# Block a card

> 🔒 **Private label — [contact sales](mailto:sales@boyahq.com).** Requires a private-label entitlement on your API client.

Blocks the card belonging to the authenticated employee. Accessible by CARD_USER and admin roles. The card must belong to the calling employee.

Endpoint: PUT /cards/{id}/block
Version: 2.0.0
Security: oauth2ClientCredentials

## Path parameters:

  - `id` (string, required)

## Header parameters:

  - `org_wallet_ref` (string)
    Organization wallet reference, defaults to "1" if not provided

  - `business_id` (string, required)
    Business identifier for the request

## Request fields (application/json):

  - `reason` (string)
    Reason for blocking card

## Response 200 fields (application/json):

  - `_id` (string)
    Card MongoDB ID

  - `vcn` (string)
    Virtual card number (raw)

  - `ref` (string)
    Card reference

  - `last4` (string)
    Last 4 digits of card

  - `bin` (string)
    BIN number

  - `name` (string)
    Card name/label

  - `brand` (string)
    Card brand (VISA, Mastercard, etc.)

  - `provider` (string)
    Card provider/issuer

  - `employee` (object)
    Employee details

  - `employee._id` (string)
    Employee MongoDB ID

  - `employee.name` (string)
    Employee name

  - `employee.employee_id` (string)
    Employee ID

  - `employee.role` (string)
    Employee role

  - `business` (string)
    Business ID

  - `account` (string)
    Account ID

  - `user` (string)
    User ID

  - `exp_month` (string)
    Expiration month (MM)

  - `exp_year` (string)
    Expiration year (YY or YYYY)

  - `basis_fingerprint` (string)
    Basis fingerprint for security

  - `blocked` (boolean)
    Is card blocked

  - `retired` (boolean)
    Is card retired

  - `dormant` (boolean)
    Is card dormant

  - `purged` (boolean)
    Is card purged

  - `verified` (boolean)
    Is card verified

  - `is_virtual` (boolean)
    Is virtual card

  - `is_offline` (boolean)
    Is offline card

  - `physical_pin_set` (boolean)
    Physical PIN is set

  - `subscription_card` (boolean)
    Is subscription card

  - `balance` (number)
    Current card balance

  - `currency` (string)
    Card currency

  - `tracking_number` (string)
    Card delivery tracking number

  - `issued_on` (string)
    Card issued on timestamp

  - `issued_by` (string)
    Card issued by user

  - `updated_by` (string)
    Card updated by user

  - `blocked_by` (string)
    Blocked by user ID

  - `frisk` (number)
    Risk/frisk level

  - `wallet_type` (string)
    Wallet type

  - `works_only_at` (array)
    Places where card works only

  - `works_only_at_mid` (array)
    MID restrictions for works_only_at

  - `works_everywhere_except` (array)
    Places where card is blocked

  - `category_spend_limits` (array)
    Category spending limits

  - `events` (array)
    Card events history

  - `org_wallet_ref` (number)
    Organization wallet reference

  - `createdAt` (string)
    Created timestamp

  - `updatedAt` (string)
    Updated timestamp

  - `__v` (number)
    Version key

  - `statusDisplay` (string)
    Card status display name

  - `typeDisplay` (string)
    Card type display name

  - `isActive` (boolean)
    Is card active

  - `isExpired` (boolean)
    Is card expired

  - `expiryFormatted` (string)
    Formatted expiry date

  - `employeeName` (string)
    Employee name from employee object

  - `employeeId` (string)
    Employee ID from employee object

  - `approval_request` (object)
    Approval request object — present only for SINGLE USE PREPAID cards

  - `approval_request.ref` (string)
    Unique approval request reference

  - `approval_request.narrative` (string)
    Approval request narrative

  - `approval_request.initiated_by` (string)
    Employee ObjectId who initiated the request

  - `approval_request.initiated_on` (string)
    Timestamp when request was initiated

  - `approval_request.business` (string)
    Business ObjectId

  - `approval_request.status` (number)
    Request status: 0=pending, 1=approved, 2=rejected

  - `approval_request.is_batch` (boolean)
    Is batch request

  - `approval_request.action_type` (number)
    Action type enum value

  - `approval_request.mandate` (number)
    Mandate — number of approvals required

  - `approval_request.participants` (array)
    Approval participants

  - `approval_request.participants.employee` (string)
    Participant employee ObjectId

  - `approval_request.participants.id` (string)
    Employee identifier string

  - `approval_request.participants.status` (number)
    Participant status: 1=pending, 0=approved, 2=rejected

  - `approval_request.participants.reason` (string)
    Reason for decision

  - `approval_request.participants.approval_type` (number)
    Approval type: 1=mandatory, 0=optional

  - `approval_request.participants.requested_on` (string)
    Requested on timestamp

  - `approval_request.participants.actioned_on` (string)
    Actioned on timestamp

  - `approval_request.participants.level` (number)
    Approval hierarchy level

  - `approval_request.records` (array)
    Associated transaction records

  - `approval_request.org_wallet_ref` (string)
    Organization wallet reference

  - `approval_request.card` (string)
    Associated card ObjectId

  - `approval_request.auto_approve` (boolean)
    Auto approve flag

  - `approval_request.source` (string)
    Source of request

  - `approval_request.attachments` (array)
    Attachment file references

  - `approval_request.createdAt` (string)
    Created timestamp

  - `approval_request.updatedAt` (string)
    Updated timestamp