POST/cards/{cardId}/block

Block / Cancel Card

Blocks the card and places a cancellation request. For blocking or cancelling the card, BlockReason is mandatory.

What happens immediately:

Card transactions are suspended right away, so the card cannot be used.
A cancellation request is created.

Once the card is fully blocked or cancelled, partners receive a CARD_STATUS_CHANGED webhook.

bash

curl -X POST "{{API_BASE_URL}}/cards/{{cardId}}/block" \
  -H "session-token: {{sessionToken}}" \
  -H "Content-Type: application/json" \
  -d "{\"BlockReason\": \"LOST\"}"

Path variables

Field	Type	Required	Possible values	Description
`cardId`	string	Required	55d0c52f-79ee-4d38-acf4-a16c07957898	Card reference ID from list cards.

Headers

Field	Type	Required	Possible values	Description
`session-token`	string	Required	—	SessionToken obtained from the Create GMA Session endpoint. All secured endpoints require this header.

Request body

Field	Type	Required	Possible values	Description
`BlockReason`	string	Required	LOST \| STOLEN \| FRAUD \| CUSTOMER_REQUESTED_CLOSE	Reason for the block / cancellation request. Use `GET /cards/block-reasons` for the dropdown values.

Example request

{
  "BlockReason": "LOST"
}

{
  "BlockReason": "LOST"
}

`BlockReason` is mandatory. Request body must use PascalCase (`BlockReason`); camelCase is not accepted.

Additional info

Field	Type	Required	Possible values	Description
`400 — Invalid request`	object	Optional	—	Missing or invalid `BlockReason`, or invalid `cardId`.
`401 — Missing session`	object	Optional	—	Missing broker session.
`403 — No access`	object	Optional	—	Broker does not have access to this card.
`404 — Not found`	object	Optional	—	Card not found, customer not found, or card data record not found.
`500 — Unable to create request`	object	Optional	—	Unable to create the reissuance request.

Example— 400 — Invalid request

{
  "ResponseCode": 400,
  "ResponseMessage": "BadRequest",
  "ResponseData": null
}

{
  "ResponseCode": 400,
  "ResponseMessage": "BadRequest",
  "ResponseData": null
}

Example— 401 — Missing session

{
  "ResponseCode": 401,
  "ResponseMessage": "Unauthorized",
  "ResponseData": null
}

{
  "ResponseCode": 401,
  "ResponseMessage": "Unauthorized",
  "ResponseData": null
}

Example— 403 — No access

{
  "ResponseCode": 403,
  "ResponseMessage": "Forbidden",
  "ResponseData": null
}

{
  "ResponseCode": 403,
  "ResponseMessage": "Forbidden",
  "ResponseData": null
}

Example— 404 — Not found

{
  "ResponseCode": 404,
  "ResponseMessage": "NotFound",
  "ResponseData": null
}

{
  "ResponseCode": 404,
  "ResponseMessage": "NotFound",
  "ResponseData": null
}

Example— 500 — Unable to create request

{
  "ResponseCode": 500,
  "ResponseMessage": "InternalServerError",
  "ResponseData": null
}

{
  "ResponseCode": 500,
  "ResponseMessage": "InternalServerError",
  "ResponseData": null
}

Path param stays camelCase (`cardId`). Body and success `ResponseData` use PascalCase (`BlockReason`, `CardId`, `AtmEnabled`, `TransactionSuspended`).

Response

Field	Type	Possible values	Description
`ResponseCode`	integer	200 \| 201 \| 204 \| 301 \| 400 \| 401 \| 403 \| 404 \| 410 \| 422 \| 500 \| 503	API result code in the response envelope. Indicates success or the error category (e.g. 200 success, 400 bad request, 401 unauthorized).
`ResponseMessage`	string	Success \| Created \| NoContent \| BadRequest \| Unauthorized \| Forbidden \| NotFound \| Gone \| UnprocessableContent \| ServerError \| ResourceMoved \| ServiceUnAvailable \| UnProcessableEntity	Human-readable label paired with ResponseCode (e.g. Success, BadRequest, Unauthorized). Use with ResponseCode to interpret the outcome.
`ResponseData`	object	Please refer to below example for response body	Card state after the block. On success the API creates a pending cancellation request and, in the same save, denies card transactions and disables ATM. Use this payload to render the page without a follow-up fetch.
`ResponseData.CardId`	string	—	Card Reference Id that was blocked.
`ResponseData.BlockReason`	string	—	Normalized reason recorded on the reissuance request.
`ResponseData.Message`	string	—	`"Card blocked successfully"`.
`ResponseData.CardStatus`	string \| null	—	Card status label after the block (e.g. `Active`).
`ResponseData.CardStatusCode`	string \| null	—	Card status internal name after the block (e.g. `active`).
`ResponseData.AtmEnabled`	boolean	—	ATM usage after the block. `false` once the block is applied.
`ResponseData.TransactionSuspended`	boolean	—	Spend suspension after the block. `true` once the block is applied.

Example response

{
  "ResponseCode": 200,
  "ResponseMessage": "Success",
  "ResponseData": {
    "CardId": "389243c6-da0f-4031-9c69-849bfca2b4d5",
    "BlockReason": "LOST",
    "Message": "Card blocked successfully",
    "CardStatus": "Active",
    "CardStatusCode": "active",
    "AtmEnabled": false,
    "TransactionSuspended": true
  }
}

{
  "ResponseCode": 200,
  "ResponseMessage": "Success",
  "ResponseData": {
    "CardId": "389243c6-da0f-4031-9c69-849bfca2b4d5",
    "BlockReason": "LOST",
    "Message": "Card blocked successfully",
    "CardStatus": "Active",
    "CardStatusCode": "active",
    "AtmEnabled": false,
    "TransactionSuspended": true
  }
}

Requires `session-token: {SessionToken}` from Create GMA Session. Use the same client IP as authentication.