> For clean Markdown of any page, append .md to the page URL. > For a complete documentation index, see https://docs.thepennyinc.com/llms.txt. > For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.thepennyinc.com/_mcp/server. # Update a spend control's rules PATCH https://sandbox.api.thepennyinc.com/spend_controls/{spend_control_id} Content-Type: application/json Upsert rule configurations on a spend control. Each provided rule replaces any existing rule of the same rule_type; rule types omitted from the request are left unchanged. See GET /spend_controls/rule_types for the supported configuration shape per rule type. Required permissions: `spend_control:update`. Reference: https://docs.thepennyinc.com/api-reference/penny-banking/spend-controls/update-rules ## Authentication - `Authorization` header (bearer token, required) — Bearer authentication of the form `Bearer `, where token is your auth token. ## Servers - `https://sandbox.api.thepennyinc.com` (Sandbox — safe for testing, no real money movement., default) - `https://live.api.thepennyinc.com` (Live — real businesses, real money movement.) ## Request ### Path parameters - `spend_control_id` (string, required) — The ID of the spend control. ### Headers - `X-Penny-As-Business` (string, optional, nullable) — Act on behalf of another business that has granted you access. Requires the `business:act_as` permission. ### Body (application/json) This endpoint expects an UpdateSpendControlRulesRequest. - `rule_configs` (list of UpdateSpendControlRulesRequestRuleConfigsItems, required) — The rule configurations to upsert. Each rule_type may appear at most once. ## Response ### 200 The updated spend control. - `spend_control_id` (string, required) — Penny's unique identifier for this spend control. - `version` (integer, required) — A number that increases each time this spend control's configuration changes. Use it to confirm you are looking at the latest configuration. - `version_time` (datetime, required) — The date and time this spend control's configuration was last changed. - `active` (boolean, required) — Whether this spend control's rules are currently being enforced against transactions. - `status` (enum, required) — The current lifecycle state of the spend control. 'active' means the rules are being enforced. 'deactivated' means enforcement has been paused and can be resumed. 'deleting' means removal has been requested and is in progress. 'deleted' means the spend control has been removed and is kept only for historical reference. - Allowed values: `active`, `deactivated`, `deleting`, `deleted` - `rules` (list of SpendControlRulesItems, required) — The full external configuration of every rule in this spend control. - `business_id` (string, required) — The identifier of the business that owns this spend control. ## Errors ### 400 Bad Request Error The request was malformed: a required field is missing or a value has the wrong type or format. - `type` (string, required) — The name of the exception that was raised. - `message` (string, required) — A human-readable description of the error. - `details` (map from string to any, optional, nullable) — Structured context about the error, if any. - `trace_id` (string, optional, nullable) — Identifier for correlating this error with server-side logs. - `errors` (list of map from string to any, optional, nullable) — Sub-errors that contributed to this failure, if any. ### 401 Unauthorized Error Authentication failed. - `type` (string, required) — The name of the exception that was raised. - `message` (string, required) — A human-readable description of the error. - `details` (map from string to any, optional, nullable) — Structured context about the error, if any. - `trace_id` (string, optional, nullable) — Identifier for correlating this error with server-side logs. - `errors` (list of map from string to any, optional, nullable) — Sub-errors that contributed to this failure, if any. ### 403 Forbidden Error The caller does not have permission to perform this action. - `type` (string, required) — The name of the exception that was raised. - `message` (string, required) — A human-readable description of the error. - `details` (map from string to any, optional, nullable) — Structured context about the error, if any. - `trace_id` (string, optional, nullable) — Identifier for correlating this error with server-side logs. - `errors` (list of map from string to any, optional, nullable) — Sub-errors that contributed to this failure, if any. ### 404 Not Found Error The spend control was not found. - `type` (string, required) — The name of the exception that was raised. - `message` (string, required) — A human-readable description of the error. - `details` (map from string to any, optional, nullable) — Structured context about the error, if any. - `trace_id` (string, optional, nullable) — Identifier for correlating this error with server-side logs. - `errors` (list of map from string to any, optional, nullable) — Sub-errors that contributed to this failure, if any. ### 422 Unprocessable Entity Error The request was well-formed but could not be processed because it breaks a business rule. - `type` (string, required) — The name of the exception that was raised. - `message` (string, required) — A human-readable description of the error. - `details` (map from string to any, optional, nullable) — Structured context about the error, if any. - `trace_id` (string, optional, nullable) — Identifier for correlating this error with server-side logs. - `errors` (list of map from string to any, optional, nullable) — Sub-errors that contributed to this failure, if any. ### 429 Too Many Requests Error Too many requests; retry after the Retry-After header. - `type` (string, required) — The name of the exception that was raised. - `message` (string, required) — A human-readable description of the error. - `details` (map from string to any, optional, nullable) — Structured context about the error, if any. - `trace_id` (string, optional, nullable) — Identifier for correlating this error with server-side logs. - `errors` (list of map from string to any, optional, nullable) — Sub-errors that contributed to this failure, if any. ### 500 Internal Server Error An unexpected error occurred. - `type` (string, required) — The name of the exception that was raised. - `message` (string, required) — A human-readable description of the error. - `details` (map from string to any, optional, nullable) — Structured context about the error, if any. - `trace_id` (string, optional, nullable) — Identifier for correlating this error with server-side logs. - `errors` (list of map from string to any, optional, nullable) — Sub-errors that contributed to this failure, if any. ## Types ### UpdateSpendControlRulesRequestRuleConfigsItems - `rule_type`: `currency` (CurrencyRuleRequest) - `applicable_card_issuance_modes` (list of enum, required) — The card issuance modes this rule applies to. Must be stated explicitly -- there is no default that implies every mode. A rule meant to apply to every issuance mode should list all of them. - Allowed values: `managed` - `applicable_transaction_authorizations` (list of enum, required) — The transaction authorization types this rule applies to. - Allowed values: `debit`, `credit`, `adjustment` - `configuration` (CurrencyConfiguration, required) — Transaction currency rules. - `rule_type`: `geographic` (GeographicRuleRequest) - `applicable_card_issuance_modes` (list of enum, required) — The card issuance modes this rule applies to. Must be stated explicitly -- there is no default that implies every mode. A rule meant to apply to every issuance mode should list all of them. - Allowed values: `managed` - `applicable_transaction_authorizations` (list of enum, required) — The transaction authorization types this rule applies to. - Allowed values: `debit`, `credit`, `adjustment` - `configuration` (GeographicConfiguration, required) — Merchant location rules; set at least one. - `rule_type`: `live_decisioning` (LiveDecisioningRuleRequest) - `applicable_card_issuance_modes` (list of enum, required) — The card issuance modes this rule applies to. Must be stated explicitly -- there is no default that implies every mode. A rule meant to apply to every issuance mode should list all of them. - Allowed values: `managed` - `applicable_transaction_authorizations` (list of enum, required) — The transaction authorization types this rule applies to. - Allowed values: `debit`, `credit`, `adjustment` - `configuration` (LiveDecisioningConfiguration, required) — Where live decisions are requested and what happens if no answer arrives. - `rule_type`: `merchant` (MerchantRuleRequest) - `applicable_card_issuance_modes` (list of enum, required) — The card issuance modes this rule applies to. Must be stated explicitly -- there is no default that implies every mode. A rule meant to apply to every issuance mode should list all of them. - Allowed values: `managed` - `applicable_transaction_authorizations` (list of enum, required) — The transaction authorization types this rule applies to. - Allowed values: `debit`, `credit`, `adjustment` - `configuration` (MerchantConfiguration, required) — Merchant rules; set at least one. - `rule_type`: `processing` (ProcessingRuleRequest) - `applicable_card_issuance_modes` (list of enum, required) — The card issuance modes this rule applies to. Must be stated explicitly -- there is no default that implies every mode. A rule meant to apply to every issuance mode should list all of them. - Allowed values: `managed` - `applicable_transaction_authorizations` (list of enum, required) — The transaction authorization types this rule applies to. - Allowed values: `debit`, `credit`, `adjustment` - `configuration` (ProcessingConfiguration, required) — Card-entry rules. - `rule_type`: `transaction_amount` (TransactionAmountRuleRequest) - `applicable_card_issuance_modes` (list of enum, required) — The card issuance modes this rule applies to. Must be stated explicitly -- there is no default that implies every mode. A rule meant to apply to every issuance mode should list all of them. - Allowed values: `managed` - `applicable_transaction_authorizations` (list of enum, required) — The transaction authorization types this rule applies to. - Allowed values: `debit`, `credit`, `adjustment` - `configuration` (map from string to AmountLimitConfiguration, required) - `rule_type`: `velocity` (VelocityRuleRequest) - `applicable_card_issuance_modes` (list of enum, required) — The card issuance modes this rule applies to. Must be stated explicitly -- there is no default that implies every mode. A rule meant to apply to every issuance mode should list all of them. - Allowed values: `managed` - `applicable_transaction_authorizations` (list of enum, required) — The transaction authorization types this rule applies to. - Allowed values: `debit`, `credit`, `adjustment` - `configuration` (VelocityConfiguration, required) — Limits per currency and calendar window. ### SpendControlRulesItems - CurrencyControlRuleResponse: CurrencyControlRuleResponse - GeographicControlRuleResponse: GeographicControlRuleResponse - ProcessingControlRuleResponse: ProcessingControlRuleResponse - MerchantControlRuleResponse: MerchantControlRuleResponse - TransactionAmountRuleResponse: TransactionAmountRuleResponse - VelocityRuleResponse: VelocityRuleResponse - LiveDecisioningRuleResponse: LiveDecisioningRuleResponse ### CurrencyConfiguration Transaction currency rules. - `currency_rules` (AllowDenyConfiguration, required) — ISO 4217 currency codes; only `USD` is supported. ### GeographicConfiguration Merchant location rules; set at least one. - `country_rules` (AllowDenyConfiguration, optional, nullable) — ISO 3166-1 alpha-2 country codes, e.g. `US`. - `subdivision_rules` (AllowDenyConfiguration, optional, nullable) — ISO 3166-2 subdivision codes, e.g. `US-CA`. - `zip_code_rules` (AllowDenyConfiguration, optional, nullable) — Merchant ZIP or postal codes, e.g. `90210`. ### LiveDecisioningConfiguration Where live decisions are requested and what happens if no answer arrives. - `notification_endpoint_id` (string, required) — The webhook endpoint that receives authorization decisions. - `fallback_result` (boolean, required) — `true` approves and `false` declines when the endpoint does not answer in time. ### MerchantConfiguration Merchant rules; set at least one. - `merchant_id_rules` (AllowDenyConfiguration, optional, nullable) — Merchant IDs supplied by the card network. - `merchant_category_codes_rules` (AllowDenyConfiguration, optional, nullable) — 4-digit merchant category codes or inclusive ranges, e.g. `5411` or `7999-8999`. - `merchant_name_rules` (list of MerchantNameConfiguration, optional) — Conditions matched against the merchant name. ### ProcessingConfiguration Card-entry rules. - `pan_entry_mode_rules` (AllowDenyConfiguration, optional, nullable) — How the card number was entered: `manual`, `chip`, `magstripe`, `contactless`, `card_on_file` or `e_commerce`. ### AmountLimitConfiguration Per-transaction amount bounds for one currency. - `minimum` (string, optional, nullable) — Smallest allowed transaction amount, as a decimal string. - `maximum` (string, optional, nullable) — Largest allowed transaction amount, as a decimal string. ### VelocityConfiguration Limits per currency and calendar window. - `velocity_controls` (map from string to map from string to VelocityLimitConfiguration, required) — Keyed by currency code (`USD`), then window. Windows are calendar periods in UTC (weeks start Monday) and reset at each boundary; `lifetime` never resets. ### CurrencyControlRuleResponse The currencies explicitly permitted or blocked by this rule. - `rule_id` (string, required) — Penny's unique identifier for this rule. - `version` (integer, required) — A number that increases each time this rule's configuration changes. Use it to confirm you are looking at the latest configuration. - `version_time` (datetime, required) — The date and time this rule's configuration was last changed. - `applicable_card_issuance_modes` (list of enum, required) — The card issuance modes this rule applies to. - Allowed values: `managed` - `applicable_transaction_authorizations` (list of enum, required) — The kinds of transaction requests this rule applies to, for example debits or credits. - Allowed values: `debit`, `credit`, `adjustment` - `currency_rules` (AllowDenyListResponse, required) — Allowed or blocked ISO 4217 transaction currency codes. - `rule_type` ("currency", optional, default: currency) ### GeographicControlRuleResponse The locations explicitly permitted or blocked by this rule. - `rule_id` (string, required) — Penny's unique identifier for this rule. - `version` (integer, required) — A number that increases each time this rule's configuration changes. Use it to confirm you are looking at the latest configuration. - `version_time` (datetime, required) — The date and time this rule's configuration was last changed. - `applicable_card_issuance_modes` (list of enum, required) — The card issuance modes this rule applies to. - Allowed values: `managed` - `applicable_transaction_authorizations` (list of enum, required) — The kinds of transaction requests this rule applies to, for example debits or credits. - Allowed values: `debit`, `credit`, `adjustment` - `rule_type` ("geographic", optional, default: geographic) - `country_rules` (AllowDenyListResponse, optional, nullable) — Allowed or blocked ISO 3166-1 alpha-2 country codes. - `subdivision_rules` (AllowDenyListResponse, optional, nullable) — Allowed or blocked ISO 3166-2 state or province codes. - `zip_code_rules` (AllowDenyListResponse, optional, nullable) — Allowed or blocked postal codes. ### ProcessingControlRuleResponse The card entry methods explicitly permitted or blocked by this rule. - `rule_id` (string, required) — Penny's unique identifier for this rule. - `version` (integer, required) — A number that increases each time this rule's configuration changes. Use it to confirm you are looking at the latest configuration. - `version_time` (datetime, required) — The date and time this rule's configuration was last changed. - `applicable_card_issuance_modes` (list of enum, required) — The card issuance modes this rule applies to. - Allowed values: `managed` - `applicable_transaction_authorizations` (list of enum, required) — The kinds of transaction requests this rule applies to, for example debits or credits. - Allowed values: `debit`, `credit`, `adjustment` - `rule_type` ("processing", optional, default: processing) - `pan_entry_mode_rules` (AllowDenyListResponse, optional, nullable) — Allowed or blocked card entry methods, such as chip or contactless. ### MerchantControlRuleResponse The merchants explicitly permitted or blocked by this rule. - `rule_id` (string, required) — Penny's unique identifier for this rule. - `version` (integer, required) — A number that increases each time this rule's configuration changes. Use it to confirm you are looking at the latest configuration. - `version_time` (datetime, required) — The date and time this rule's configuration was last changed. - `applicable_card_issuance_modes` (list of enum, required) — The card issuance modes this rule applies to. - Allowed values: `managed` - `applicable_transaction_authorizations` (list of enum, required) — The kinds of transaction requests this rule applies to, for example debits or credits. - Allowed values: `debit`, `credit`, `adjustment` - `rule_type` ("merchant", optional, default: merchant) - `merchant_id_rules` (AllowDenyListResponse, optional, nullable) — Allowed or blocked merchant identifiers. - `merchant_category_codes_rules` (AllowDenyListResponse, optional, nullable) — Allowed or blocked merchant category codes or code ranges. - `merchant_name_rules` (list of StringMatchCriteriaResponse, optional, nullable) — Criteria used to permit or block transactions by merchant name. ### TransactionAmountRuleResponse The minimum and maximum transaction amounts configured per currency. - `rule_id` (string, required) — Penny's unique identifier for this rule. - `version` (integer, required) — A number that increases each time this rule's configuration changes. Use it to confirm you are looking at the latest configuration. - `version_time` (datetime, required) — The date and time this rule's configuration was last changed. - `applicable_card_issuance_modes` (list of enum, required) — The card issuance modes this rule applies to. - Allowed values: `managed` - `applicable_transaction_authorizations` (list of enum, required) — The kinds of transaction requests this rule applies to, for example debits or credits. - Allowed values: `debit`, `credit`, `adjustment` - `currency_amount_limits` (map from string to TransactionAmountLimitResponse, required) — Transaction amount limits keyed by ISO 4217 currency code. - `rule_type` ("transaction_amount", optional, default: transaction_amount) ### VelocityRuleResponse The transaction count and amount limits configured per currency and period. - `rule_id` (string, required) — Penny's unique identifier for this rule. - `version` (integer, required) — A number that increases each time this rule's configuration changes. Use it to confirm you are looking at the latest configuration. - `version_time` (datetime, required) — The date and time this rule's configuration was last changed. - `applicable_card_issuance_modes` (list of enum, required) — The card issuance modes this rule applies to. - Allowed values: `managed` - `applicable_transaction_authorizations` (list of enum, required) — The kinds of transaction requests this rule applies to, for example debits or credits. - Allowed values: `debit`, `credit`, `adjustment` - `velocity_controls` (map from string to map from string to VelocityControlClientAPIResponse, required) — Usage and amount limits keyed first by ISO 4217 currency code and then by limit period. - `rule_type` ("velocity", optional, default: velocity) ### LiveDecisioningRuleResponse The endpoint and fallback behaviour used for real-time decisioning. - `rule_id` (string, required) — Penny's unique identifier for this rule. - `version` (integer, required) — A number that increases each time this rule's configuration changes. Use it to confirm you are looking at the latest configuration. - `version_time` (datetime, required) — The date and time this rule's configuration was last changed. - `applicable_card_issuance_modes` (list of enum, required) — The card issuance modes this rule applies to. - Allowed values: `managed` - `applicable_transaction_authorizations` (list of enum, required) — The kinds of transaction requests this rule applies to, for example debits or credits. - Allowed values: `debit`, `credit`, `adjustment` - `notification_endpoint_id` (string, required) — The notification endpoint that receives authorization decisions. - `fallback_result` (boolean, required) — Whether a transaction is approved if live decisioning fails. - `rule_type` ("live_decisioning", optional, default: live_decisioning) ### AllowDenyConfiguration Values to allow or deny; when an allowlist is set, anything absent from it is declined. - `allowlist` (list of string, optional, nullable) — Values that are allowed; all others are declined. - `denylist` (list of string, optional, nullable) — Values that are always declined. ### MerchantNameConfiguration One merchant name condition. - `match_type` (enum, required) — How `condition_values` are compared to the merchant name. - Allowed values: `equals`, `contains`, `starts_with`, `ends_with`, `regex` - `condition_values` (list of string, required) — Values compared to the merchant name; any match counts. - `match_result` (boolean, required) — `true` approves matching merchants; `false` declines them. ### VelocityLimitConfiguration Limits for one window; set at least one. - `usage_limit` (VelocityLimitConfigurationUsageLimit, optional) — Maximum number of transactions in the window. - `amount_limit` (string, optional) — Maximum total amount in the window, as a decimal string. ### AllowDenyListResponse A list of specific values that are explicitly permitted or explicitly blocked. At most one of these lists is typically configured. When an allowlist is present, only the listed values are permitted. When only a denylist is present, every value is permitted except the ones listed. - `allowlist` (list of string, optional, nullable) — The only values that are permitted. Absent when this restriction uses a denylist instead. - `denylist` (list of string, optional, nullable) — The values that are explicitly blocked. Absent when this restriction uses an allowlist instead. ### StringMatchCriteriaResponse A rule for matching a piece of text, such as a merchant name, against one or more reference values. - `match_type` (enum, required) — How the reference values are compared against the text being checked: 'equals' (exact match), 'starts_with', 'ends_with', 'contains', or 'regex' (matches a pattern). - Allowed values: `equals`, `starts_with`, `ends_with`, `contains`, `regex` - `condition_values` (list of string, required) — The reference values the text is compared against. - `match_result` (boolean, required) — The outcome to apply when the text matches one of the condition values. If the text does not match any of them, the opposite outcome applies. - `timeout` (double, optional, nullable) — The maximum time, in seconds, allowed to evaluate a 'regex' match before it is abandoned. Only applies when match_type is 'regex'. ### TransactionAmountLimitResponse The minimum and/or maximum amount permitted for a single transaction. - `minimum` (string, optional, nullable) — The smallest amount permitted, as a decimal string. No minimum applies if absent. - `maximum` (string, optional, nullable) — The largest amount permitted, as a decimal string. No maximum applies if absent. ### VelocityControlClientAPIResponse A velocity-based spend limit applied to an account or card: combining an optional usage (count) limit and an optional amount limit. Either, both, or neither may be configured; when both are configured, covered activity must satisfy both to be allowed. - `usage` (VelocityCounterClientAPIResponse, optional, nullable) — The usage (count) limit enforced by this control, if one is configured. Absent when this control does not restrict how many times covered activity may occur. - `balance` (VelocityBalanceClientAPIResponse, optional, nullable) — The amount limit enforced by this control, if one is configured. Absent when this control does not restrict the amount of covered activity. ### VelocityLimitConfigurationUsageLimit Maximum number of transactions in the window. - string - integer ### VelocityCounterClientAPIResponse The current usage of a velocity counter, as shown to clients: how much of the limit has been used and when it will next reset. - `count` (integer, required) — The current value tracked by this counter. Increases or decreases as covered activity occurs and is maintained automatically by Penny. - `count_limit` (integer, required) — The maximum value this counter is allowed to reach before further covered activity is declined. - `limit_window` (enum, required) — The recurring time period over which the count is measured, such as daily or monthly, before it resets to zero. - Allowed values: `hour`, `day`, `week`, `month`, `quarter`, `year`, `lifetime` - `last_reset_time` (datetime, required) — The date and time the count was last reset to zero at the start of a new limit window. ### VelocityBalanceClientAPIResponse The current usage of a velocity balance, as shown to clients: how much is still available against the limit and when it will next reset. - `currency` (enum, required) — ISO-4217 currency code in which this balance is maintained. - Allowed values: `USD` - `available_balance` (string, required) — The amount currently available for transactions, as a decimal string. - `amount_limit` (string, required) — The maximum amount that can be spent or transacted within the current limit window, as a decimal string. - `limit_window` (enum, required) — The recurring time period over which the amount limit applies, such as daily or monthly, before it resets. - Allowed values: `hour`, `day`, `week`, `month`, `quarter`, `year`, `lifetime` - `last_reset_time` (datetime, required) — The date and time the available balance was last reset to the full limit at the start of a new limit window. ## Examples **Request** ```json { "rule_configs": [ { "applicable_card_issuance_modes": [ "managed" ], "applicable_transaction_authorizations": [ "debit" ], "configuration": {}, "rule_type": "string" } ] } ``` **Response** ```json { "spend_control_id": "spend_control_019379d9-a170-796b-867a-a17096b67a21", "version": 1, "version_time": "2024-01-15T10:30:00Z", "active": true, "status": "active", "rules": [ { "applicable_card_issuance_modes": [ "managed" ], "applicable_transaction_authorizations": [ "debit", "credit" ], "currency_amount_limits": {}, "rule_id": "spend_control_rule_019370e9-c1a6-78ad-8fee-c1a68adfee20", "rule_type": "transaction_amount", "version": 1, "version_time": "2024-01-15T10:30:00Z" } ], "business_id": "business_01937b95-484e-75af-8c68-484e5afc68d3" } ``` **SDK Code** ```python import requests url = "https://sandbox.api.thepennyinc.com/spend_controls/spend_control_id" payload = { "rule_configs": [ { "applicable_card_issuance_modes": ["managed"], "applicable_transaction_authorizations": ["debit"], "configuration": {}, "rule_type": "string" } ] } headers = { "X-Penny-As-Business": "business_01a083e2-82ed-7a5c-9d1e-3b6f0c2a4d71", "Authorization": "Bearer ", "Content-Type": "application/json" } response = requests.patch(url, json=payload, headers=headers) print(response.json()) ``` ```javascript const url = 'https://sandbox.api.thepennyinc.com/spend_controls/spend_control_id'; const options = { method: 'PATCH', headers: { 'X-Penny-As-Business': 'business_01a083e2-82ed-7a5c-9d1e-3b6f0c2a4d71', Authorization: 'Bearer ', 'Content-Type': 'application/json' }, body: '{"rule_configs":[{"applicable_card_issuance_modes":["managed"],"applicable_transaction_authorizations":["debit"],"configuration":{},"rule_type":"string"}]}' }; try { const response = await fetch(url, options); const data = await response.json(); console.log(data); } catch (error) { console.error(error); } ``` ```go package main import ( "fmt" "strings" "net/http" "io" ) func main() { url := "https://sandbox.api.thepennyinc.com/spend_controls/spend_control_id" payload := strings.NewReader("{\n \"rule_configs\": [\n {\n \"applicable_card_issuance_modes\": [\n \"managed\"\n ],\n \"applicable_transaction_authorizations\": [\n \"debit\"\n ],\n \"configuration\": {},\n \"rule_type\": \"string\"\n }\n ]\n}") req, _ := http.NewRequest("PATCH", url, payload) req.Header.Add("X-Penny-As-Business", "business_01a083e2-82ed-7a5c-9d1e-3b6f0c2a4d71") req.Header.Add("Authorization", "Bearer ") req.Header.Add("Content-Type", "application/json") res, _ := http.DefaultClient.Do(req) defer res.Body.Close() body, _ := io.ReadAll(res.Body) fmt.Println(res) fmt.Println(string(body)) } ``` ```ruby require 'uri' require 'net/http' url = URI("https://sandbox.api.thepennyinc.com/spend_controls/spend_control_id") http = Net::HTTP.new(url.host, url.port) http.use_ssl = true request = Net::HTTP::Patch.new(url) request["X-Penny-As-Business"] = 'business_01a083e2-82ed-7a5c-9d1e-3b6f0c2a4d71' request["Authorization"] = 'Bearer ' request["Content-Type"] = 'application/json' request.body = "{\n \"rule_configs\": [\n {\n \"applicable_card_issuance_modes\": [\n \"managed\"\n ],\n \"applicable_transaction_authorizations\": [\n \"debit\"\n ],\n \"configuration\": {},\n \"rule_type\": \"string\"\n }\n ]\n}" response = http.request(request) puts response.read_body ``` ```java import com.mashape.unirest.http.HttpResponse; import com.mashape.unirest.http.Unirest; HttpResponse response = Unirest.patch("https://sandbox.api.thepennyinc.com/spend_controls/spend_control_id") .header("X-Penny-As-Business", "business_01a083e2-82ed-7a5c-9d1e-3b6f0c2a4d71") .header("Authorization", "Bearer ") .header("Content-Type", "application/json") .body("{\n \"rule_configs\": [\n {\n \"applicable_card_issuance_modes\": [\n \"managed\"\n ],\n \"applicable_transaction_authorizations\": [\n \"debit\"\n ],\n \"configuration\": {},\n \"rule_type\": \"string\"\n }\n ]\n}") .asString(); ``` ```php request('PATCH', 'https://sandbox.api.thepennyinc.com/spend_controls/spend_control_id', [ 'body' => '{ "rule_configs": [ { "applicable_card_issuance_modes": [ "managed" ], "applicable_transaction_authorizations": [ "debit" ], "configuration": {}, "rule_type": "string" } ] }', 'headers' => [ 'Authorization' => 'Bearer ', 'Content-Type' => 'application/json', 'X-Penny-As-Business' => 'business_01a083e2-82ed-7a5c-9d1e-3b6f0c2a4d71', ], ]); echo $response->getBody(); ``` ```csharp using RestSharp; var client = new RestClient("https://sandbox.api.thepennyinc.com/spend_controls/spend_control_id"); var request = new RestRequest(Method.PATCH); request.AddHeader("X-Penny-As-Business", "business_01a083e2-82ed-7a5c-9d1e-3b6f0c2a4d71"); request.AddHeader("Authorization", "Bearer "); request.AddHeader("Content-Type", "application/json"); request.AddParameter("application/json", "{\n \"rule_configs\": [\n {\n \"applicable_card_issuance_modes\": [\n \"managed\"\n ],\n \"applicable_transaction_authorizations\": [\n \"debit\"\n ],\n \"configuration\": {},\n \"rule_type\": \"string\"\n }\n ]\n}", ParameterType.RequestBody); IRestResponse response = client.Execute(request); ``` ```swift import Foundation let headers = [ "X-Penny-As-Business": "business_01a083e2-82ed-7a5c-9d1e-3b6f0c2a4d71", "Authorization": "Bearer ", "Content-Type": "application/json" ] let parameters = ["rule_configs": [ [ "applicable_card_issuance_modes": ["managed"], "applicable_transaction_authorizations": ["debit"], "configuration": [], "rule_type": "string" ] ]] as [String : Any] let postData = JSONSerialization.data(withJSONObject: parameters, options: []) let request = NSMutableURLRequest(url: NSURL(string: "https://sandbox.api.thepennyinc.com/spend_controls/spend_control_id")! as URL, cachePolicy: .useProtocolCachePolicy, timeoutInterval: 10.0) request.httpMethod = "PATCH" request.allHTTPHeaderFields = headers request.httpBody = postData as Data let session = URLSession.shared let dataTask = session.dataTask(with: request as URLRequest, completionHandler: { (data, response, error) -> Void in if (error != nil) { print(error as Any) } else { let httpResponse = response as? HTTPURLResponse print(httpResponse) } }) dataTask.resume() ```