Update Card - UQPAY Developer Docs

Update Card

curl --request POST \
  --url https://api-sandbox.uqpaytech.com/api/v1/issuing/cards/{id} \
  --header 'Content-Type: application/json' \
  --header 'x-auth-token: <api-key>' \
  --header 'x-idempotency-key: <x-idempotency-key>' \
  --data '
{
  "card_limit": 2100.02,
  "name_on_card": "MARSHALL HU",
  "no_pin_payment_amount": 100,
  "spending_controls": [
    {
      "amount": 100.03,
      "interval": "PER_TRANSACTION"
    }
  ],
  "risk_controls": {
    "enable_3ds": "Y",
    "allow_3ds_transactions": "Y",
    "allowed_mcc": null,
    "blocked_mcc": [
      "5999",
      "6011"
    ]
  },
  "metadata": {
    "key1": "value1",
    "key2": "value2"
  },
  "card_art_id": "01KD52BKQWDMFF63R1NNQN7A79"
}
'

import requests

url = "https://api-sandbox.uqpaytech.com/api/v1/issuing/cards/{id}"

payload = {
    "card_limit": 2100.02,
    "name_on_card": "MARSHALL HU",
    "no_pin_payment_amount": 100,
    "spending_controls": [
        {
            "amount": 100.03,
            "interval": "PER_TRANSACTION"
        }
    ],
    "risk_controls": {
        "enable_3ds": "Y",
        "allow_3ds_transactions": "Y",
        "allowed_mcc": None,
        "blocked_mcc": ["5999", "6011"]
    },
    "metadata": {
        "key1": "value1",
        "key2": "value2"
    },
    "card_art_id": "01KD52BKQWDMFF63R1NNQN7A79"
}
headers = {
    "x-idempotency-key": "<x-idempotency-key>",
    "x-auth-token": "<api-key>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {
    'x-idempotency-key': '<x-idempotency-key>',
    'x-auth-token': '<api-key>',
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({
    card_limit: 2100.02,
    name_on_card: 'MARSHALL HU',
    no_pin_payment_amount: 100,
    spending_controls: [{amount: 100.03, interval: 'PER_TRANSACTION'}],
    risk_controls: {
      enable_3ds: 'Y',
      allow_3ds_transactions: 'Y',
      allowed_mcc: null,
      blocked_mcc: ['5999', '6011']
    },
    metadata: {key1: 'value1', key2: 'value2'},
    card_art_id: '01KD52BKQWDMFF63R1NNQN7A79'
  })
};

fetch('https://api-sandbox.uqpaytech.com/api/v1/issuing/cards/{id}', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api-sandbox.uqpaytech.com/api/v1/issuing/cards/{id}",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'card_limit' => 2100.02,
    'name_on_card' => 'MARSHALL HU',
    'no_pin_payment_amount' => 100,
    'spending_controls' => [
        [
                'amount' => 100.03,
                'interval' => 'PER_TRANSACTION'
        ]
    ],
    'risk_controls' => [
        'enable_3ds' => 'Y',
        'allow_3ds_transactions' => 'Y',
        'allowed_mcc' => null,
        'blocked_mcc' => [
                '5999',
                '6011'
        ]
    ],
    'metadata' => [
        'key1' => 'value1',
        'key2' => 'value2'
    ],
    'card_art_id' => '01KD52BKQWDMFF63R1NNQN7A79'
  ]),
  CURLOPT_HTTPHEADER => [
    "Content-Type: application/json",
    "x-auth-token: <api-key>",
    "x-idempotency-key: <x-idempotency-key>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api-sandbox.uqpaytech.com/api/v1/issuing/cards/{id}"

	payload := strings.NewReader("{\n  \"card_limit\": 2100.02,\n  \"name_on_card\": \"MARSHALL HU\",\n  \"no_pin_payment_amount\": 100,\n  \"spending_controls\": [\n    {\n      \"amount\": 100.03,\n      \"interval\": \"PER_TRANSACTION\"\n    }\n  ],\n  \"risk_controls\": {\n    \"enable_3ds\": \"Y\",\n    \"allow_3ds_transactions\": \"Y\",\n    \"allowed_mcc\": null,\n    \"blocked_mcc\": [\n      \"5999\",\n      \"6011\"\n    ]\n  },\n  \"metadata\": {\n    \"key1\": \"value1\",\n    \"key2\": \"value2\"\n  },\n  \"card_art_id\": \"01KD52BKQWDMFF63R1NNQN7A79\"\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("x-idempotency-key", "<x-idempotency-key>")
	req.Header.Add("x-auth-token", "<api-key>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://api-sandbox.uqpaytech.com/api/v1/issuing/cards/{id}")
  .header("x-idempotency-key", "<x-idempotency-key>")
  .header("x-auth-token", "<api-key>")
  .header("Content-Type", "application/json")
  .body("{\n  \"card_limit\": 2100.02,\n  \"name_on_card\": \"MARSHALL HU\",\n  \"no_pin_payment_amount\": 100,\n  \"spending_controls\": [\n    {\n      \"amount\": 100.03,\n      \"interval\": \"PER_TRANSACTION\"\n    }\n  ],\n  \"risk_controls\": {\n    \"enable_3ds\": \"Y\",\n    \"allow_3ds_transactions\": \"Y\",\n    \"allowed_mcc\": null,\n    \"blocked_mcc\": [\n      \"5999\",\n      \"6011\"\n    ]\n  },\n  \"metadata\": {\n    \"key1\": \"value1\",\n    \"key2\": \"value2\"\n  },\n  \"card_art_id\": \"01KD52BKQWDMFF63R1NNQN7A79\"\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://api-sandbox.uqpaytech.com/api/v1/issuing/cards/{id}")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["x-idempotency-key"] = '<x-idempotency-key>'
request["x-auth-token"] = '<api-key>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"card_limit\": 2100.02,\n  \"name_on_card\": \"MARSHALL HU\",\n  \"no_pin_payment_amount\": 100,\n  \"spending_controls\": [\n    {\n      \"amount\": 100.03,\n      \"interval\": \"PER_TRANSACTION\"\n    }\n  ],\n  \"risk_controls\": {\n    \"enable_3ds\": \"Y\",\n    \"allow_3ds_transactions\": \"Y\",\n    \"allowed_mcc\": null,\n    \"blocked_mcc\": [\n      \"5999\",\n      \"6011\"\n    ]\n  },\n  \"metadata\": {\n    \"key1\": \"value1\",\n    \"key2\": \"value2\"\n  },\n  \"card_art_id\": \"01KD52BKQWDMFF63R1NNQN7A79\"\n}"

response = http.request(request)
puts response.read_body

{
  "card_id": "c0cef051-29c5-4796-b86a-cd5b684bfad7",
  "card_order_id": "c0cef051-29c5-4796-b86a-cd5ee34bfad7",
  "card_status": "ACTIVE",
  "order_status": "SUCCESS"
}

POST

issuing

cards

{id}

Update Card

curl --request POST \
  --url https://api-sandbox.uqpaytech.com/api/v1/issuing/cards/{id} \
  --header 'Content-Type: application/json' \
  --header 'x-auth-token: <api-key>' \
  --header 'x-idempotency-key: <x-idempotency-key>' \
  --data '
{
  "card_limit": 2100.02,
  "name_on_card": "MARSHALL HU",
  "no_pin_payment_amount": 100,
  "spending_controls": [
    {
      "amount": 100.03,
      "interval": "PER_TRANSACTION"
    }
  ],
  "risk_controls": {
    "enable_3ds": "Y",
    "allow_3ds_transactions": "Y",
    "allowed_mcc": null,
    "blocked_mcc": [
      "5999",
      "6011"
    ]
  },
  "metadata": {
    "key1": "value1",
    "key2": "value2"
  },
  "card_art_id": "01KD52BKQWDMFF63R1NNQN7A79"
}
'

import requests

url = "https://api-sandbox.uqpaytech.com/api/v1/issuing/cards/{id}"

payload = {
    "card_limit": 2100.02,
    "name_on_card": "MARSHALL HU",
    "no_pin_payment_amount": 100,
    "spending_controls": [
        {
            "amount": 100.03,
            "interval": "PER_TRANSACTION"
        }
    ],
    "risk_controls": {
        "enable_3ds": "Y",
        "allow_3ds_transactions": "Y",
        "allowed_mcc": None,
        "blocked_mcc": ["5999", "6011"]
    },
    "metadata": {
        "key1": "value1",
        "key2": "value2"
    },
    "card_art_id": "01KD52BKQWDMFF63R1NNQN7A79"
}
headers = {
    "x-idempotency-key": "<x-idempotency-key>",
    "x-auth-token": "<api-key>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {
    'x-idempotency-key': '<x-idempotency-key>',
    'x-auth-token': '<api-key>',
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({
    card_limit: 2100.02,
    name_on_card: 'MARSHALL HU',
    no_pin_payment_amount: 100,
    spending_controls: [{amount: 100.03, interval: 'PER_TRANSACTION'}],
    risk_controls: {
      enable_3ds: 'Y',
      allow_3ds_transactions: 'Y',
      allowed_mcc: null,
      blocked_mcc: ['5999', '6011']
    },
    metadata: {key1: 'value1', key2: 'value2'},
    card_art_id: '01KD52BKQWDMFF63R1NNQN7A79'
  })
};

fetch('https://api-sandbox.uqpaytech.com/api/v1/issuing/cards/{id}', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api-sandbox.uqpaytech.com/api/v1/issuing/cards/{id}",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'card_limit' => 2100.02,
    'name_on_card' => 'MARSHALL HU',
    'no_pin_payment_amount' => 100,
    'spending_controls' => [
        [
                'amount' => 100.03,
                'interval' => 'PER_TRANSACTION'
        ]
    ],
    'risk_controls' => [
        'enable_3ds' => 'Y',
        'allow_3ds_transactions' => 'Y',
        'allowed_mcc' => null,
        'blocked_mcc' => [
                '5999',
                '6011'
        ]
    ],
    'metadata' => [
        'key1' => 'value1',
        'key2' => 'value2'
    ],
    'card_art_id' => '01KD52BKQWDMFF63R1NNQN7A79'
  ]),
  CURLOPT_HTTPHEADER => [
    "Content-Type: application/json",
    "x-auth-token: <api-key>",
    "x-idempotency-key: <x-idempotency-key>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api-sandbox.uqpaytech.com/api/v1/issuing/cards/{id}"

	payload := strings.NewReader("{\n  \"card_limit\": 2100.02,\n  \"name_on_card\": \"MARSHALL HU\",\n  \"no_pin_payment_amount\": 100,\n  \"spending_controls\": [\n    {\n      \"amount\": 100.03,\n      \"interval\": \"PER_TRANSACTION\"\n    }\n  ],\n  \"risk_controls\": {\n    \"enable_3ds\": \"Y\",\n    \"allow_3ds_transactions\": \"Y\",\n    \"allowed_mcc\": null,\n    \"blocked_mcc\": [\n      \"5999\",\n      \"6011\"\n    ]\n  },\n  \"metadata\": {\n    \"key1\": \"value1\",\n    \"key2\": \"value2\"\n  },\n  \"card_art_id\": \"01KD52BKQWDMFF63R1NNQN7A79\"\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("x-idempotency-key", "<x-idempotency-key>")
	req.Header.Add("x-auth-token", "<api-key>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://api-sandbox.uqpaytech.com/api/v1/issuing/cards/{id}")
  .header("x-idempotency-key", "<x-idempotency-key>")
  .header("x-auth-token", "<api-key>")
  .header("Content-Type", "application/json")
  .body("{\n  \"card_limit\": 2100.02,\n  \"name_on_card\": \"MARSHALL HU\",\n  \"no_pin_payment_amount\": 100,\n  \"spending_controls\": [\n    {\n      \"amount\": 100.03,\n      \"interval\": \"PER_TRANSACTION\"\n    }\n  ],\n  \"risk_controls\": {\n    \"enable_3ds\": \"Y\",\n    \"allow_3ds_transactions\": \"Y\",\n    \"allowed_mcc\": null,\n    \"blocked_mcc\": [\n      \"5999\",\n      \"6011\"\n    ]\n  },\n  \"metadata\": {\n    \"key1\": \"value1\",\n    \"key2\": \"value2\"\n  },\n  \"card_art_id\": \"01KD52BKQWDMFF63R1NNQN7A79\"\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://api-sandbox.uqpaytech.com/api/v1/issuing/cards/{id}")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["x-idempotency-key"] = '<x-idempotency-key>'
request["x-auth-token"] = '<api-key>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"card_limit\": 2100.02,\n  \"name_on_card\": \"MARSHALL HU\",\n  \"no_pin_payment_amount\": 100,\n  \"spending_controls\": [\n    {\n      \"amount\": 100.03,\n      \"interval\": \"PER_TRANSACTION\"\n    }\n  ],\n  \"risk_controls\": {\n    \"enable_3ds\": \"Y\",\n    \"allow_3ds_transactions\": \"Y\",\n    \"allowed_mcc\": null,\n    \"blocked_mcc\": [\n      \"5999\",\n      \"6011\"\n    ]\n  },\n  \"metadata\": {\n    \"key1\": \"value1\",\n    \"key2\": \"value2\"\n  },\n  \"card_art_id\": \"01KD52BKQWDMFF63R1NNQN7A79\"\n}"

response = http.request(request)
puts response.read_body

{
  "card_id": "c0cef051-29c5-4796-b86a-cd5b684bfad7",
  "card_order_id": "c0cef051-29c5-4796-b86a-cd5ee34bfad7",
  "card_status": "ACTIVE",
  "order_status": "SUCCESS"
}

Authorizations

x-auth-token

string

header

required

The API token for login provided by UQPay.

Headers

x-on-behalf-of

string

Specifies the sub-account on whose behalf the request is made. This should be set to the account_id, which can be retrieved via the List Connected Accounts endpoint. If omitted or empty, the request is executed using the master account. More information at Connected Accounts.

x-idempotency-key

string<uuid>

required

A unique identifier (UUID) used to maintain operation idempotency, ensuring that repeated executions of the same operation do not result in unintended effects or duplication. It helps preserve data consistency in the face of network errors, retries, or failures.

Path Parameters

string<uuid>

required

Universally unique identifier (UUID v4) of a resource.

Example:

"71fdb0fe-9682-457a-9361-e8868694f12f"

Body

application/json

card_limit

number

The total credit limit assigned to the card, currency refer to card_currency. This is not a cumulative balance, but a fixed credit limit similar to that of a credit card.

Leave empty when card mode_type is SINGLE.

Required range: x >= 0

Example:

2100.02

name_on_card

string

The cardholder name shown on the card. When the Secure Iframe renders the cardholder name (cardholder_name=true), this value is used as the default; if omitted, the iframe falls back to first_name + last_name from the cardholder record.

Maximum string length: 26

Example:

"MARSHALL HU"

no_pin_payment_amount

number

The allowable amount for card transactions without PIN verification. Default NO-PIN transaction amount applied when not explicitly set by the customer. Defaults to 200 SGD.

If you would like to opt-out from having any transactions without credentials or password, you may adjust the amount to zero (0).

Note: This setting is only applicable to Business Visa. See Card products and No-PIN payments for more information.

Required range: x >= 0

Example:

100

spending_controls

object[]

Rules that control spending for this card.

Show child attributes

risk_controls

object

User-customized risk control settings.

Supported configurations depend on the card product. See Card products for the capability matrix.

Show child attributes

metadata

object

Any key-value object. Max length = 3200 bytes. This must be valid JSON data.

Show child attributes

Example:

{ "key1": "value1", "key2": "value2" }

card_art_id

string

Updates the card art on an existing card. Only allowed on VIRTUAL cards whose card_status and processing_status are both ACTIVE; the request is rejected otherwise.

Card-art updates are processed asynchronously — the response returns order_status: PROCESSING and the new card art takes effect after channel confirmation. The value must be a card art available to the issuing account; list available card arts via List card arts.

Example:

"01KD52BKQWDMFF63R1NNQN7A79"

Response

200 - application/json

Card update successfully.

card_id

string

required

Unique identifier for the card.

Example:

"c0cef051-29c5-4796-b86a-cd5b684bfad7"

card_order_id

string

required

ID of the card order.

Example:

"c0cef051-29c5-4796-b86a-cd5ee34bfad7"

card_status

enum<string>

required

Card status enum. See the Card lifecycle and statuses guide for more information.

PENDING: The request to create the card has been received and is under review.
ACTIVE: The request to create the card was successful and the card is ready to use.
FROZEN: All incoming authorization requests will be declined. The card can be reactivated to accept new authorizations.
BLOCKED: The card was blocked by UQPAY due to suspicious activity.
PRE_CANCEL: The card is scheduled for cancellation and is in a waiting period during which all incoming authorization requests are declined. It transitions to CANCELLED when the waiting period ends.
CANCELLED: The card cannot be reactivated from this state, all incoming authorization requests will be permanently declined.
LOST: The card has been reported as lost to UQPAY.
STOLEN: The card has been reported as stolen to UQPAY.
FAILED: The request to create a card using Create Card failed.

Available options:

PENDING,

ACTIVE,

FROZEN,

BLOCKED,

PRE_CANCEL,

CANCELLED,

LOST,

STOLEN,

FAILED

Example:

"ACTIVE"

order_status

enum<string>

required

This field will contain the status of the request after processing.

PENDING -The initial status of the order request.
PROCESSING - If this status shall be subject to webhooks notification.
SUCCESS - The final status of the order request is successful.
FAILED - The final status of the order request is failed.

Available options:

PENDING,

PROCESSING,

SUCCESS,

FAILED

Example:

"SUCCESS"

Retrieve card Update card status