Move per-transaction spending limits onto cards

[DhruvPareek]

Reason

Delegated-key spending limits cannot protect custodial-funded cards, and the public array shape implies multi-currency limits that a single-currency card does not need.

Overview

Moves the per-transaction limit to the card as one scalar maxSpendPerTransaction value in the smallest unit of the card currency. Create accepts an optional positive int64 and omission means unlimited. Card responses always include the nullable field. PATCH omits to preserve, supplies a positive integer to set, and supplies null to clear. The delegated-key limit contract and DelegatedKeySpendingLimit schema are removed.

The bundled CLI now exposes the scalar on card create/update through --max-spend-per-transaction, supports clearing it during update, and no longer advertises or serializes the removed delegated-key field.

This is intentionally breaking: there are no active production cards, so the change carries no legacy API compatibility or backfill.

Test Plan

• npm run lint:openapi
• (cd cli && npm test) — 80 tests passed
• (cd cli && npm run build)
• Bundled and validated openapi.yaml and mintlify/openapi.yaml

[mintlify]

Preview deployment for your docs. Learn more about Mintlify Previews.

Project	Status	Preview	Updated (UTC)
Grid	🟢 Ready	View Preview	Aug 12, 2026, 9:48 PM

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

2 Skipped Deployments

Project	Deployment	Actions	Updated (UTC)
grid-flow-builder	Ignored	Preview	Aug 18, 2026 12:48am
grid-wallet-demo	Ignored	Preview	Aug 18, 2026 12:48am

[github-actions]

⚠️ Breaking OpenAPI changes detected

oasdiff reports 2 error / 4 warning changes to openapi.yaml.
This PR will need approval from an API reviewer before merge.

Errors (2)

• POST webhook:card-funding-source-change — added the new required request property allOf[subschema #2]/data/maxSpendPerTransaction [new-required-request-property].
• POST webhook:card-state-change — added the new required request property allOf[subschema #2]/data/maxSpendPerTransaction [new-required-request-property].

Warnings (4)

Show sample

• GET /auth/delegated-keys — removed the optional property data/items/spendingLimits from the response with the 200 status [response-optional-property-removed].
• POST /auth/delegated-keys — removed the request property spendingLimits [request-property-removed].
• POST /auth/delegated-keys — removed the optional property spendingLimits from the response with the 201 status [response-optional-property-removed].
• GET /auth/delegated-keys/{id} — removed the optional property spendingLimits from the response with the 200 status [response-optional-property-removed].

---

Detected by oasdiff. Full report: job summary or the oasdiff-report artifact.

[DhruvPareek]

• Move per-transaction spending limits onto cards #818 👈 (View in Graphite)
• main

This stack of pull requests is managed by Graphite. Learn more about stacking.

[github-actions]

✱ Stainless preview builds for grid

This PR will update the grid SDKs with the following commit messages.

cli

feat(api): add spendingLimits to cards update and issue

go

feat(api): add spendingLimits to card create, update, response, and webhooks

kotlin

feat(api): add spendingLimits field to Card model and create/update requests

openapi

feat(api): add spendingLimits to cards create/update, remove from delegated keys

php

feat(api): add spendingLimits field and parameters to cards

python

feat(api): add spending_limits to cards issue/update methods and response

ruby

feat(api): add spending_limits to card create/update methods and response

typescript

feat(api): add spendingLimits parameter and field to cards

Edit this comment to update them. They will appear in their respective SDK's changelogs.

⚠️ grid-typescript studio · code · diff

Your SDK build had a failure in the lint CI job, which is a regression from the base state.
generate ✅ → build ✅ (prev: build ⏭️) → lint ❗ (prev: lint ⏭️) → test ✅

npm install https://pkg.stainless.com/s/grid-typescript/085d77e24217902b6f93a8855d885be8c60739f3/dist.tar.gz

✅ grid-openapi studio · code · diff

Your SDK build had at least one "warning" diagnostic, but this did not represent a regression.
generate ⚠️

✅ grid-ruby studio · code · diff

Your SDK build had at least one "note" diagnostic, but this did not represent a regression.
generate ✅ → build ✅ (prev: build ⏭️) → lint ✅ → test ✅

✅ grid-go studio · code · diff

Your SDK build had at least one "note" diagnostic, but this did not represent a regression.
generate ✅ → build ✅ (prev: build ⏭️) → lint ❗ → test ❗

go get github.com/stainless-sdks/grid-go@d95324c7d3454ab4a8a2376596667f02edf46114

✅ grid-kotlin studio · code · diff

Your SDK build had at least one "warning" diagnostic, but this did not represent a regression.
generate ⚠️ → build ✅ (prev: build ⏭️) → lint ✅ (prev: lint ⏭️) → test ❗

⚠️ grid-python studio · code · diff

Your SDK build had a failure in the lint CI job, which is a regression from the base state.
generate ✅ → build ✅ (prev: build ⏭️) → lint ❗ (prev: lint ⏭️) → test ❗

pip install https://pkg.stainless.com/s/grid-python/95959d799ac52809685033596f1c40d577f0d726/grid-0.0.1-py3-none-any.whl

✅ grid-php studio · code · diff

Your SDK build had at least one "note" diagnostic, but this did not represent a regression.
generate ✅ → lint ✅ → test ✅

✅ grid-cli studio · code · diff

Your SDK build had at least one "warning" diagnostic, but this did not represent a regression.
generate ⚠️ → build ❗ → lint ❗ → test ❗

---

This comment is auto-generated by GitHub Actions and is automatically kept up to date as you push.
If you push custom code to the preview branch, re-run this workflow to update the comment.
Last updated: 2026-08-18 00:52:36 UTC

[greptile-apps]

Greptile Summary

The PR moves per-transaction spending limits from delegated keys to a nullable scalar on cards and updates card create, update, response, and webhook contracts. The OpenAPI artifacts are internally synchronized, but the bundled CLI still exposes and sends the removed delegated-key field.

• Removes DelegatedKeySpendingLimit and delegated-key spendingLimits.
• Adds card-level maxSpendPerTransaction create, PATCH, response, and webhook semantics.
• Leaves the CLI's delegated-key spending-limit option on the obsolete request contract.

Confidence Score: 4/5

The PR should not merge until the CLI's obsolete delegated-key spending-limit option is removed or migrated to the card endpoints.

The OpenAPI contract removes delegated-key spending limits, while the checked-in CLI still advertises the option and sends the deleted field, causing user requests to fail or silently create an unprotected card.

Files Needing Attention: openapi/components/schemas/auth/DelegatedKeyCreateRequest.yaml and cli/src/commands/auth.ts

Important Files Changed

Filename	Overview
openapi/components/schemas/auth/DelegatedKeyCreateRequest.yaml	Removes delegated-key spending limits, but the repository CLI still sends the deleted request field.
openapi/components/schemas/cards/Card.yaml	Adds the required nullable card-level spending limit consistently to the shared Card response contract.
openapi/components/schemas/cards/CardCreateRequest.yaml	Adds an optional positive int64 limit with documented currency-unit and omission semantics.
openapi/components/schemas/cards/CardUpdateRequest.yaml	Adds the intended omission/value/null PATCH tri-state using the repository's established OpenAPI 3.1 nullable pattern.
openapi/paths/cards/cards_{id}.yaml	Documents setting and clearing the card limit and supplies representative PATCH examples.
openapi/webhooks/card-state-change.yaml	Updates all state-change examples to include the newly required nullable Card field.
openapi/webhooks/card-funding-source-change.yaml	Updates the funding-source-change example to include the newly required nullable Card field.
openapi.yaml	Generated bundle reflects the modular source changes consistently.
mintlify/openapi.yaml	Mintlify bundle remains synchronized with the root generated OpenAPI artifact.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart LR
  A[Card create or update] --> B[maxSpendPerTransaction]
  B --> C[Card resource]
  C --> D[Card response]
  C --> E[State-change webhook]
  C --> F[Funding-source-change webhook]
  G[Delegated-key creation] -. spendingLimits removed .-> H[Signing key]
  I[Existing CLI option] -- still sends spendingLimits --> G

Loading

Prompt To Fix All With AI

### Issue 1
openapi/components/schemas/auth/DelegatedKeyCreateRequest.yaml:24
**CLI sends removed limit field**

When a user runs `grid auth delegated-keys create --spending-limit USD:5000`, the CLI still serializes `spendingLimits` even though this change removes it from `DelegatedKeyCreateRequest`, causing the request to be rejected or the requested protection to be silently ignored.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

_{Reviews (1): Last reviewed commit: "feat(grid-api): move card spending limit..." | Re-trigger Greptile}