Get Spend Rules by Card

This endpoint returns all spend rules and velocity rules that are attached to a given payment card. The response includes amount limit rules, merchant category rules, merchant country rules, and velocity (time-windowed) rules. Use this endpoint to audit the spending controls in effect for any card before making changes or troubleshooting declined transactions.

Endpoint

GET /api/spendRules/v2/byCard

Authentication

Bearer token required. Obtain via:

POST https://api.banking.netevia.dev/api/auth/v2

Include in header: Authorization: Bearer {token} Token lifetime: 10 minutes. Refresh via POST /api/auth/refresh.

When to use

Use this endpoint when you need to inspect the spending controls currently active on a payment card — for example, before adding or removing a rule, when diagnosing a declined transaction, or when displaying card restrictions in a partner-facing dashboard. This is the primary read endpoint for card-level spend rule management.

Query Parameters

Response

200 OK

{
  "attachedSpendRules": [
    {
      "id": "sr_abc123",
      "name": "Max Per Transaction",
      "version": "1",
      "createdAt": "2024-01-15T10:00:00Z",
      "updatedAt": "2024-03-01T08:30:00Z",
      "spendRuleType": 1,
      "maximumAmount": {
        "value": 50000,
        "currencyCode": "USD"
      },
      "merchantCategoryAllowed": null,
      "merchantCategoryBlocked": null,
      "merchantCountryAllowed": null,
      "merchantCountryBlocked": null
    },
    {
      "id": "sr_def456",
      "name": "Block Gambling",
      "version": "1",
      "createdAt": "2024-01-15T10:00:00Z",
      "updatedAt": null,
      "spendRuleType": 2,
      "maximumAmount": null,
      "merchantCategoryAllowed": null,
      "merchantCategoryBlocked": [
        "BETTING_CASINO_GAMBLING",
        "GOVERNMENT_LICENSED_ON_LINE_CASINO"
      ],
      "merchantCountryAllowed": null,
      "merchantCountryBlocked": null
    }
  ],
  "attachedVelocityRules": [
    {
      "id": "vr_ghi789",
      "name": "Monthly Spend Cap",
      "velocityRuleWindow": 2,
      "cumulativeRule": {
        "id": "sr_xyz001",
        "name": "Monthly Max",
        "version": "1",
        "createdAt": "2024-01-15T10:00:00Z",
        "updatedAt": null,
        "spendRuleType": 1,
        "maximumAmount": {
          "value": 500000,
          "currencyCode": "USD"
        },
        "merchantCategoryAllowed": null,
        "merchantCategoryBlocked": null,
        "merchantCountryAllowed": null,
        "merchantCountryBlocked": null
      },
      "spendRules": [],
      "errors": null
    }
  ]
}

Error Codes

Common Mistakes

• Omitting paymentCardId from the query string — the parameter is required even though the schema marks it without an explicit required: true flag; the API will return an error or empty result without it.
• Interpreting maximumAmount.value as a decimal dollar amount — values are in the smallest currency unit (cents for USD), so 50000 equals $500.00.
• Assuming merchantCategoryAllowed being null means all categories are allowed — an empty or null allowed list combined with a non-empty blocked list means all categories are allowed except those explicitly blocked.
• Confusing velocityRuleWindow integer codes: 0 = daily, 1 = weekly, 2 = monthly.
• Using a card ID from a different partner's environment — card IDs are scoped to the partner; sandbox IDs will not work in production and vice versa.

Related Endpoints

• GET /api/spendRules/v2/byProfile — Retrieve spend rules attached to a customer profile rather than a specific card.
• POST /api/spendRules/v2 — Create a new spend rule.
• POST /api/spendRules/v2/attachToCard — Attach an existing spend rule to a payment card.
• DELETE /api/spendRules/v2/detachFromCard — Remove a spend rule from a payment card.

Example

curl -X GET "https://api.banking.netevia.dev/api/spendRules/v2/byCard?paymentCardId=card_abc123xyz" \
  -H "Authorization: Bearer YOUR_TOKEN" \
  -H "Content-Type: application/json"