Browse the docs

Get velocity control status by card id

GET /v2/api-gateway/controls/velocity/card/{card_id}/status

Returns a bare JSON array (no envelope): one entry per control on the card (deleted ones only with include_deleted=true), followed by a final default-cap entry { "used": <total>, "limit": 10000, "velocity_control_id": null }. Keys are snake_case (velocity_control_id), unlike the cardholder status route.

Request

Authentication: your API key in the x-api-key header.

Path parameters

Field	Type	Description
`card_id` required	string, uuid	Card id. Returns the status of every control that applies to the card.

Query parameters

Field	Type	Description
`include_deleted`	boolean	Return the control even if it was deleted (`true`/`false`). Otherwise a deleted control is a 404.

Example request

cURL

curl --request GET \
     --url 'https://api.themooncard.com/v2/api-gateway/controls/velocity/card/8d2cd518-5ef2-4280-91e8-63b1a0e672e7/status' \
     --header 'x-api-key: YOUR_API_KEY'

Responses

200 Success

Field	Type	Description
`[].used` required	number	Consumed so far in the current window: an amount in `currency` on a `SPEND` control, a count of approved authorizations on a `COUNT` one.
`[].limit` required	number	Limit for the window, in the same unit as `used`.
`[].velocity_control_id` required	string, nullable
`[].currency` required	string, nullable	ISO code `used` and `limit` are denominated in: the currency of the card's ledger account, which is what the authorization engine compares. Null on a `COUNT` control.

JSON

[
  {
    "used": 124.5,
    "limit": 500,
    "velocity_control_id": "e2c4a6b8-0d1f-4a2b-8c3d-4e5f6a7b8c9d",
    "currency": "USD"
  }
]

400 Error

Validation failed (errors[] lists each offending field) or a domain rule rejected the request ({ message, code }).

The body is the standard error object: see Errors.

401 Error

Missing or invalid credentials, e.g. { "message": "Invalid API Key", "code": "UNAUTHORIZED" }.

The body is the standard error object: see Errors.

404 Error

Card not found or not owned by this organization (CARD_NOT_FOUND).

The body is the standard error object: see Errors.

500 Error

Unexpected server error. Body is { message: "Internal server error", code: "INTERNAL_SERVER_ERROR" }.

The body is the standard error object: see Errors.

Last updated August 24, 2026