GET/cards/{cardId}/limits

Get Card Limits

Returns purchase/ATM limits for a card. Cap values resolve: Card_Data (user-defined → base) → Card_Type → BIN. Remaining daily values are card-level only. Limit amounts are numbers with 2 decimal places (e.g. 17 or 17.5, not "17.000000000"). Missing or invalid values are null, not 0. Limits are read-only via this API (no update endpoint).

bash

curl -X GET "{{API_BASE_URL}}/cards/{{cardId}}/limits" \
  -H "session-token: {{sessionToken}}" \
  -H "Accept: application/json"

Path variables

Field	Type	Required	Possible values	Description
`cardId`	string	Required	55d0c52f-79ee-4d38-acf4-a16c07957898	Card reference ID from list cards.

Headers

Field	Type	Required	Possible values	Description
`session-token`	string	Required	—	SessionToken obtained from the Create GMA Session endpoint. All secured endpoints require this header.

Additional info

Field	Type	Required	Possible values	Description
`404 — Card not found`	object	Optional	—	cardId does not resolve to a card owned by this broker.
`403 — No access`	object	Optional	—	Broker does not own this card.

Example— 404 — Card not found

{
  "ResponseCode": 404,
  "ResponseMessage": "Card not found",
  "ResponseData": null
}

{
  "ResponseCode": 404,
  "ResponseMessage": "Card not found",
  "ResponseData": null
}

Example— 403 — No access

{
  "ResponseCode": 403,
  "ResponseMessage": "Broker does not have access to this card",
  "ResponseData": null
}

{
  "ResponseCode": 403,
  "ResponseMessage": "Broker does not have access to this card",
  "ResponseData": null
}

Path param stays camelCase (`cardId`). Response limit keys are PascalCase. Amounts are numbers (2 decimals), not strings.

Response

Field	Type	Possible values	Description
`ResponseCode`	integer	200 \| 201 \| 204 \| 301 \| 400 \| 401 \| 403 \| 404 \| 410 \| 422 \| 500 \| 503	API result code in the response envelope. Indicates success or the error category (e.g. 200 success, 400 bad request, 401 unauthorized).
`ResponseMessage`	string	Success \| Created \| NoContent \| BadRequest \| Unauthorized \| Forbidden \| NotFound \| Gone \| UnprocessableContent \| ServerError \| ResourceMoved \| ServiceUnAvailable \| UnProcessableEntity	Human-readable label paired with ResponseCode (e.g. Success, BadRequest, Unauthorized). Use with ResponseCode to interpret the outcome.
`ResponseData`	object	Please refer to below example for response body	Purchase and ATM limit snapshot. Values are numbers with 2 decimal places. Fields are `null` when not configured or invalid (not long decimal strings).
`ResponseData.DailyPurchaseLimit`	number \| null	—	Daily purchase cap. Number, 2 decimal places; `null` if missing or invalid.
`ResponseData.RemainingPurchaseLimit`	number \| null	—	Remaining daily purchase (card-level only). Number, 2 decimal places; `null` if missing or invalid.
`ResponseData.DailyAtmLimit`	number \| null	—	Daily ATM cap. Number, 2 decimal places; `null` if missing or invalid.
`ResponseData.RemainingAtmLimit`	number \| null	—	Remaining daily ATM (card-level only). Number, 2 decimal places; `null` if missing or invalid.
`ResponseData.MonthlyPurchaseLimit`	number \| null	—	Monthly purchase cap. Number, 2 decimal places; `null` if missing or invalid.
`ResponseData.MonthlyAtmLimit`	number \| null	—	Monthly ATM cap. Number, 2 decimal places; `null` if missing or invalid.
`ResponseData.PerTransactionLimit`	number \| null	—	Per-purchase transaction cap. Resolves Card_Data user-defined → Card_Data base → Card_Type → BIN. Number, 2 decimal places; `null` if missing or invalid.
`ResponseData.PerAtmTransactionLimit`	number \| null	—	Per-ATM transaction cap. Resolves Card_Data user-defined → Card_Data base → Card_Type → BIN. Number, 2 decimal places; `null` if missing or invalid.

Example response

{
  "ResponseCode": 200,
  "ResponseMessage": "Success",
  "ResponseData": {
    "DailyPurchaseLimit": 5000,
    "RemainingPurchaseLimit": 4200.5,
    "DailyAtmLimit": 500,
    "RemainingAtmLimit": 350,
    "MonthlyPurchaseLimit": 20000,
    "MonthlyAtmLimit": 2000,
    "PerTransactionLimit": 2500,
    "PerAtmTransactionLimit": 500
  }
}

{
  "ResponseCode": 200,
  "ResponseMessage": "Success",
  "ResponseData": {
    "DailyPurchaseLimit": 5000,
    "RemainingPurchaseLimit": 4200.5,
    "DailyAtmLimit": 500,
    "RemainingAtmLimit": 350,
    "MonthlyPurchaseLimit": 20000,
    "MonthlyAtmLimit": 2000,
    "PerTransactionLimit": 2500,
    "PerAtmTransactionLimit": 500
  }
}

Limit amounts are numbers with 2 decimal places (e.g. `17` or `17.5`). Missing or invalid values are `null`.

Requires `session-token: {SessionToken}` from Create GMA Session. Use the same client IP as authentication.