',
    'canceled' => true,
    'cardholder' => [
        'email' => 'marcus@shinetime.example',
        'first_name' => 'Tanya',
        'last_name' => 'Cole',
        'phone' => '+xxxxxxxxxxx'
    ],
    'frozen' => true,
    'name' => 'Detailing supplies',
    'pin' => '1234',
    'remove_limit' => true,
    'spend_limit' => 2500,
    'spend_limit_frequency' => 'monthly',
    'transaction_limit' => 500,
    'user_id' => 'user_xxxxxxxxxxxxxx'
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.whop.com/api/v1/cards/{id}"

	payload := strings.NewReader("{\n  \"account_id\": \"biz_xxxxxxxxxxxxxx\",\n  \"canceled\": true,\n  \"cardholder\": {\n    \"email\": \"marcus@shinetime.example\",\n    \"first_name\": \"Tanya\",\n    \"last_name\": \"Cole\",\n    \"phone\": \"+xxxxxxxxxxx\"\n  },\n  \"frozen\": true,\n  \"name\": \"Detailing supplies\",\n  \"pin\": \"1234\",\n  \"remove_limit\": true,\n  \"spend_limit\": 2500,\n  \"spend_limit_frequency\": \"monthly\",\n  \"transaction_limit\": 500,\n  \"user_id\": \"user_xxxxxxxxxxxxxx\"\n}")

	req, _ := http.NewRequest("PATCH", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.patch("https://api.whop.com/api/v1/cards/{id}")
  .header("Authorization", "Bearer <token>")
  .header("Content-Type", "application/json")
  .body("{\n  \"account_id\": \"biz_xxxxxxxxxxxxxx\",\n  \"canceled\": true,\n  \"cardholder\": {\n    \"email\": \"marcus@shinetime.example\",\n    \"first_name\": \"Tanya\",\n    \"last_name\": \"Cole\",\n    \"phone\": \"+xxxxxxxxxxx\"\n  },\n  \"frozen\": true,\n  \"name\": \"Detailing supplies\",\n  \"pin\": \"1234\",\n  \"remove_limit\": true,\n  \"spend_limit\": 2500,\n  \"spend_limit_frequency\": \"monthly\",\n  \"transaction_limit\": 500,\n  \"user_id\": \"user_xxxxxxxxxxxxxx\"\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://api.whop.com/api/v1/cards/{id}")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Patch.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"account_id\": \"biz_xxxxxxxxxxxxxx\",\n  \"canceled\": true,\n  \"cardholder\": {\n    \"email\": \"marcus@shinetime.example\",\n    \"first_name\": \"Tanya\",\n    \"last_name\": \"Cole\",\n    \"phone\": \"+xxxxxxxxxxx\"\n  },\n  \"frozen\": true,\n  \"name\": \"Detailing supplies\",\n  \"pin\": \"1234\",\n  \"remove_limit\": true,\n  \"spend_limit\": 2500,\n  \"spend_limit_frequency\": \"monthly\",\n  \"transaction_limit\": 500,\n  \"user_id\": \"user_xxxxxxxxxxxxxx\"\n}"

response = http.request(request)
puts response.read_body

{
  "billing": {
    "city": "Austin",
    "country_code": "US",
    "line1": "4180 Burnet Rd",
    "line2": "Suite 210",
    "postal_code": "78756",
    "region": "TX"
  },
  "canceled_at": "2026-01-01T12:00:00.000Z",
  "created_at": "2026-01-01T12:00:00.000Z",
  "expiration_month": "12",
  "expiration_year": "2027",
  "id": "icrd_xxxxxxxxxxxxxx",
  "last4": "4242",
  "limit": {
    "amount": 50,
    "frequency": "daily"
  },
  "name": "Detailing supplies",
  "object": "card",
  "spent_last_month": 1234,
  "status": "active",
  "type": "virtual",
  "user_id": "user_xxxxxxxxxxxxxx",
  "secrets": {
    "card_number": "<string>",
    "cvc": "<string>",
    "name_on_card": "<string>",
    "pin": "<string>"
  }
}

{
  "error": {
    "message": "account_id is required",
    "type": "bad_request",
    "code": "<string>"
  }
}

{
  "error": {
    "message": "account_id is required",
    "type": "bad_request",
    "code": "<string>"
  }
}

{
  "error": {
    "message": "account_id is required",
    "type": "bad_request",
    "code": "<string>"
  }
}

{
  "error": {
    "message": "account_id is required",
    "type": "bad_request",
    "code": "<string>"
  }
}

PATCH

cards

{id}

TypeScript

import { WhopClient } from "@whop/sdk";

const client = new WhopClient({ token: "YOUR_TOKEN", apiVersionDate: "2026-08-21-1", idempotencyKey: "YOUR_IDEMPOTENCY_KEY" });
await client.cards.update({
    id: "id"
});

curl --request PATCH \
  --url https://api.whop.com/api/v1/cards/{id} \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "account_id": "biz_xxxxxxxxxxxxxx",
  "canceled": true,
  "cardholder": {
    "email": "marcus@shinetime.example",
    "first_name": "Tanya",
    "last_name": "Cole",
    "phone": "+xxxxxxxxxxx"
  },
  "frozen": true,
  "name": "Detailing supplies",
  "pin": "1234",
  "remove_limit": true,
  "spend_limit": 2500,
  "spend_limit_frequency": "monthly",
  "transaction_limit": 500,
  "user_id": "user_xxxxxxxxxxxxxx"
}
'

import requests

url = "https://api.whop.com/api/v1/cards/{id}"

payload = {
    "account_id": "biz_xxxxxxxxxxxxxx",
    "canceled": True,
    "cardholder": {
        "email": "marcus@shinetime.example",
        "first_name": "Tanya",
        "last_name": "Cole",
        "phone": "+xxxxxxxxxxx"
    },
    "frozen": True,
    "name": "Detailing supplies",
    "pin": "1234",
    "remove_limit": True,
    "spend_limit": 2500,
    "spend_limit_frequency": "monthly",
    "transaction_limit": 500,
    "user_id": "user_xxxxxxxxxxxxxx"
}
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.patch(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'PATCH',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: JSON.stringify({
    account_id: 'biz_xxxxxxxxxxxxxx',
    canceled: true,
    cardholder: {
      email: 'marcus@shinetime.example',
      first_name: 'Tanya',
      last_name: 'Cole',
      phone: '+xxxxxxxxxxx'
    },
    frozen: true,
    name: 'Detailing supplies',
    pin: '1234',
    remove_limit: true,
    spend_limit: 2500,
    spend_limit_frequency: 'monthly',
    transaction_limit: 500,
    user_id: 'user_xxxxxxxxxxxxxx'
  })
};

fetch('https://api.whop.com/api/v1/cards/{id}', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.whop.com/api/v1/cards/{id}",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "PATCH",
  CURLOPT_POSTFIELDS => json_encode([
    'account_id' => 'biz_xxxxxxxxxxxxxx',
    'canceled' => true,
    'cardholder' => [
        'email' => 'marcus@shinetime.example',
        'first_name' => 'Tanya',
        'last_name' => 'Cole',
        'phone' => '+xxxxxxxxxxx'
    ],
    'frozen' => true,
    'name' => 'Detailing supplies',
    'pin' => '1234',
    'remove_limit' => true,
    'spend_limit' => 2500,
    'spend_limit_frequency' => 'monthly',
    'transaction_limit' => 500,
    'user_id' => 'user_xxxxxxxxxxxxxx'
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.whop.com/api/v1/cards/{id}"

	payload := strings.NewReader("{\n  \"account_id\": \"biz_xxxxxxxxxxxxxx\",\n  \"canceled\": true,\n  \"cardholder\": {\n    \"email\": \"marcus@shinetime.example\",\n    \"first_name\": \"Tanya\",\n    \"last_name\": \"Cole\",\n    \"phone\": \"+xxxxxxxxxxx\"\n  },\n  \"frozen\": true,\n  \"name\": \"Detailing supplies\",\n  \"pin\": \"1234\",\n  \"remove_limit\": true,\n  \"spend_limit\": 2500,\n  \"spend_limit_frequency\": \"monthly\",\n  \"transaction_limit\": 500,\n  \"user_id\": \"user_xxxxxxxxxxxxxx\"\n}")

	req, _ := http.NewRequest("PATCH", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.patch("https://api.whop.com/api/v1/cards/{id}")
  .header("Authorization", "Bearer <token>")
  .header("Content-Type", "application/json")
  .body("{\n  \"account_id\": \"biz_xxxxxxxxxxxxxx\",\n  \"canceled\": true,\n  \"cardholder\": {\n    \"email\": \"marcus@shinetime.example\",\n    \"first_name\": \"Tanya\",\n    \"last_name\": \"Cole\",\n    \"phone\": \"+xxxxxxxxxxx\"\n  },\n  \"frozen\": true,\n  \"name\": \"Detailing supplies\",\n  \"pin\": \"1234\",\n  \"remove_limit\": true,\n  \"spend_limit\": 2500,\n  \"spend_limit_frequency\": \"monthly\",\n  \"transaction_limit\": 500,\n  \"user_id\": \"user_xxxxxxxxxxxxxx\"\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://api.whop.com/api/v1/cards/{id}")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Patch.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"account_id\": \"biz_xxxxxxxxxxxxxx\",\n  \"canceled\": true,\n  \"cardholder\": {\n    \"email\": \"marcus@shinetime.example\",\n    \"first_name\": \"Tanya\",\n    \"last_name\": \"Cole\",\n    \"phone\": \"+xxxxxxxxxxx\"\n  },\n  \"frozen\": true,\n  \"name\": \"Detailing supplies\",\n  \"pin\": \"1234\",\n  \"remove_limit\": true,\n  \"spend_limit\": 2500,\n  \"spend_limit_frequency\": \"monthly\",\n  \"transaction_limit\": 500,\n  \"user_id\": \"user_xxxxxxxxxxxxxx\"\n}"

response = http.request(request)
puts response.read_body

{
  "billing": {
    "city": "Austin",
    "country_code": "US",
    "line1": "4180 Burnet Rd",
    "line2": "Suite 210",
    "postal_code": "78756",
    "region": "TX"
  },
  "canceled_at": "2026-01-01T12:00:00.000Z",
  "created_at": "2026-01-01T12:00:00.000Z",
  "expiration_month": "12",
  "expiration_year": "2027",
  "id": "icrd_xxxxxxxxxxxxxx",
  "last4": "4242",
  "limit": {
    "amount": 50,
    "frequency": "daily"
  },
  "name": "Detailing supplies",
  "object": "card",
  "spent_last_month": 1234,
  "status": "active",
  "type": "virtual",
  "user_id": "user_xxxxxxxxxxxxxx",
  "secrets": {
    "card_number": "<string>",
    "cvc": "<string>",
    "name_on_card": "<string>",
    "pin": "<string>"
  }
}

{
  "error": {
    "message": "account_id is required",
    "type": "bad_request",
    "code": "<string>"
  }
}

{
  "error": {
    "message": "account_id is required",
    "type": "bad_request",
    "code": "<string>"
  }
}

{
  "error": {
    "message": "account_id is required",
    "type": "bad_request",
    "code": "<string>"
  }
}

{
  "error": {
    "message": "account_id is required",
    "type": "bad_request",
    "code": "<string>"
  }
}

Authorizations

Authorization

string

header

required

An Account API key, account-scoped JWT, App API key, or user OAuth token. Prepend the key or token with Bearer, for example Bearer ***************************.

Headers

Api-Version-Date

string

Pins the request to a dated API version.

Example:

"2026-09-15"

Path Parameters

string

required

Card ID to retrieve, prefixed icrd_.

Body

application/json

account_id

string

The owning account ID (a biz_ identifier). Provide this or user_id.

Example:

"biz_xxxxxxxxxxxxxx"

billing

object

The billing address. On an issued card this replaces the card's billing address and region is also required. On an invited card, sending it as the invited user completes onboarding and starts card provisioning.

Show child attributes

canceled

boolean

Pass true to permanently cancel the card. A canceled card cannot be uncanceled. Cannot be combined with other fields.

Example:

true

cardholder

object

Details for the invited cardholder, accepted only while completing onboarding on an invited card. The legal name comes from an approved identity verification when the invited user has one, and from these fields when they do not.

Show child attributes

frozen

boolean

Pass true to freeze the card, false to unfreeze it. The assigned cardholder may freeze their own card without the payout:account:update scope.

Example:

true

name

string

A display name for the card.

Example:

"Detailing supplies"

string

New 4-digit PIN. Can only be set on a card assigned to the acting user, who may set it without the payout:account:update scope.

Example:

"1234"

remove_limit

boolean

Pass true to remove the spending limit (make the card unlimited).

Example:

true

spend_limit

number

Spending limit amount, in dollars.

Example:

2500

spend_limit_frequency

enum<string>

The window the spend limit applies to.

Available options:

daily,

weekly,

monthly,

one_time

Example:

"monthly"

transaction_limit

number

Per-transaction limit amount, in dollars.

Example:

500

user_id

string

The owning user ID (a user_ identifier). Provide this or account_id.

Example:

"user_xxxxxxxxxxxxxx"

Response

invited card onboarding completed: card provisioning started

billing

object | null

required

The billing address.

Show child attributes

canceled_at

string<date-time> | null

required

When the card was canceled.

Example:

"2026-01-01T12:00:00.000Z"

created_at

string<date-time> | null

required

When the card was created.

Example:

"2026-01-01T12:00:00.000Z"

expiration_month

string | null

required

Card expiration month.

Example:

"12"

expiration_year

string | null

required

Card expiration year.

Example:

"2027"

string

required

Card ID, prefixed icrd_.

Example:

"icrd_xxxxxxxxxxxxxx"

last4

string | null

required

Last four digits of the card number. null for pending invitation cards.

Example:

"4242"

limit

object | null

required

The spending limit configuration.

Show child attributes

name

string | null

required

Card display name.

Example:

"Detailing supplies"

object

enum<string>

required

Available options:

card

Example:

"card"

spent_last_month

integer | null

required

Total spend in the last 30 days, in cents.

Example:

1234

status

enum<string> | null

required

The card status. denied means the issuer declined the cardholder, so the card will never be issued.

Available options:

null,

active,

frozen,

canceled,

invited,

denied

Example:

"active"

type

enum<string> | null

required

The card type.

Available options:

null,

virtual,

physical

Example:

"virtual"

user_id

string | null

required

Cardholder user ID, prefixed user_, when assigned.

Example:

"user_xxxxxxxxxxxxxx"

secrets

object | null

Sensitive card details. Present only on GET /cards/:id for active cards; null when the card is inactive or details cannot be retrieved.

Show child attributes

Introduction

Reference

Webhooks & Events

Core Resources

Notifications

Payments

Money

Commerce

Partners

Workforce

Tracking

Ads

Media

Identity

Developer

Authorizations

Headers

Path Parameters

Body

Response