Browse the docs

Get cardholder velocity status by external id

GET /v2/api-gateway/controls/velocity/cardholder/{external_id}/status

Looks the cardholder up by your external_id within your top-level organization. Returns a bare JSON array (no envelope): one entry per enabled control on the cardholder, each reporting used and limit in that control unit, followed by a final monthly default-cap entry { "used": <total>, "limit": 10000, "velocityControlId": null }. Keys are camelCase (velocityControlId), unlike the card status route — this is intentional for backwards compatibility.

Request

Authentication: your API key in the x-api-key header.

Path parameters

Field	Type	Description
`external_id` required	string	Your own identifier for the cardholder (its `external_id`), not the Moon cardholder id.

Example request

cURL

curl --request GET \
     --url 'https://api.themooncard.com/v2/api-gateway/controls/velocity/cardholder/{external_id}/status' \
     --header 'x-api-key: YOUR_API_KEY'

Responses

200 Success

Field	Type	Description
`[].used` required	number
`[].limit` required	number
`[].velocityControlId` required	string, nullable
`[].currency` required	string, nullable	ISO code `used` and `limit` are denominated in: the currency of the card's ledger account. Null on a `COUNT` control.

JSON

[
  {
    "used": 124.5,
    "limit": 500,
    "velocityControlId": "e2c4a6b8-0d1f-4a2b-8c3d-4e5f6a7b8c9d",
    "currency": "USD"
  }
]

401 Error

Missing or invalid credentials, e.g. { "message": "Invalid API Key", "code": "UNAUTHORIZED" }.

The body is the standard error object: see Errors.

404 Error

No top-level organization for the caller (ORGANIZATION_NOT_FOUND), or no cardholder with this external id in it (CARDHOLDER_NOT_FOUND).

The body is the standard error object: see Errors.

500 Error

Unexpected server error. Body is { message: "Internal server error", code: "INTERNAL_SERVER_ERROR" }.

The body is the standard error object: see Errors.

Last updated August 24, 2026