# Bulk update card permissions

Enable or disable multiple spending permissions on a card in a single request.

This is the recommended endpoint for updating card permissions as it allows updating multiple permissions atomically.

Endpoint: PATCH /spend/profiles/{profileId}/cards/{cardToken}/spending-permissions
Security: UserToken

## Path parameters:

  - `profileId` (integer, required)
    The ID of the profile that owns the card.
    Example: 123456

  - `cardToken` (string, required)
    The unique token identifying the card.
    Example: "ca0c8154-1e14-4464-a1ce-dcea7dc3de52"

## Header parameters:

  - `X-External-Correlation-Id` (string)
    Optional UUID for correlating requests across systems. If provided, Wise echoes it back in the response. Maximum 36 characters. Learn more.
    Example: "f47ac10b-58cc-4372-a567-0e02b2c3d479"

## Request fields (application/json):

  - `permissions` (array, required)
    List of permissions to update.

  - `permissions.type` (string, required)
    The type of transaction this permission controls.

Permissions available on all cards:
- ECOM - Online transactions
- ATM_WITHDRAWAL - ATM withdrawals
- MOBILE_WALLETS - Digital wallet payments (Apple Pay, Google Pay)

Additional permissions available on physical cards:
- POS_MAGSTRIPE - Physical point-of-sale transactions with magnetic stripe
- POS_CONTACTLESS - Physical point-of-sale contactless transactions
- POS_CHIP - Physical point-of-sale transactions with chip

Virtual cards do not return physical point-of-sale permissions. Only permissions returned for the card can be updated.
    Enum: "ECOM", "POS_CHIP", "POS_MAGSTRIPE", "POS_CONTACTLESS", "ATM_WITHDRAWAL", "MOBILE_WALLETS"

  - `permissions.isEnabled` (boolean, required)
    Indicates if this permission type is enabled.

## Response 400 fields (application/json):

  - `message` (string)
    Error message describing the invalid permission type.
    Example: "Permission 'INVALID_TYPE' is not a valid permission type"

## Response 422 fields (application/json):

  - `message` (string)
    Error message describing why the permission update was rejected.


## Response 200 fields