Create a card limit

curl --request POST \
  --url https://api.banking.v2.portao3.com.br/realms/{realmId}/organizations/{organizationId}/accounts/{accountId}/card-limit \
  --header 'Content-Type: application/json' \
  --data '
{
  "amount": 150000,
  "startDate": "2026-11-01",
  "endDate": "2026-11-30",
  "cardIds": [
    "66f2a4b8b4d3e80012c9a0e1"
  ],
  "ruleIds": [
    "66f2a5a0b4d3e80012c9a0f1"
  ],
  "name": "Campaign budget"
}
'

import requests

url = "https://api.banking.v2.portao3.com.br/realms/{realmId}/organizations/{organizationId}/accounts/{accountId}/card-limit"

payload = {
    "amount": 150000,
    "startDate": "2026-11-01",
    "endDate": "2026-11-30",
    "cardIds": ["66f2a4b8b4d3e80012c9a0e1"],
    "ruleIds": ["66f2a5a0b4d3e80012c9a0f1"],
    "name": "Campaign budget"
}
headers = {"Content-Type": "application/json"}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {'Content-Type': 'application/json'},
  body: JSON.stringify({
    amount: 150000,
    startDate: '2026-11-01',
    endDate: '2026-11-30',
    cardIds: ['66f2a4b8b4d3e80012c9a0e1'],
    ruleIds: ['66f2a5a0b4d3e80012c9a0f1'],
    name: 'Campaign budget'
  })
};

fetch('https://api.banking.v2.portao3.com.br/realms/{realmId}/organizations/{organizationId}/accounts/{accountId}/card-limit', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.banking.v2.portao3.com.br/realms/{realmId}/organizations/{organizationId}/accounts/{accountId}/card-limit",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'amount' => 150000,
    'startDate' => '2026-11-01',
    'endDate' => '2026-11-30',
    'cardIds' => [
        '66f2a4b8b4d3e80012c9a0e1'
    ],
    'ruleIds' => [
        '66f2a5a0b4d3e80012c9a0f1'
    ],
    'name' => 'Campaign budget'
  ]),
  CURLOPT_HTTPHEADER => [
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.banking.v2.portao3.com.br/realms/{realmId}/organizations/{organizationId}/accounts/{accountId}/card-limit"

	payload := strings.NewReader("{\n  \"amount\": 150000,\n  \"startDate\": \"2026-11-01\",\n  \"endDate\": \"2026-11-30\",\n  \"cardIds\": [\n    \"66f2a4b8b4d3e80012c9a0e1\"\n  ],\n  \"ruleIds\": [\n    \"66f2a5a0b4d3e80012c9a0f1\"\n  ],\n  \"name\": \"Campaign budget\"\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://api.banking.v2.portao3.com.br/realms/{realmId}/organizations/{organizationId}/accounts/{accountId}/card-limit")
  .header("Content-Type", "application/json")
  .body("{\n  \"amount\": 150000,\n  \"startDate\": \"2026-11-01\",\n  \"endDate\": \"2026-11-30\",\n  \"cardIds\": [\n    \"66f2a4b8b4d3e80012c9a0e1\"\n  ],\n  \"ruleIds\": [\n    \"66f2a5a0b4d3e80012c9a0f1\"\n  ],\n  \"name\": \"Campaign budget\"\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://api.banking.v2.portao3.com.br/realms/{realmId}/organizations/{organizationId}/accounts/{accountId}/card-limit")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Content-Type"] = 'application/json'
request.body = "{\n  \"amount\": 150000,\n  \"startDate\": \"2026-11-01\",\n  \"endDate\": \"2026-11-30\",\n  \"cardIds\": [\n    \"66f2a4b8b4d3e80012c9a0e1\"\n  ],\n  \"ruleIds\": [\n    \"66f2a5a0b4d3e80012c9a0f1\"\n  ],\n  \"name\": \"Campaign budget\"\n}"

response = http.request(request)
puts response.read_body

{
  "_id": "66f2a5c2b4d3e80012c9a0f3",
  "realmId": "f495ff0c-ab54-4f99-8e92-ca8682e4de9b",
  "organizationId": "c4bd3f21-dfbd-44e8-8055-68ba15bed410",
  "accountId": "66f2a1c7b4d3e80012c9a0b4",
  "environment": "LIVE",
  "amount": 150000,
  "startDate": "2026-11-01",
  "endDate": "2026-11-30",
  "cardIds": [
    "66f2a4b8b4d3e80012c9a0e1"
  ],
  "ruleIds": [
    "66f2a5a0b4d3e80012c9a0f1"
  ],
  "external": {
    "controlId": "5d0e7a9c-3b21-4c6f-8e4d-9a7b1c2d3e4f"
  },
  "status": "ACTIVE",
  "createdAt": "2026-11-02T13:05:12.000Z",
  "updatedAt": "2026-11-02T13:05:12.000Z",
  "__v": 0,
  "name": "Campaign budget"
}

{
  "traceId": "1-68ee2a1b-3c4d5e6f7a8b9c0d1e2f3a4b",
  "code": "ACCOUNT_NOT_FOUND",
  "origin": "BANKING",
  "message": "Account not found"
}

{
  "traceId": "1-68ee2a1b-3c4d5e6f7a8b9c0d1e2f3a4b",
  "code": "BAD_REQUEST",
  "origin": "BANKING",
  "message": "Bad Request: Your request is invalid or incomplete. Please make sure you are requesting with the right fields.",
  "fields": [
    {
      "field": "amount",
      "message": "Invalid input: expected integer, received undefined",
      "code": "AMOUNT_REQUIRED"
    }
  ]
}

{
  "traceId": "1-68ee2a1b-3c4d5e6f7a8b9c0d1e2f3a4b",
  "code": "BANKING_PROVIDER_UNAVAILABLE",
  "origin": "BANKING",
  "message": "Banking provider temporarily unavailable, please retry"
}

{
  "traceId": "1-68ee2a1b-3c4d5e6f7a8b9c0d1e2f3a4b",
  "code": "BANKING_PROVIDER_UNAVAILABLE",
  "origin": "BANKING",
  "message": "Banking provider temporarily unavailable, please retry"
}

{
  "traceId": "1-68ee2a1b-3c4d5e6f7a8b9c0d1e2f3a4b",
  "code": "BANKING_PROVIDER_UNAVAILABLE",
  "origin": "BANKING",
  "message": "Banking provider temporarily unavailable, please retry"
}

{
  "traceId": "1-68ee2a1b-3c4d5e6f7a8b9c0d1e2f3a4b",
  "code": "BANKING_PROVIDER_UNAVAILABLE",
  "origin": "BANKING",
  "message": "Banking provider did not respond in time, please retry"
}

POST

realms

{realmId}

organizations

{organizationId}

accounts

{accountId}

card-limit

Create a card limit

curl --request POST \
  --url https://api.banking.v2.portao3.com.br/realms/{realmId}/organizations/{organizationId}/accounts/{accountId}/card-limit \
  --header 'Content-Type: application/json' \
  --data '
{
  "amount": 150000,
  "startDate": "2026-11-01",
  "endDate": "2026-11-30",
  "cardIds": [
    "66f2a4b8b4d3e80012c9a0e1"
  ],
  "ruleIds": [
    "66f2a5a0b4d3e80012c9a0f1"
  ],
  "name": "Campaign budget"
}
'

import requests

url = "https://api.banking.v2.portao3.com.br/realms/{realmId}/organizations/{organizationId}/accounts/{accountId}/card-limit"

payload = {
    "amount": 150000,
    "startDate": "2026-11-01",
    "endDate": "2026-11-30",
    "cardIds": ["66f2a4b8b4d3e80012c9a0e1"],
    "ruleIds": ["66f2a5a0b4d3e80012c9a0f1"],
    "name": "Campaign budget"
}
headers = {"Content-Type": "application/json"}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {'Content-Type': 'application/json'},
  body: JSON.stringify({
    amount: 150000,
    startDate: '2026-11-01',
    endDate: '2026-11-30',
    cardIds: ['66f2a4b8b4d3e80012c9a0e1'],
    ruleIds: ['66f2a5a0b4d3e80012c9a0f1'],
    name: 'Campaign budget'
  })
};

fetch('https://api.banking.v2.portao3.com.br/realms/{realmId}/organizations/{organizationId}/accounts/{accountId}/card-limit', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.banking.v2.portao3.com.br/realms/{realmId}/organizations/{organizationId}/accounts/{accountId}/card-limit",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'amount' => 150000,
    'startDate' => '2026-11-01',
    'endDate' => '2026-11-30',
    'cardIds' => [
        '66f2a4b8b4d3e80012c9a0e1'
    ],
    'ruleIds' => [
        '66f2a5a0b4d3e80012c9a0f1'
    ],
    'name' => 'Campaign budget'
  ]),
  CURLOPT_HTTPHEADER => [
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.banking.v2.portao3.com.br/realms/{realmId}/organizations/{organizationId}/accounts/{accountId}/card-limit"

	payload := strings.NewReader("{\n  \"amount\": 150000,\n  \"startDate\": \"2026-11-01\",\n  \"endDate\": \"2026-11-30\",\n  \"cardIds\": [\n    \"66f2a4b8b4d3e80012c9a0e1\"\n  ],\n  \"ruleIds\": [\n    \"66f2a5a0b4d3e80012c9a0f1\"\n  ],\n  \"name\": \"Campaign budget\"\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://api.banking.v2.portao3.com.br/realms/{realmId}/organizations/{organizationId}/accounts/{accountId}/card-limit")
  .header("Content-Type", "application/json")
  .body("{\n  \"amount\": 150000,\n  \"startDate\": \"2026-11-01\",\n  \"endDate\": \"2026-11-30\",\n  \"cardIds\": [\n    \"66f2a4b8b4d3e80012c9a0e1\"\n  ],\n  \"ruleIds\": [\n    \"66f2a5a0b4d3e80012c9a0f1\"\n  ],\n  \"name\": \"Campaign budget\"\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://api.banking.v2.portao3.com.br/realms/{realmId}/organizations/{organizationId}/accounts/{accountId}/card-limit")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Content-Type"] = 'application/json'
request.body = "{\n  \"amount\": 150000,\n  \"startDate\": \"2026-11-01\",\n  \"endDate\": \"2026-11-30\",\n  \"cardIds\": [\n    \"66f2a4b8b4d3e80012c9a0e1\"\n  ],\n  \"ruleIds\": [\n    \"66f2a5a0b4d3e80012c9a0f1\"\n  ],\n  \"name\": \"Campaign budget\"\n}"

response = http.request(request)
puts response.read_body

{
  "_id": "66f2a5c2b4d3e80012c9a0f3",
  "realmId": "f495ff0c-ab54-4f99-8e92-ca8682e4de9b",
  "organizationId": "c4bd3f21-dfbd-44e8-8055-68ba15bed410",
  "accountId": "66f2a1c7b4d3e80012c9a0b4",
  "environment": "LIVE",
  "amount": 150000,
  "startDate": "2026-11-01",
  "endDate": "2026-11-30",
  "cardIds": [
    "66f2a4b8b4d3e80012c9a0e1"
  ],
  "ruleIds": [
    "66f2a5a0b4d3e80012c9a0f1"
  ],
  "external": {
    "controlId": "5d0e7a9c-3b21-4c6f-8e4d-9a7b1c2d3e4f"
  },
  "status": "ACTIVE",
  "createdAt": "2026-11-02T13:05:12.000Z",
  "updatedAt": "2026-11-02T13:05:12.000Z",
  "__v": 0,
  "name": "Campaign budget"
}

{
  "traceId": "1-68ee2a1b-3c4d5e6f7a8b9c0d1e2f3a4b",
  "code": "ACCOUNT_NOT_FOUND",
  "origin": "BANKING",
  "message": "Account not found"
}

{
  "traceId": "1-68ee2a1b-3c4d5e6f7a8b9c0d1e2f3a4b",
  "code": "BAD_REQUEST",
  "origin": "BANKING",
  "message": "Bad Request: Your request is invalid or incomplete. Please make sure you are requesting with the right fields.",
  "fields": [
    {
      "field": "amount",
      "message": "Invalid input: expected integer, received undefined",
      "code": "AMOUNT_REQUIRED"
    }
  ]
}

{
  "traceId": "1-68ee2a1b-3c4d5e6f7a8b9c0d1e2f3a4b",
  "code": "BANKING_PROVIDER_UNAVAILABLE",
  "origin": "BANKING",
  "message": "Banking provider temporarily unavailable, please retry"
}

{
  "traceId": "1-68ee2a1b-3c4d5e6f7a8b9c0d1e2f3a4b",
  "code": "BANKING_PROVIDER_UNAVAILABLE",
  "origin": "BANKING",
  "message": "Banking provider temporarily unavailable, please retry"
}

{
  "traceId": "1-68ee2a1b-3c4d5e6f7a8b9c0d1e2f3a4b",
  "code": "BANKING_PROVIDER_UNAVAILABLE",
  "origin": "BANKING",
  "message": "Banking provider temporarily unavailable, please retry"
}

{
  "traceId": "1-68ee2a1b-3c4d5e6f7a8b9c0d1e2f3a4b",
  "code": "BANKING_PROVIDER_UNAVAILABLE",
  "origin": "BANKING",
  "message": "Banking provider did not respond in time, please retry"
}

A card limit allows a purchase that fits its remaining amount, falls within its period and matches ANY of its ruleIds: your account’s rules, or the default rule sets HOTEL, FLIGHT, TRAVEL and FLEX_INTERNATIONAL (a permissive default to start with). A card can have several limits at once — on a reusable card, add a new one before each charge. The limit is created ACTIVE and expires after its endDate. Send x-environment: LIVE for production cards and rules. Any member of the organization can create limits.

Headers

x-environment

enum<string>

Environment to create the card limit in: LIVE (production) or TEST (sandbox). When you omit it, the limit is created in TEST; any other value is rejected.

Available options:

LIVE,

TEST

Path Parameters

realmId

string<uuid>

required

ID of your realm.

Format: UUID

organizationId

string<uuid>

required

ID of the organization the account belongs to.

Format: UUID

accountId

string

required

ID of the organization's account (24 hexadecimal characters).

Pattern: ^[0-9a-fA-F]{24}$

Body

application/json

amount

integer

required

Amount the cards can spend under this limit, in cents (BRL).

Required range: x >= 1

Example:

150000

startDate

string

required

First day of the limit, as YYYY-MM-DD.

Pattern: ^\d{4}-\d{2}-\d{2}

Example:

"2026-11-01"

endDate

string

required

Last day of the limit, as YYYY-MM-DD. The limit stops applying when this day ends.

Pattern: ^\d{4}-\d{2}-\d{2}

Example:

"2026-11-30"

cardIds

string[]

required

IDs of the account's cards the limit applies to, in this environment.

Example: ["66f2a4b8b4d3e80012c9a0e1"]

Minimum array length: 1

Pattern: ^[0-9a-fA-F]{24}$

ruleIds

string[]

required

Card limit rules the limit applies: IDs of your account's rules, or the names of the default rule sets HOTEL, FLIGHT, TRAVEL and FLEX_INTERNATIONAL. A transaction is allowed when any one of them matches.

Example: ["66f2a5a0b4d3e80012c9a0f1","FLEX_INTERNATIONAL"]

Minimum array length: 1

Pattern: ^([0-9a-fA-F]{24}|HOTEL|FLIGHT|TRAVEL|FLEX_INTERNATIONAL)$

name

string

Name of the limit, to tell it apart from the card's other limits.

Example:

"Campaign budget"

Response

Successful response

An amount a set of cards can spend during a period, under a set of rules.

_id

string

required

ID of the card limit.

Example:

"66f2a5c2b4d3e80012c9a0f3"

realmId

string<uuid>

required

ID of the realm the limit belongs to.

Example:

"f495ff0c-ab54-4f99-8e92-ca8682e4de9b"

organizationId

string<uuid>

required

ID of the organization the limit belongs to.

Example:

"c4bd3f21-dfbd-44e8-8055-68ba15bed410"

accountId

string

required

ID of the organization's account.

Example:

"66f2a1c7b4d3e80012c9a0b4"

environment

enum<string>

required

Environment of the limit: LIVE (production) or TEST (sandbox).

Available options:

LIVE,

TEST

Example:

"LIVE"

amount

number

required

Amount the cards can spend under this limit, in cents (BRL).

Example:

150000

startDate

string

required

First day of the limit, as YYYY-MM-DD.

Example:

"2026-11-01"

endDate

string

required

Last day of the limit, as YYYY-MM-DD. The limit stops applying when this day ends.

Example:

"2026-11-30"

cardIds

string[]

required

IDs of the cards the limit applies to.

Example: ["66f2a4b8b4d3e80012c9a0e1"]

ruleIds

string[]

required

IDs of the card limit rules the limit applies — a default rule set (such as FLEX_INTERNATIONAL) appears as the IDs of its rules. A transaction is allowed when any one of them matches.

Example: ["66f2a5a0b4d3e80012c9a0f1"]

external

object

required

Identifier of the card limit at the card issuer.

Show child attributes

status

enum<string>

required

Status of the limit: ACTIVE (it applies), EXPIRED (its endDate has passed — marked once a day, so it can still read ACTIVE for up to a day after it ends) or DELETED (removed).

Available options:

ACTIVE,

EXPIRED,

DELETED

Example:

"ACTIVE"

createdAt

string<date-time>

required

When the limit was created.

Example:

"2026-11-02T13:05:12.000Z"

updatedAt

string<date-time>

required

When the limit last changed.

Example:

"2026-11-02T13:05:12.000Z"

__v

number

required

Version of the record, incremented by some updates.

Example:

0

name

string

Name of the limit. Absent when it was created without one.

Example:

"Campaign budget"

Overview

Identity

Banking

Billing

Accounting

Registry

Platform

Notification

Rule Engine

Scheduling

Travel

Vehicles

Attachments

Create a card limit

Headers

Path Parameters

Body

Response