Update provider limit policy

PATCH
/providers/{providerID}/limits

Update your provider’s default limit policy.

A body that changes no field returns 400. An explicit null on a dimension leaves that dimension unchanged, the same as omitting it.

Auth: API key or bearer token. Scoped to the calling provider.

Request
cURL
curl -X PATCH https://api.moov.money/providers/{providerID}/limits \
  -u "$MOOV_API_KEY_ID:$MOOV_API_KEY_SECRET" \
  -H "X-Moov-Version: v2026.10.00"
Responses
200 400 401 403 409 422
The request completed successfully.
{
  "policy": {
    "createdOn": "2026-08-31T12:00:00Z",
    "currency": "USD",
    "dailyAmount": {
      "currency": {
        "code": "USD",
        "decimalPlaces": 2
      },
      "value": "1000.00"
    },
    "dailySendCount": 10,
    "monthlyAmount": {
      "currency": {
        "code": "USD",
        "decimalPlaces": 2
      },
      "value": "10000.00"
    },
    "perTransactionAmount": {
      "currency": {
        "code": "USD",
        "decimalPlaces": 2
      },
      "value": "500.00"
    },
    "versionID": "ver_01HF5J9ZKQT4RXP8M2VYBN3D",
    "weeklyAmount": {
      "currency": {
        "code": "USD",
        "decimalPlaces": 2
      },
      "value": "2500.00"
    }
  }
}
Malformed request: the body or headers failed validation.
Response body application/problem+json
RFC 9457 Problem Details error body, served as application/problem+json. From v2026.10.00, every error response that has a body uses this schema.

type

string required
URI that tells you which problem occurred. Branch on this value; it never changes. Moov problem types look like https://api.moov.money/errors#<code> (for example invalid-request, idempotency-key-reused, or idempotency-request-in-progress). Treat the value as an opaque constant and do not fetch it. about:blank means the HTTP status code says everything there is to know.

title

string required
Short human-readable name of the problem type. Fixed per type; defaults to the HTTP status text.

status

integer<int32> required
The HTTP status code of this response.

detail

string
Human-readable explanation of this specific occurrence.

instance

string
URI reference that identifies this specific occurrence.

errors

array<object>
The request-body fields that failed validation. Present on validation errors only.
Show child attributes

errors[]

pointer

string required
RFC 6901 JSON Pointer to the field, using the public JSON field names. If the field is missing, the pointer shows where it belongs.

detail

string required
What is wrong with the field.
Authentication missing, invalid, or insufficient.
Authentication present but the action is forbidden for this principal/claim.
Returned when a version-producing mutation’s expectedVersionID is stale or omitted while a version exists. You re-read the resource and retry with the current version.
Response body application/problem+json
RFC 9457 Problem Details body of the 409 returned when a version-producing mutation’s expectedVersionID is stale. currentVersion is an extension member of the problem detail.

detail

string
Human-readable explanation of this specific occurrence.

type

string<enum> required
The problem type URI, always https://api.moov.money/errors#version-conflict.
Possible values: https://api.moov.money/errors#version-conflict

title

string required
Short human-readable name of the problem type.

status

integer<int32> required
The HTTP status code of this response, always 409.

currentVersion

string required
The current latest version ID; re-read before retrying.
The request was well-formed but couldn’t be processed (e.g. card declined).
Response body application/problem+json
RFC 9457 Problem Details error body, served as application/problem+json. From v2026.10.00, every error response that has a body uses this schema.

type

string required
URI that tells you which problem occurred. Branch on this value; it never changes. Moov problem types look like https://api.moov.money/errors#<code> (for example invalid-request, idempotency-key-reused, or idempotency-request-in-progress). Treat the value as an opaque constant and do not fetch it. about:blank means the HTTP status code says everything there is to know.

title

string required
Short human-readable name of the problem type. Fixed per type; defaults to the HTTP status text.

status

integer<int32> required
The HTTP status code of this response.

detail

string
Human-readable explanation of this specific occurrence.

instance

string
URI reference that identifies this specific occurrence.

errors

array<object>
The request-body fields that failed validation. Present on validation errors only.
Show child attributes

errors[]

pointer

string required
RFC 6901 JSON Pointer to the field, using the public JSON field names. If the field is missing, the pointer shows where it belongs.

detail

string required
What is wrong with the field.

Headers

X-Moov-Version

string
Set this header to the API version being targeted (e.g. v2026.10.00). When omitted, the server applies its default version.

Path parameters

providerID

string required
Your provider account ID.

Request

application/json
A partial update to the provider default policy: present dimensions change, absent leave unchanged. Send expectedVersionID from your latest read; omit only on bootstrap (first write for a provider with no policy yet).

expectedVersionID

string
The versionID from your latest read; omit only on bootstrap. A stale value returns a 409 version-conflict problem.

perTransactionAmount

object | null
Per-send amount ceiling. Omit or send null to leave unchanged.

dailyAmount

object | null
Trailing 24h amount ceiling. Omit or send null to leave unchanged.

weeklyAmount

object | null
Trailing 7d amount ceiling. Omit or send null to leave unchanged.

monthlyAmount

object | null
Trailing 30d amount ceiling. Omit or send null to leave unchanged.

dailySendCount

integer<int64> | null
Trailing 24h send-count ceiling. Omit or send null to leave unchanged.

Response

Response envelope for the provider limit policy; the policy is nested under policy.

policy

object required
The provider default limit policy.
Show child attributes

policy

currency

string required
Three-letter ISO 4217 currency the policy is denominated in (v1 USD-only).

perTransactionAmount

object
Per-send amount ceiling.
Show child attributes

policy.perTransactionAmount

value

string required
Decimal amount as a string.

currency

object required
ISO 4217 currency descriptor.
Show child attributes

policy.perTransactionAmount.currency

code

string required
Uppercase 3-letter ISO 4217 currency code.

decimalPlaces

integer<uint8> required
Number of minor-unit decimal places for code. Required.

numericCode

string
ISO 4217 numeric currency code, if known. Informational only.

name

string
Human-readable currency name, if known. Informational only.

dailyAmount

object
Trailing 24h amount ceiling.
Show child attributes

policy.dailyAmount

value

string required
Decimal amount as a string.

currency

object required
ISO 4217 currency descriptor.
Show child attributes

policy.dailyAmount.currency

code

string required
Uppercase 3-letter ISO 4217 currency code.

decimalPlaces

integer<uint8> required
Number of minor-unit decimal places for code. Required.

numericCode

string
ISO 4217 numeric currency code, if known. Informational only.

name

string
Human-readable currency name, if known. Informational only.

weeklyAmount

object
Trailing 7d amount ceiling.
Show child attributes

policy.weeklyAmount

value

string required
Decimal amount as a string.

currency

object required
ISO 4217 currency descriptor.
Show child attributes

policy.weeklyAmount.currency

code

string required
Uppercase 3-letter ISO 4217 currency code.

decimalPlaces

integer<uint8> required
Number of minor-unit decimal places for code. Required.

numericCode

string
ISO 4217 numeric currency code, if known. Informational only.

name

string
Human-readable currency name, if known. Informational only.

monthlyAmount

object
Trailing 30d amount ceiling.
Show child attributes

policy.monthlyAmount

value

string required
Decimal amount as a string.

currency

object required
ISO 4217 currency descriptor.
Show child attributes

policy.monthlyAmount.currency

code

string required
Uppercase 3-letter ISO 4217 currency code.

decimalPlaces

integer<uint8> required
Number of minor-unit decimal places for code. Required.

numericCode

string
ISO 4217 numeric currency code, if known. Informational only.

name

string
Human-readable currency name, if known. Informational only.

dailySendCount

integer<int64>
Trailing 24h send-count ceiling.

versionID

string required
Latest version ID; send this back as expectedVersionID on your next mutation.

createdOn

string<date-time> required
When this version was created.