Skip to content
APIs/Team/
/
Lock card

Team API (1.0)

The team API lets you manage users, departments, locations, and cards.

Download OpenAPI description
team_api.json
team_api.yaml
Overview
URL
https://brex.com
Admin
developer-support@brex.com
Languages
Servers
Production
https://api.brex.com
Staging (Note: This is not a sandbox. It will not work with customer tokens.)
https://api-staging.brex.com

Users

Endpoints for user management.

Operations

Locations

Endpoints for location management.

Operations

Departments

Endpoints for department management.

Operations

Titles

Endpoints for title management.

Operations

Cards

Endpoints for card management.

Operations

List cards

Request

Lists all cards by a user_id. Only cards with limit_type = CARD have spend_controls

Security
OAuth2(Required scopes:
cards.readonly
cards
)
Query
user_idstring or null
cursorstring or null
limitinteger or null(int32)
curl -i -X GET \
  https://api.brex.com/v2/cards \
  -H 'Authorization: Bearer <YOUR_TOKEN_HERE>'

Responses

listCardsByUserId 200 response

Bodyapplication/json
next_cursorstring or null
itemsArray of objects(Card)required
items[].​idstringrequired
items[].​ownerobject(CardOwner)required
items[].​owner.​typestring(OwnerType)required
Value"USER"
Discriminator
items[].​owner.​user_idstringrequired
items[].​statusstring or null
Enum"ACTIVE""SHIPPED""LOCKED""TERMINATED"
items[].​last_fourstringrequired
items[].​card_namestringrequired
items[].​card_typestring or null
Enum"VIRTUAL""PHYSICAL"
items[].​limit_typestring(LimitType)required

limit_type = CARD for vendor cards. Vendor cards must have a card_type of VIRTUAL and do not rely on the user specific limit.

For corporate cards, limit_type = USER.

Learn more about different card types here.

Enum"CARD""USER"
items[].​spend_controlsobject or null
items[].​billing_addressobject(Address)required

Company business address (must be in the US; no PO box or virtual/forwarding addresses allowed).

items[].​billing_address.​line1string or null

Address line 1, no PO Box.

items[].​billing_address.​line2string or null

Address line 2 (e.g., apartment, suite, unit, or building).

items[].​billing_address.​citystring or null

City, district, suburb, town, or village.

items[].​billing_address.​statestring or null

For US-addressed the 2-letter State abbreviation. For international-addresses the county, providence, or region.

items[].​billing_address.​countrystring or null

Two-letter country code (ISO 3166-1 alpha-2).

items[].​billing_address.​postal_codestring or null

ZIP or postal code.

items[].​billing_address.​phone_numberstring or null

Phone number.

items[].​mailing_addressobject or null

Company business address (must be in the US; no PO box or virtual/forwarding addresses allowed).

items[].​expiration_dateobject(CardExpiration)required

Card expiration year and month. Cards expire on the last day of the expiration month.

The expiration date is in UTC for cards starting with 555671, 428803 and 485932. And the expiration date is in PST for cards starting with 511572.

items[].​expiration_date.​monthinteger(int32)required
items[].​expiration_date.​yearinteger(int32)required
items[].​has_been_transferredboolean

Indicates whether a card has been transferred. Transferred cards have a spending restriction: we only allow transactions
at online vendors where this card was previously used before the transfer.

items[].​metadataobject or null

Set of key value pairs associated with this object. Please do not store any personally identifiable or sensitive information here. Limitations: maximum of 50 keys, keys cannot exceed 40 characters, values cannot exceed 500 characters.

items[].​budget_idstring or null
Response
application/json
{
  "next_cursor": "string",
  "items": [
    { … }
  ]
}

Create card

Request

Creates a new card. The spend_controls field is required when limit_type = CARD. The mailing_address field is required for physical cards and is the shipping address used to send the card; it is not the same as the billing and mailing address used for online purchases. The first 2 lines of this address must be under 60 characters long. Each user can only have up to 10 active physical cards. For Empower accounts, this endpoint requires budget management. If your account does not have access to budget management features, a 403 response status will be returned. If this is the case and you want to gain access to this endpoint, please contact Brex support.

Security
OAuth2(Required scopes:
cards
)
Headers
Idempotency-Keystringrequired
Bodyapplication/jsonrequired
ownerobject(CardOwner)required
owner.​typestring(OwnerType)required
Value"USER"
Discriminator
owner.​user_idstringrequired
card_namestringnon-emptyrequired
card_typestring(CardType)required
Enum"VIRTUAL""PHYSICAL"
limit_typestring(LimitType)required

limit_type = CARD for vendor cards. Vendor cards must have a card_type of VIRTUAL and do not rely on the user specific limit.

For corporate cards, limit_type = USER.

Learn more about different card types here.

Enum"CARD""USER"
spend_controlsobject or null

When limit_type = CARD, spend_controls must be set. When limit type = USER, spend_controls must be null.

mailing_addressobject or null

Company business address (must be in the US; no PO box or virtual/forwarding addresses allowed).

metadataobject or null

Set of key value pairs associated with this object. Please do not store any personally identifiable or sensitive information here. Limitations: maximum of 50 keys, keys cannot exceed 40 characters, values cannot exceed 500 characters.

card_attribute_preferencesobject or null
curl -i -X POST \
  https://api.brex.com/v2/cards \
  -H 'Authorization: Bearer <YOUR_TOKEN_HERE>' \
  -H 'Content-Type: application/json' \
  -H 'Idempotency-Key: string' \
  -d '{
    "owner": {
      "type": "USER",
      "user_id": "string"
    },
    "card_name": "string",
    "card_type": "VIRTUAL",
    "limit_type": "CARD",
    "spend_controls": {
      "spend_limit": {
        "amount": 700,
        "currency": "USD"
      },
      "spend_duration": "MONTHLY",
      "reason": "string",
      "lock_after_date": "2019-08-24",
      "parent_budget_id": "string",
      "policy_id": "string",
      "allowed_merchant_details": "[{\"name\": \"Github\"}, {\"name\": \"AWS\"}]",
      "blocked_merchant_details": "[{\"name\": \"Apple\"}, {\"name\": \"Amazon\"}]"
    },
    "mailing_address": {
      "line1": "string",
      "line2": "string",
      "city": "string",
      "state": "string",
      "country": "string",
      "postal_code": "string",
      "phone_number": "string"
    },
    "metadata": {
      "property1": "string",
      "property2": "string"
    },
    "card_attribute_preferences": {
      "three_domain_secure_enabled_preference": "THREE_DOMAIN_SECURE_ENABLED"
    }
  }'

Responses

createCard 200 response

Bodyapplication/json
idstringrequired
ownerobject(CardOwner)required
owner.​typestring(OwnerType)required
Value"USER"
Discriminator
owner.​user_idstringrequired
statusstring or null
Enum"ACTIVE""SHIPPED""LOCKED""TERMINATED"
last_fourstringrequired
card_namestringrequired
card_typestring or null
Enum"VIRTUAL""PHYSICAL"
limit_typestring(LimitType)required

limit_type = CARD for vendor cards. Vendor cards must have a card_type of VIRTUAL and do not rely on the user specific limit.

For corporate cards, limit_type = USER.

Learn more about different card types here.

Enum"CARD""USER"
spend_controlsobject or null
billing_addressobject(Address)required

Company business address (must be in the US; no PO box or virtual/forwarding addresses allowed).

billing_address.​line1string or null

Address line 1, no PO Box.

billing_address.​line2string or null

Address line 2 (e.g., apartment, suite, unit, or building).

billing_address.​citystring or null

City, district, suburb, town, or village.

billing_address.​statestring or null

For US-addressed the 2-letter State abbreviation. For international-addresses the county, providence, or region.

billing_address.​countrystring or null

Two-letter country code (ISO 3166-1 alpha-2).

billing_address.​postal_codestring or null

ZIP or postal code.

billing_address.​phone_numberstring or null

Phone number.

mailing_addressobject or null

Company business address (must be in the US; no PO box or virtual/forwarding addresses allowed).

expiration_dateobject(CardExpiration)required

Card expiration year and month. Cards expire on the last day of the expiration month.

The expiration date is in UTC for cards starting with 555671, 428803 and 485932. And the expiration date is in PST for cards starting with 511572.

expiration_date.​monthinteger(int32)required
expiration_date.​yearinteger(int32)required
has_been_transferredboolean

Indicates whether a card has been transferred. Transferred cards have a spending restriction: we only allow transactions
at online vendors where this card was previously used before the transfer.

metadataobject or null

Set of key value pairs associated with this object. Please do not store any personally identifiable or sensitive information here. Limitations: maximum of 50 keys, keys cannot exceed 40 characters, values cannot exceed 500 characters.

budget_idstring or null
Response
application/json
{
  "id": "string",
  "owner": {
    "type": "USER",
    "user_id": "string"
  },
  "status": "ACTIVE",
  "last_four": "string",
  "card_name": "string",
  "card_type": "VIRTUAL",
  "limit_type": "CARD",
  "spend_controls": {
    "spend_limit": { … },
    "spend_available": { … },
    "spend_duration": "MONTHLY",
    "reason": "string",
    "lock_after_date": "2019-08-24",
    "allowed_merchant_details": "[{\"name\": \"Github\"}, {\"name\": \"AWS\"}]",
    "blocked_merchant_details": "[{\"name\": \"Apple\"}, {\"name\": \"Amazon\"}]"
  },
  "billing_address": {
    "line1": "string",
    "line2": "string",
    "city": "string",
    "state": "string",
    "country": "string",
    "postal_code": "string",
    "phone_number": "string"
  },
  "mailing_address": {
    "line1": "string",
    "line2": "string",
    "city": "string",
    "state": "string",
    "country": "string",
    "postal_code": "string",
    "phone_number": "string"
  },
  "expiration_date": {
    "month": 0,
    "year": 0
  },
  "has_been_transferred": true,
  "metadata": {
    "property1": "string",
    "property2": "string"
  },
  "budget_id": "string"
}

Get card

Request

Retrieves a card by ID. Only cards with limit_type = CARD have spend_controls

Security
OAuth2(Required scopes:
cards
cards.readonly
)
Path
idstringrequired
curl -i -X GET \
  'https://api.brex.com/v2/cards/{id}' \
  -H 'Authorization: Bearer <YOUR_TOKEN_HERE>'

Responses

getCardById 200 response

Bodyapplication/json
idstringrequired
ownerobject(CardOwner)required
owner.​typestring(OwnerType)required
Value"USER"
Discriminator
owner.​user_idstringrequired
statusstring or null
Enum"ACTIVE""SHIPPED""LOCKED""TERMINATED"
last_fourstringrequired
card_namestringrequired
card_typestring or null
Enum"VIRTUAL""PHYSICAL"
limit_typestring(LimitType)required

limit_type = CARD for vendor cards. Vendor cards must have a card_type of VIRTUAL and do not rely on the user specific limit.

For corporate cards, limit_type = USER.

Learn more about different card types here.

Enum"CARD""USER"
spend_controlsobject or null
billing_addressobject(Address)required

Company business address (must be in the US; no PO box or virtual/forwarding addresses allowed).

billing_address.​line1string or null

Address line 1, no PO Box.

billing_address.​line2string or null

Address line 2 (e.g., apartment, suite, unit, or building).

billing_address.​citystring or null

City, district, suburb, town, or village.

billing_address.​statestring or null

For US-addressed the 2-letter State abbreviation. For international-addresses the county, providence, or region.

billing_address.​countrystring or null

Two-letter country code (ISO 3166-1 alpha-2).

billing_address.​postal_codestring or null

ZIP or postal code.

billing_address.​phone_numberstring or null

Phone number.

mailing_addressobject or null

Company business address (must be in the US; no PO box or virtual/forwarding addresses allowed).

expiration_dateobject(CardExpiration)required

Card expiration year and month. Cards expire on the last day of the expiration month.

The expiration date is in UTC for cards starting with 555671, 428803 and 485932. And the expiration date is in PST for cards starting with 511572.

expiration_date.​monthinteger(int32)required
expiration_date.​yearinteger(int32)required
has_been_transferredboolean

Indicates whether a card has been transferred. Transferred cards have a spending restriction: we only allow transactions
at online vendors where this card was previously used before the transfer.

metadataobject or null

Set of key value pairs associated with this object. Please do not store any personally identifiable or sensitive information here. Limitations: maximum of 50 keys, keys cannot exceed 40 characters, values cannot exceed 500 characters.

budget_idstring or null
Response
application/json
{
  "id": "string",
  "owner": {
    "type": "USER",
    "user_id": "string"
  },
  "status": "ACTIVE",
  "last_four": "string",
  "card_name": "string",
  "card_type": "VIRTUAL",
  "limit_type": "CARD",
  "spend_controls": {
    "spend_limit": { … },
    "spend_available": { … },
    "spend_duration": "MONTHLY",
    "reason": "string",
    "lock_after_date": "2019-08-24",
    "allowed_merchant_details": "[{\"name\": \"Github\"}, {\"name\": \"AWS\"}]",
    "blocked_merchant_details": "[{\"name\": \"Apple\"}, {\"name\": \"Amazon\"}]"
  },
  "billing_address": {
    "line1": "string",
    "line2": "string",
    "city": "string",
    "state": "string",
    "country": "string",
    "postal_code": "string",
    "phone_number": "string"
  },
  "mailing_address": {
    "line1": "string",
    "line2": "string",
    "city": "string",
    "state": "string",
    "country": "string",
    "postal_code": "string",
    "phone_number": "string"
  },
  "expiration_date": {
    "month": 0,
    "year": 0
  },
  "has_been_transferred": true,
  "metadata": {
    "property1": "string",
    "property2": "string"
  },
  "budget_id": "string"
}

Update card

Request

Update an existing vendor card

Security
OAuth2(Required scopes:
cards
)
Path
idstringrequired
Headers
Idempotency-Keystring or null
Bodyapplication/jsonrequired
spend_controlsobject or null
metadataobject or null

Set of key value pairs associated with this object. Please do not store any personally identifiable or sensitive information here. Limitations: maximum of 50 keys, keys cannot exceed 40 characters, values cannot exceed 500 characters.

curl -i -X PUT \
  'https://api.brex.com/v2/cards/{id}' \
  -H 'Authorization: Bearer <YOUR_TOKEN_HERE>' \
  -H 'Content-Type: application/json' \
  -d '{
    "spend_controls": {
      "spend_limit": {
        "amount": 700,
        "currency": "USD"
      },
      "spend_duration": "MONTHLY",
      "reason": "string",
      "lock_after_date": "2019-08-24",
      "allowed_merchant_details": "[{\"name\": \"Github\"}, {\"name\": \"AWS\"}]",
      "blocked_merchant_details": "[{\"name\": \"Apple\"}, {\"name\": \"Amazon\"}]"
    },
    "metadata": {
      "property1": "string",
      "property2": "string"
    }
  }'

Responses

updateCard 200 response

Bodyapplication/json
idstringrequired
ownerobject(CardOwner)required
owner.​typestring(OwnerType)required
Value"USER"
Discriminator
owner.​user_idstringrequired
statusstring or null
Enum"ACTIVE""SHIPPED""LOCKED""TERMINATED"
last_fourstringrequired
card_namestringrequired
card_typestring or null
Enum"VIRTUAL""PHYSICAL"
limit_typestring(LimitType)required

limit_type = CARD for vendor cards. Vendor cards must have a card_type of VIRTUAL and do not rely on the user specific limit.

For corporate cards, limit_type = USER.

Learn more about different card types here.

Enum"CARD""USER"
spend_controlsobject or null
billing_addressobject(Address)required

Company business address (must be in the US; no PO box or virtual/forwarding addresses allowed).

billing_address.​line1string or null

Address line 1, no PO Box.

billing_address.​line2string or null

Address line 2 (e.g., apartment, suite, unit, or building).

billing_address.​citystring or null

City, district, suburb, town, or village.

billing_address.​statestring or null

For US-addressed the 2-letter State abbreviation. For international-addresses the county, providence, or region.

billing_address.​countrystring or null

Two-letter country code (ISO 3166-1 alpha-2).

billing_address.​postal_codestring or null

ZIP or postal code.

billing_address.​phone_numberstring or null

Phone number.

mailing_addressobject or null

Company business address (must be in the US; no PO box or virtual/forwarding addresses allowed).

expiration_dateobject(CardExpiration)required

Card expiration year and month. Cards expire on the last day of the expiration month.

The expiration date is in UTC for cards starting with 555671, 428803 and 485932. And the expiration date is in PST for cards starting with 511572.

expiration_date.​monthinteger(int32)required
expiration_date.​yearinteger(int32)required
has_been_transferredboolean

Indicates whether a card has been transferred. Transferred cards have a spending restriction: we only allow transactions
at online vendors where this card was previously used before the transfer.

metadataobject or null

Set of key value pairs associated with this object. Please do not store any personally identifiable or sensitive information here. Limitations: maximum of 50 keys, keys cannot exceed 40 characters, values cannot exceed 500 characters.

budget_idstring or null
Response
application/json
{
  "id": "string",
  "owner": {
    "type": "USER",
    "user_id": "string"
  },
  "status": "ACTIVE",
  "last_four": "string",
  "card_name": "string",
  "card_type": "VIRTUAL",
  "limit_type": "CARD",
  "spend_controls": {
    "spend_limit": { … },
    "spend_available": { … },
    "spend_duration": "MONTHLY",
    "reason": "string",
    "lock_after_date": "2019-08-24",
    "allowed_merchant_details": "[{\"name\": \"Github\"}, {\"name\": \"AWS\"}]",
    "blocked_merchant_details": "[{\"name\": \"Apple\"}, {\"name\": \"Amazon\"}]"
  },
  "billing_address": {
    "line1": "string",
    "line2": "string",
    "city": "string",
    "state": "string",
    "country": "string",
    "postal_code": "string",
    "phone_number": "string"
  },
  "mailing_address": {
    "line1": "string",
    "line2": "string",
    "city": "string",
    "state": "string",
    "country": "string",
    "postal_code": "string",
    "phone_number": "string"
  },
  "expiration_date": {
    "month": 0,
    "year": 0
  },
  "has_been_transferred": true,
  "metadata": {
    "property1": "string",
    "property2": "string"
  },
  "budget_id": "string"
}

Lock card

Request

Locks an existing, unlocked card. And the card owner will receive a notification about it.

Security
OAuth2(Required scopes:
cards
)
Path
idstringrequired
Headers
Idempotency-Keystring or null
Bodyapplication/jsonrequired
descriptionstring or null

Description for locking a card

reasonstring(ChangeCardReason)required

Reason for card termination.

Enum"CARD_DAMAGED""CARD_LOST""CARD_NOT_RECEIVED""DO_NOT_NEED_PHYSICAL_CARD""DO_NOT_NEED_VIRTUAL_CARD""FRAUD""OTHER"
curl -i -X POST \
  'https://api.brex.com/v2/cards/{id}/lock' \
  -H 'Authorization: Bearer <YOUR_TOKEN_HERE>' \
  -H 'Content-Type: application/json' \
  -d '{
    "description": "string",
    "reason": "CARD_DAMAGED"
  }'

Responses

lockCard 200 response

Bodyapplication/json
idstringrequired
ownerobject(CardOwner)required
owner.​typestring(OwnerType)required
Value"USER"
Discriminator
owner.​user_idstringrequired
statusstring or null
Enum"ACTIVE""SHIPPED""LOCKED""TERMINATED"
last_fourstringrequired
card_namestringrequired
card_typestring or null
Enum"VIRTUAL""PHYSICAL"
limit_typestring(LimitType)required

limit_type = CARD for vendor cards. Vendor cards must have a card_type of VIRTUAL and do not rely on the user specific limit.

For corporate cards, limit_type = USER.

Learn more about different card types here.

Enum"CARD""USER"
spend_controlsobject or null
billing_addressobject(Address)required

Company business address (must be in the US; no PO box or virtual/forwarding addresses allowed).

billing_address.​line1string or null

Address line 1, no PO Box.

billing_address.​line2string or null

Address line 2 (e.g., apartment, suite, unit, or building).

billing_address.​citystring or null

City, district, suburb, town, or village.

billing_address.​statestring or null

For US-addressed the 2-letter State abbreviation. For international-addresses the county, providence, or region.

billing_address.​countrystring or null

Two-letter country code (ISO 3166-1 alpha-2).

billing_address.​postal_codestring or null

ZIP or postal code.

billing_address.​phone_numberstring or null

Phone number.

mailing_addressobject or null

Company business address (must be in the US; no PO box or virtual/forwarding addresses allowed).

expiration_dateobject(CardExpiration)required

Card expiration year and month. Cards expire on the last day of the expiration month.

The expiration date is in UTC for cards starting with 555671, 428803 and 485932. And the expiration date is in PST for cards starting with 511572.

expiration_date.​monthinteger(int32)required
expiration_date.​yearinteger(int32)required
has_been_transferredboolean

Indicates whether a card has been transferred. Transferred cards have a spending restriction: we only allow transactions
at online vendors where this card was previously used before the transfer.

metadataobject or null

Set of key value pairs associated with this object. Please do not store any personally identifiable or sensitive information here. Limitations: maximum of 50 keys, keys cannot exceed 40 characters, values cannot exceed 500 characters.

budget_idstring or null
Response
application/json
{
  "id": "string",
  "owner": {
    "type": "USER",
    "user_id": "string"
  },
  "status": "ACTIVE",
  "last_four": "string",
  "card_name": "string",
  "card_type": "VIRTUAL",
  "limit_type": "CARD",
  "spend_controls": {
    "spend_limit": { … },
    "spend_available": { … },
    "spend_duration": "MONTHLY",
    "reason": "string",
    "lock_after_date": "2019-08-24",
    "allowed_merchant_details": "[{\"name\": \"Github\"}, {\"name\": \"AWS\"}]",
    "blocked_merchant_details": "[{\"name\": \"Apple\"}, {\"name\": \"Amazon\"}]"
  },
  "billing_address": {
    "line1": "string",
    "line2": "string",
    "city": "string",
    "state": "string",
    "country": "string",
    "postal_code": "string",
    "phone_number": "string"
  },
  "mailing_address": {
    "line1": "string",
    "line2": "string",
    "city": "string",
    "state": "string",
    "country": "string",
    "postal_code": "string",
    "phone_number": "string"
  },
  "expiration_date": {
    "month": 0,
    "year": 0
  },
  "has_been_transferred": true,
  "metadata": {
    "property1": "string",
    "property2": "string"
  },
  "budget_id": "string"
}

Get card number

Request

Retrieves card number, CVV, and expiration date of a card by ID.

Security
OAuth2(Required scopes:
cards.pan
)
Path
idstringrequired
curl -i -X GET \
  'https://secure-platform.brexapis.com/v2/cards/{id}/pan' \
  -H 'Authorization: Bearer <YOUR_TOKEN_HERE>'

Responses

getCardNumber 200 response

Bodyapplication/json
idstringrequired
numberstringrequired
cvvstringrequired
expiration_dateobject(CardExpiration)required

Card expiration year and month. Cards expire on the last day of the expiration month.

The expiration date is in UTC for cards starting with 555671, 428803 and 485932. And the expiration date is in PST for cards starting with 511572.

expiration_date.​monthinteger(int32)required
expiration_date.​yearinteger(int32)required
holder_namestringrequired
Response
application/json
{
  "id": "string",
  "number": "string",
  "cvv": "string",
  "expiration_date": {
    "month": 0,
    "year": 0
  },
  "holder_name": "string"
}

Create secure email to send card number

Request

Creates a secure email to send card number, CVV, and expiration date of a card by ID to the specified email.

This endpoint is currently gated. If you would like to request access, please reach out to developer-support@brex.com

Security
OAuth2(Required scopes:
cards.pan
)
Path
idstringrequired
Headers
Idempotency-Keystringrequired
Bodyapplication/jsonrequired
recipient_emailstringrequired

Email address to send card details to

sender_namestringrequired

Sender name. Shows up in the subject of the email

messagestring or null

Message to send with the card details

expiry_daysinteger or null(int32)<= 30

Link expiry in number of days. Defaults to 30

curl -i -X POST \
  'https://api.brex.com/v2/cards/{id}/secure_email' \
  -H 'Authorization: Bearer <YOUR_TOKEN_HERE>' \
  -H 'Content-Type: application/json' \
  -H 'Idempotency-Key: string' \
  -d '{
    "recipient_email": "string",
    "sender_name": "string",
    "message": "string",
    "expiry_days": 30
  }'

Responses

emailCardNumber 200 response

Terminate card

Request

Terminates an existing card. The card owner will receive a notification about it.

Security
OAuth2(Required scopes:
cards
)
Path
idstringrequired
Headers
Idempotency-Keystring or null
Bodyapplication/jsonrequired
descriptionstring or null

Description for terminating a card

reasonstring(ChangeCardReason)required

Reason for card termination.

Enum"CARD_DAMAGED""CARD_LOST""CARD_NOT_RECEIVED""DO_NOT_NEED_PHYSICAL_CARD""DO_NOT_NEED_VIRTUAL_CARD""FRAUD""OTHER"
curl -i -X POST \
  'https://api.brex.com/v2/cards/{id}/terminate' \
  -H 'Authorization: Bearer <YOUR_TOKEN_HERE>' \
  -H 'Content-Type: application/json' \
  -d '{
    "description": "string",
    "reason": "CARD_DAMAGED"
  }'

Responses

terminateCard 200 response

Bodyapplication/json
idstringrequired
ownerobject(CardOwner)required
owner.​typestring(OwnerType)required
Value"USER"
Discriminator
owner.​user_idstringrequired
statusstring or null
Enum"ACTIVE""SHIPPED""LOCKED""TERMINATED"
last_fourstringrequired
card_namestringrequired
card_typestring or null
Enum"VIRTUAL""PHYSICAL"
limit_typestring(LimitType)required

limit_type = CARD for vendor cards. Vendor cards must have a card_type of VIRTUAL and do not rely on the user specific limit.

For corporate cards, limit_type = USER.

Learn more about different card types here.

Enum"CARD""USER"
spend_controlsobject or null
billing_addressobject(Address)required

Company business address (must be in the US; no PO box or virtual/forwarding addresses allowed).

billing_address.​line1string or null

Address line 1, no PO Box.

billing_address.​line2string or null

Address line 2 (e.g., apartment, suite, unit, or building).

billing_address.​citystring or null

City, district, suburb, town, or village.

billing_address.​statestring or null

For US-addressed the 2-letter State abbreviation. For international-addresses the county, providence, or region.

billing_address.​countrystring or null

Two-letter country code (ISO 3166-1 alpha-2).

billing_address.​postal_codestring or null

ZIP or postal code.

billing_address.​phone_numberstring or null

Phone number.

mailing_addressobject or null

Company business address (must be in the US; no PO box or virtual/forwarding addresses allowed).

expiration_dateobject(CardExpiration)required

Card expiration year and month. Cards expire on the last day of the expiration month.

The expiration date is in UTC for cards starting with 555671, 428803 and 485932. And the expiration date is in PST for cards starting with 511572.

expiration_date.​monthinteger(int32)required
expiration_date.​yearinteger(int32)required
has_been_transferredboolean

Indicates whether a card has been transferred. Transferred cards have a spending restriction: we only allow transactions
at online vendors where this card was previously used before the transfer.

metadataobject or null

Set of key value pairs associated with this object. Please do not store any personally identifiable or sensitive information here. Limitations: maximum of 50 keys, keys cannot exceed 40 characters, values cannot exceed 500 characters.

budget_idstring or null
Response
application/json
{
  "id": "string",
  "owner": {
    "type": "USER",
    "user_id": "string"
  },
  "status": "ACTIVE",
  "last_four": "string",
  "card_name": "string",
  "card_type": "VIRTUAL",
  "limit_type": "CARD",
  "spend_controls": {
    "spend_limit": { … },
    "spend_available": { … },
    "spend_duration": "MONTHLY",
    "reason": "string",
    "lock_after_date": "2019-08-24",
    "allowed_merchant_details": "[{\"name\": \"Github\"}, {\"name\": \"AWS\"}]",
    "blocked_merchant_details": "[{\"name\": \"Apple\"}, {\"name\": \"Amazon\"}]"
  },
  "billing_address": {
    "line1": "string",
    "line2": "string",
    "city": "string",
    "state": "string",
    "country": "string",
    "postal_code": "string",
    "phone_number": "string"
  },
  "mailing_address": {
    "line1": "string",
    "line2": "string",
    "city": "string",
    "state": "string",
    "country": "string",
    "postal_code": "string",
    "phone_number": "string"
  },
  "expiration_date": {
    "month": 0,
    "year": 0
  },
  "has_been_transferred": true,
  "metadata": {
    "property1": "string",
    "property2": "string"
  },
  "budget_id": "string"
}

Unlock card

Request

Unlocks an existing card.

Security
OAuth2(Required scopes:
cards
)
Path
idstringrequired
Headers
Idempotency-Keystring or null
curl -i -X POST \
  'https://api.brex.com/v2/cards/{id}/unlock' \
  -H 'Authorization: Bearer <YOUR_TOKEN_HERE>'

Responses

unlockCard 200 response

Bodyapplication/json
idstringrequired
ownerobject(CardOwner)required
owner.​typestring(OwnerType)required
Value"USER"
Discriminator
owner.​user_idstringrequired
statusstring or null
Enum"ACTIVE""SHIPPED""LOCKED""TERMINATED"
last_fourstringrequired
card_namestringrequired
card_typestring or null
Enum"VIRTUAL""PHYSICAL"
limit_typestring(LimitType)required

limit_type = CARD for vendor cards. Vendor cards must have a card_type of VIRTUAL and do not rely on the user specific limit.

For corporate cards, limit_type = USER.

Learn more about different card types here.

Enum"CARD""USER"
spend_controlsobject or null
billing_addressobject(Address)required

Company business address (must be in the US; no PO box or virtual/forwarding addresses allowed).

billing_address.​line1string or null

Address line 1, no PO Box.

billing_address.​line2string or null

Address line 2 (e.g., apartment, suite, unit, or building).

billing_address.​citystring or null

City, district, suburb, town, or village.

billing_address.​statestring or null

For US-addressed the 2-letter State abbreviation. For international-addresses the county, providence, or region.

billing_address.​countrystring or null

Two-letter country code (ISO 3166-1 alpha-2).

billing_address.​postal_codestring or null

ZIP or postal code.

billing_address.​phone_numberstring or null

Phone number.

mailing_addressobject or null

Company business address (must be in the US; no PO box or virtual/forwarding addresses allowed).

expiration_dateobject(CardExpiration)required

Card expiration year and month. Cards expire on the last day of the expiration month.

The expiration date is in UTC for cards starting with 555671, 428803 and 485932. And the expiration date is in PST for cards starting with 511572.

expiration_date.​monthinteger(int32)required
expiration_date.​yearinteger(int32)required
has_been_transferredboolean

Indicates whether a card has been transferred. Transferred cards have a spending restriction: we only allow transactions
at online vendors where this card was previously used before the transfer.

metadataobject or null

Set of key value pairs associated with this object. Please do not store any personally identifiable or sensitive information here. Limitations: maximum of 50 keys, keys cannot exceed 40 characters, values cannot exceed 500 characters.

budget_idstring or null
Response
application/json
{
  "id": "string",
  "owner": {
    "type": "USER",
    "user_id": "string"
  },
  "status": "ACTIVE",
  "last_four": "string",
  "card_name": "string",
  "card_type": "VIRTUAL",
  "limit_type": "CARD",
  "spend_controls": {
    "spend_limit": { … },
    "spend_available": { … },
    "spend_duration": "MONTHLY",
    "reason": "string",
    "lock_after_date": "2019-08-24",
    "allowed_merchant_details": "[{\"name\": \"Github\"}, {\"name\": \"AWS\"}]",
    "blocked_merchant_details": "[{\"name\": \"Apple\"}, {\"name\": \"Amazon\"}]"
  },
  "billing_address": {
    "line1": "string",
    "line2": "string",
    "city": "string",
    "state": "string",
    "country": "string",
    "postal_code": "string",
    "phone_number": "string"
  },
  "mailing_address": {
    "line1": "string",
    "line2": "string",
    "city": "string",
    "state": "string",
    "country": "string",
    "postal_code": "string",
    "phone_number": "string"
  },
  "expiration_date": {
    "month": 0,
    "year": 0
  },
  "has_been_transferred": true,
  "metadata": {
    "property1": "string",
    "property2": "string"
  },
  "budget_id": "string"
}

Companies

Operations
Copyright © Brex 2019–2026. All rights reserved.