[Daily-Spend-Limits]: Add UTC daily card spending limit contract

[DhruvPareek]

Cards can cap individual authorizations but cannot bound cumulative spend across a day. This contract adds card- and platform-level maxSpendPerDay controls with the lower configured value taking precedence.

Daily windows reset at 00:00 UTC. Refunds, reversals, and authorization expiries do not restore capacity during the same day, keeping the limit deterministic for integrators.

The card-management guide documents limit updates as direct BasicAuth PATCH /cards/{id} requests returning 200 OK, matching the endpoint contract.

Test Plan

• make lint-openapi — passed with existing warnings and no errors
• git diff --check

---

created with claude session 4488e661-03aa-4894-8387-647fcee1344e

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

2 Skipped Deployments

Project	Deployment	Actions	Updated (UTC)
grid-flow-builder	Ignored	Preview	Aug 29, 2026 9:27pm
grid-wallet-demo	Ignored	Preview	Aug 29, 2026 9:27pm

[DhruvPareek]

Warning

This pull request is not mergeable via GitHub because a downstack PR is open. Once all requirements are satisfied, merge this PR as a stack on Graphite.
Learn more

• [Daily-Spend-Limits]: Add UTC daily card spending limit contract #878 👈 (View in Graphite)
• [platform-spending-caps]: add a platform per-transaction spending cap #865
• main

This stack of pull requests is managed by Graphite. Learn more about stacking.

[github-actions]

✱ Stainless preview builds for grid

This PR will update the grid SDKs with the following commit messages.

cli
⏳ (generating...)```
feat: �[KAdd UTC daily card spending limit contract

**go**
⏳ (generating...)```
feat: �[KAdd UTC daily card spending limit contract

kotlin
⏳ (generating...)```
feat: �[KAdd UTC daily card spending limit contract

**openapi**
⏳ (generating...)```
feat: �[KAdd UTC daily card spending limit contract

php
⏳ (generating...)```
feat: �[KAdd UTC daily card spending limit contract

**python**
⏳ (generating...)```
feat: �[KAdd UTC daily card spending limit contract

ruby
⏳ (generating...)```
feat: �[KAdd UTC daily card spending limit contract

**typescript**
⏳ (generating...)```
feat: �[KAdd UTC daily card spending limit contract

Edit this comment to update them. They will appear in their respective SDK's changelogs.

⏳ grid-typescript studio

⏳ grid-openapi studio

⏳ grid-ruby studio

⏳ grid-kotlin studio

⏳ grid-go studio

⏳ grid-python studio

⏳ grid-php studio

⏳ grid-cli studio

⏳ These are partial results; builds are still running.

---

This comment is auto-generated by GitHub Actions and is automatically kept up to date as you push.
If you push custom code to the preview branch, re-run this workflow to update the comment.
Last updated: 2026-08-29 21:37:50 UTC

[greptile-apps]

Greptile Summary

The PR extends the card contract with card- and platform-level UTC daily spending limits, including nullable updates and full Card webhook payloads.

• Adds maxSpendPerDay to card create, update, response, and platform configuration schemas.
• Documents lower-of-card-and-platform precedence, UTC reset boundaries, and non-restoration after refunds, reversals, or authorization expiry.
• Updates bundled specifications, webhook examples, and card integration guides.

Confidence Score: 4/5

The PR should not merge until the daily-limit guide is aligned with the endpoint’s direct BasicAuth request flow.

The OpenAPI contract defines PATCH /cards/{id} as a single BasicAuth request returning 200, but the newly added daily-limit example requires credentials from a nonexistent prior 202 signing response.

Files Needing Attention: mintlify/snippets/cards/freezing-and-closing.mdx

Important Files Changed

Filename	Overview
openapi/components/schemas/cards/Card.yaml	Adds a required nullable daily-limit field to the canonical Card response shared by card endpoints and webhooks.
openapi/components/schemas/cards/CardCreateRequest.yaml	Adds the optional positive maxSpendPerDay issuance input and its UTC-window semantics.
openapi/components/schemas/cards/CardUpdateRequest.yaml	Adds nullable set-or-clear semantics for card-specific daily limits.
openapi/components/schemas/config/CardConfig.yaml	Adds the platform-wide daily cap and lower-limit precedence contract.
openapi/paths/cards/cards_{id}.yaml	Documents direct BasicAuth updates for the new daily-limit field and returns the updated Card with 200.
mintlify/snippets/cards/freezing-and-closing.mdx	Adds a daily-limit example that incorrectly requires a signed retry despite the endpoint’s direct BasicAuth contract.
openapi/webhooks/card-state-change.yaml	Keeps full Card state-change examples aligned with the newly required daily-limit field.
openapi/webhooks/card-funding-source-change.yaml	Keeps the funding-source webhook’s full Card example aligned with the new field.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    CardLimit[Card maxSpendPerDay] --> Effective{Lower configured value}
    PlatformLimit[Platform maxSpendPerDay] --> Effective
    Effective --> Authorizations[Cumulative new spend]
    Authorizations --> Decision{Within effective limit?}
    Decision -->|Yes| Approve[Authorization may proceed]
    Decision -->|No| Decline[Decline authorization]
    Reset[00:00 UTC] --> NewWindow[Start new daily window]
    NewWindow --> Authorizations
    Refunds[Refunds, reversals, and expiries] -. do not restore capacity .-> Authorizations

Loading

Prompt To Fix All With AI

### Issue 1
mintlify/snippets/cards/freezing-and-closing.mdx:160-161
**Daily limit uses wrong flow**

When an integrator follows this new example, it requires a signature and request ID from a prior `202`, but `PATCH /cards/{id}` is a direct BasicAuth operation that returns `200` and never provides that signing payload, so the documented daily-limit update cannot be completed as described.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

_{Reviews (1): Last reviewed commit: "feat(cards): add daily spending limit co..." | Re-trigger Greptile}