[Daily-Spend-Limits]: Add UTC daily card spending limit contract

[DhruvPareek]

Cards can cap individual authorizations but cannot bound cumulative spend across a day. This contract adds card- and platform-level maxSpendPerDay controls with the lower configured value taking precedence.

Daily windows reset at 00:00 UTC. Refunds, reversals, and authorization expiries do not restore capacity during the same day, keeping the limit deterministic for integrators.

The card-management guide documents limit updates as direct BasicAuth PATCH /cards/{id} requests returning 200 OK, matching the endpoint contract.

Test Plan

• make lint-openapi — passed with existing warnings and no errors
• git diff --check

---

created with claude session 4488e661-03aa-4894-8387-647fcee1344e

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

2 Skipped Deployments

Project	Deployment	Actions	Updated
grid-flow-builder	Ignored	Preview	Sep 1, 2026 9:40pm UTC
grid-wallet-demo	Ignored	Preview	Sep 1, 2026 9:40pm UTC

[DhruvPareek]

• [Daily-Spend-Limits]: Add UTC daily card spending limit contract #878 👈 (View in Graphite)
• [platform-spending-caps]: add a platform per-transaction spending cap #865
• main

This stack of pull requests is managed by Graphite. Learn more about stacking.

[github-actions]

✱ Stainless preview builds for grid

This PR will update the grid SDKs with the following commit messages.

cli

feat(api): add maxSpendPerDay parameter to cards and config methods

go

feat(api): add maxSpendPerDay to card create/update, config update, and webhook events

kotlin

feat(api): add maxSpendPerDay field to card and config types

openapi

feat(api): add maxSpendPerDay parameter to cards and platform config

php

feat(api): add maxSpendPerDay to cards and config

python

feat(api): add max_spend_per_day parameter to cards update/issue and config methods

ruby

feat(api): add max_spend_per_day to cards and platform config

typescript

feat(api): add maxSpendPerDay to cards and config

Edit this comment to update them. They will appear in their respective SDK's changelogs.

✅ grid-typescript studio · code · diff

Your SDK build had at least one "note" diagnostic, but this did not represent a regression.
generate ✅ → build ✅ → lint ❗ → test ✅

npm install https://pkg.stainless.com/s/grid-typescript/0483fd468ae98c99f882fb776e971f9661cafea6/dist.tar.gz

✅ grid-cli studio · code · diff

Your SDK build had at least one "warning" diagnostic, but this did not represent a regression.
generate ⚠️ → build ❗ → lint ❗ → test ❗

✅ grid-openapi studio · code · diff

Your SDK build had at least one "warning" diagnostic, but this did not represent a regression.
generate ⚠️

✅ grid-ruby studio · code · diff

Your SDK build had at least one "note" diagnostic, but this did not represent a regression.
generate ✅ → build ✅ → lint ✅ → test ✅

✅ grid-kotlin studio · code · diff

Your SDK build had at least one "warning" diagnostic, but this did not represent a regression.
generate ⚠️ → build ✅ → lint ✅ → test ❗

✅ grid-go studio · code · diff

Your SDK build had at least one "note" diagnostic, but this did not represent a regression.
generate ✅ → build ✅ → lint ❗ → test ❗

go get github.com/stainless-sdks/grid-go@53d0f82bb2235bb908cfe3f272e4c54fc901194c

✅ grid-python studio · code · diff

Your SDK build had at least one "note" diagnostic, but this did not represent a regression.
generate ✅ → build ✅ → lint ❗ → test ❗

pip install https://pkg.stainless.com/s/grid-python/53eacad274417fc5f2defa877afdcfcc7d602072/grid-0.0.1-py3-none-any.whl

✅ grid-php studio · code · diff

Your SDK build had at least one "note" diagnostic, but this did not represent a regression.
generate ✅ → lint ✅ → test ✅

---

This comment is auto-generated by GitHub Actions and is automatically kept up to date as you push.
If you push custom code to the preview branch, re-run this workflow to update the comment.
Last updated: 2026-09-01 21:47:56 UTC

[greptile-apps]

Greptile Summary

The PR extends the card contract with card- and platform-level UTC daily spending limits, including nullable updates and full Card webhook payloads.

• Adds maxSpendPerDay to card create, update, response, and platform configuration schemas.
• Documents lower-of-card-and-platform precedence, UTC reset boundaries, and non-restoration after refunds, reversals, or authorization expiry.
• Updates bundled specifications, webhook examples, and card integration guides.

Confidence Score: 4/5

The PR should not merge until the daily-limit guide is aligned with the endpoint’s direct BasicAuth request flow.

The OpenAPI contract defines PATCH /cards/{id} as a single BasicAuth request returning 200, but the newly added daily-limit example requires credentials from a nonexistent prior 202 signing response.

Files Needing Attention: mintlify/snippets/cards/freezing-and-closing.mdx

Important Files Changed

Filename	Overview
openapi/components/schemas/cards/Card.yaml	Adds a required nullable daily-limit field to the canonical Card response shared by card endpoints and webhooks.
openapi/components/schemas/cards/CardCreateRequest.yaml	Adds the optional positive maxSpendPerDay issuance input and its UTC-window semantics.
openapi/components/schemas/cards/CardUpdateRequest.yaml	Adds nullable set-or-clear semantics for card-specific daily limits.
openapi/components/schemas/config/CardConfig.yaml	Adds the platform-wide daily cap and lower-limit precedence contract.
openapi/paths/cards/cards_{id}.yaml	Documents direct BasicAuth updates for the new daily-limit field and returns the updated Card with 200.
mintlify/snippets/cards/freezing-and-closing.mdx	Adds a daily-limit example that incorrectly requires a signed retry despite the endpoint’s direct BasicAuth contract.
openapi/webhooks/card-state-change.yaml	Keeps full Card state-change examples aligned with the newly required daily-limit field.
openapi/webhooks/card-funding-source-change.yaml	Keeps the funding-source webhook’s full Card example aligned with the new field.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    CardLimit[Card maxSpendPerDay] --> Effective{Lower configured value}
    PlatformLimit[Platform maxSpendPerDay] --> Effective
    Effective --> Authorizations[Cumulative new spend]
    Authorizations --> Decision{Within effective limit?}
    Decision -->|Yes| Approve[Authorization may proceed]
    Decision -->|No| Decline[Decline authorization]
    Reset[00:00 UTC] --> NewWindow[Start new daily window]
    NewWindow --> Authorizations
    Refunds[Refunds, reversals, and expiries] -. do not restore capacity .-> Authorizations

Loading

Prompt To Fix All With AI

### Issue 1
mintlify/snippets/cards/freezing-and-closing.mdx:160-161
**Daily limit uses wrong flow**

When an integrator follows this new example, it requires a signature and request ID from a prior `202`, but `PATCH /cards/{id}` is a direct BasicAuth operation that returns `200` and never provides that signing payload, so the documented daily-limit update cannot be completed as described.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

_{Reviews (1): Last reviewed commit: "feat(cards): add daily spending limit co..." | Re-trigger Greptile}

The base branch was changed.

[mintlify]

Preview deployment for your docs. Learn more about Mintlify Previews.

Project	Status	Preview	Updated (UTC)
Grid	🟢 Ready	View Preview	Sep 1, 2026, 9:41 PM

[github-actions]

⚠️ Breaking OpenAPI changes detected

oasdiff reports 2 error / 0 warning changes to openapi.yaml.
This PR will need approval from an API reviewer before merge.

Errors (2)

• POST webhook:card-funding-source-change — added the new required request property allOf[subschema #2]/data/maxSpendPerDay [new-required-request-property].
• POST webhook:card-state-change — added the new required request property allOf[subschema #2]/data/maxSpendPerDay [new-required-request-property].

---

Detected by oasdiff. Full report: job summary or the oasdiff-report artifact.