PATCH

Update a card bulk order

ENDPOINT/v1/card-bulk-orders/{card_bulk_order_id}

Applies a partial update to a bulk order's status or shipping address. Omitted fields are left unchanged. Set status to CANCELED to stop unshipped work. Fulfilled orders reject updates. Shipping can change only while status is PENDING.

Authentication & Headers

Header	Type	Requirement	Description
Authorization	string	REQUIRED	API key passed as an HTTP Bearer token: `Bearer rk_live_...`
X-Program-ID	UUID	PROGRAM-SCOPED	Program boundary UUID that scopes the issuing card, wallet, or transfer.
Content-Type	string	REQUIRED	Must be `application/json`.
Idempotency-Key	string	OPTIONAL	Unique UUID to prevent duplicate execution of financial creations or mutations.

Path Parameters

Parameter	Type	Requirement	Description
card_bulk_order_id	string	REQUIRED	Unique identifier of the card bulk order.

Request Body Schema

application/json

statusstring

optional

Lifecycle of a bulk physical-card order. `PENDING` is accepted and not yet sent to manufacturing. `PROCESSING` is in fulfillment. `FULFILLED` has produced every card. `CANCELED` stops work that has not shipped.

Enum values:PENDINGPROCESSINGFULFILLEDCANCELED

shippingobject

optional

Destination and carrier service for a physical card. Required when issuing, reissuing, converting, or bulk-ordering a physical card.

Properties of shipping

addressobjectrequired

Postal address. `country` is an ISO 3166-1 alpha-2 code. For US addresses, `state` is the two-letter subdivision and `postal_code` is the ZIP or ZIP+4.

methodstringrequired

Carrier service used to send a physical card. `STANDARD` is the default ground service. `EXPEDITED` and `OVERNIGHT` are faster at program rates.

Response Codes & Schemas

200The bulk order after the update.

application/json

{
  "id": "5e8a3c19-6d4f-4b72-91e0-2a7c5d8f0136",
  "object": "card_bulk_order",
  "status": "CANCELED",
  "count": 2,
  "card_ids": [
    "0c4e8f16-2a7b-4d93-b5e1-8f3a6c9d0142",
    "1d5f9a27-3b8c-4e04-c6f2-9e4b7d0e1253"
  ],
  "wallet_id": null,
  "product_id": null,
  "shipping": {
    "status": "ORDERED",
    "tracking": null,
    "method": "STANDARD",
    "address": {
      "line_1": "100 Main St",
      "line_2": "Suite 400",
      "city": "Austin",
      "state": "TX",
      "postal_code": "78701",
      "country": "US"
    }
  },
  "created_at": "2026-08-20T09:00:00Z",
  "updated_at": "2026-08-27T15:20:00Z"
}

400Bad Request: malformed JSON, failed schema validation, or conflicting parameters.

application/json

{
  "error": {
    "type": "invalid_request_error",
    "code": "invalid_request",
    "message": "invalid order by: foo. Valid options are: [created_at updated_at]",
    "param": "order_by",
    "request_id": "550e8400-e29b-41d4-a716-446655440000",
    "doc_url": "https://docs.rookpayments.com/errors/invalid_request"
  }
}

401Unauthorized: missing, malformed, or unknown API key.

application/json

{
  "error": {
    "type": "authentication_error",
    "code": "authentication_error",
    "message": "A valid API key is required.",
    "param": null,
    "request_id": "550e8400-e29b-41d4-a716-446655440000",
    "doc_url": "https://docs.rookpayments.com/errors/authentication_error"
  }
}

403Forbidden: the API key is denied by RBAC, or it cannot access this program. A resource that exists on another program or organization returns `404 not_found`, not `403`.

application/json

{
  "error": {
    "type": "permission_error",
    "code": "permission_denied",
    "message": "The API key cannot access this program.",
    "param": "X-Program-ID",
    "request_id": "550e8400-e29b-41d4-a716-446655440000",
    "doc_url": "https://docs.rookpayments.com/errors/permission_denied"
  }
}

404Not Found: unknown id, or the resource is not visible to this API key.

application/json

{
  "error": {
    "type": "not_found_error",
    "code": "not_found",
    "message": "No card found for the given id.",
    "param": "card_id",
    "request_id": "550e8400-e29b-41d4-a716-446655440000",
    "doc_url": "https://docs.rookpayments.com/errors/not_found"
  }
}

409Conflict: incompatible state, or Idempotency-Key reused with a different body.

application/json

{
  "error": {
    "type": "conflict_error",
    "code": "conflict",
    "message": "The card cannot be reissued from its current state.",
    "param": null,
    "request_id": "550e8400-e29b-41d4-a716-446655440000",
    "doc_url": "https://docs.rookpayments.com/errors/conflict"
  }
}

422Unprocessable Entity: the document is valid JSON but violates a business rule.

application/json

{
  "error": {
    "type": "invalid_request_error",
    "code": "insufficient_funds",
    "message": "The source financial account does not have enough available balance.",
    "param": "amount",
    "request_id": "550e8400-e29b-41d4-a716-446655440000",
    "doc_url": "https://docs.rookpayments.com/errors/insufficient_funds"
  }
}

429Too Many Requests: the API key exceeded its rate limit.

application/json

{
  "error": {
    "type": "rate_limit_error",
    "code": "rate_limited",
    "message": "Rate limit exceeded. Retry after the number of seconds in Retry-After.",
    "param": null,
    "request_id": "550e8400-e29b-41d4-a716-446655440000",
    "doc_url": "https://docs.rookpayments.com/errors/rate_limited"
  }
}

500Internal Server Error: unexpected failure. Retry with the same Idempotency-Key.

application/json

{
  "error": {
    "type": "api_error",
    "code": "internal_error",
    "message": "An unexpected error occurred. Retry with the same Idempotency-Key.",
    "param": null,
    "request_id": "550e8400-e29b-41d4-a716-446655440000",
    "doc_url": "https://docs.rookpayments.com/errors/internal_error"
  }
}