Browse the docs

Get cardholder velocity status by external id

GET /v1/api-gateway/controls/velocity/cardholder/{external_id}/status

Bare JSON array with one entry per enabled velocity control on the cardholder, plus a trailing default entry (limit: 10000, velocityControlId: null). Note the camelCase velocityControlId key on this route (the other status routes use velocity_control_id).

Request

Authentication: your API key in the x-api-key header.

Path parameters

Field	Type	Description
`external_id` required	string	Your external id for the cardholder.

Example request

cURL

curl --request GET \
     --url 'https://api.themooncard.com/v1/api-gateway/controls/velocity/cardholder/{external_id}/status' \
     --header 'x-api-key: YOUR_API_KEY'

Responses

200 Success

Array of per-control statuses plus the trailing default entry.

Field	Type	Description
`[].used` required	number
`[].limit` required	number
`[].velocityControlId` required	string, nullable
`[].currency` required	string, nullable	ISO code `used` and `limit` are denominated in: the currency of the card's ledger account. Null on a `COUNT` control.

JSON

[
  {
    "used": 124.5,
    "limit": 500,
    "velocityControlId": "e2c4a6b8-0d1f-4a2b-8c3d-4e5f6a7b8c9d",
    "currency": "USD"
  }
]

400 Error

Validation failed (errors[] lists each offending field) or a domain rule rejected the request ({ message, code }).

The body is the standard error object: see Errors.

401 Error

Missing or invalid credentials, e.g. { "message": "Invalid API Key", "code": "UNAUTHORIZED" }.

The body is the standard error object: see Errors.

404 Error

Cardholder or organization not found (CARDHOLDER_NOT_FOUND, ORGANIZATION_NOT_FOUND).

The body is the standard error object: see Errors.

500 Error

Unexpected server error. Body is { message: "Internal server error", code: "INTERNAL_SERVER_ERROR" }.

The body is the standard error object: see Errors.

Last updated April 30, 2026