Update a lending program

PATCH/api/v1/credit/programs/{program_id}

Supplying late_terms, early_payoff_terms, or underwriting_criteria is what settles the corresponding open decision: the guarded code paths stop raising once a rule body exists. Moving a live program to active from another status is refused (CREDIT_660) while a blocking launch check fails, unless the patch carries force_activate with a reason. Operator action: an API token receives 403.

Operation ID: update_program·View as markdown·OpenAPI slice

Authentication

Bearer token authentication. Pass your DayZero API token in the Authorization header and the target business UUID in x-business-id.

Parameters

Path

program_idstringrequired

Request body

Schema: CreditProgramUpdateRequest

display_namestring
statusProgramStatusEnum
lending_modelLendingModel
limit_min_centsinteger
limit_max_centsinteger
allowed_term_daysarray · integer
default_rate_bpsinteger
default_disbursement_fee_bpsinteger
allocation_orderAllocationOrder
loan_orderingLoanOrdering
interest_accrual_startInterestAccrualStart
minimum_payment_centsinteger
due_soon_daysinteger
underwriting_wait_daysinteger: Days the nightly sweep leaves a new underwriting assessment pending while the merchant's data lands.
gl_posting_enabledboolean
gl_funding_ledger_idstring
gl_cash_ledger_idstring
interest_cap_pct_of_principal_bpsinteger: Ceiling on total interest per loan as a share of principal (2000 = 20%); null is uncapped. At the ceiling the loan's interest stops growing, statements bill no further interest, and the loan stays past_due. Reaches loans originated after the change only.
card_managementstring
deferred_fee_recognitionboolean
email_statementsboolean
noticesCreditNoticeSettings
complianceCompliancePolicy: Compliance policy. Replaces the stored one whole; null clears it.
bank_settlement_matchingboolean
alert_slack_channelstring
alert_emailsarray · string
allowance_policyobject
borrowing_base_policyBorrowingBasePolicy: Replaces the whole policy; fields left out take their defaults.
interchange_sourcestring
interchange_bpsinteger
issuing_providerstring
statement_balance_modestring
allocation_scopestring
cycle_close_rulestring
cycle_anchor_dayinteger
excess_credit_dispositionstring
collections_policyobject
limit_review_policyLimitReviewPolicy: Dynamic limit reviews. Send null to turn them off.
limit_change_policystring: direct, approval_required or console_only. Leaving direct is refused while the limit-review policy says apply: direct.
late_termsobject
early_payoff_termsobject
underwriting_criteriaarray · object
legal_lending_entitystring
statement_brandingobject
covenantsobject
event_delivery_modeEventDeliveryMode
issuing_enabledboolean
ramp_spend_program_idstring
ramp_cardholder_user_idstring: The issuing identity (see the create request). Verified as a user on the connected Ramp account when set; null clears it.
allowed_mcc_codesarray · string
blocked_mcc_codesarray · string
force_activateForceActivateRequest: Operator console only. With status: active on a live program that fails a blocking launch check, makes it active anyway; the reason, who and when are recorded as activation_override. Without it that change is refused (CREDIT_660); an API token cannot send it (CREDIT_661).

Responses

200Successful Response

Schema: SuccessEnvelope_CreditProgramResponse_

successboolean
messagestring
codestring
dataCreditProgramResponse

400Bad Request - Invalid input

Schema: ErrorResponse

errorstringrequired: Error category: validation_error, unauthorized, forbidden, not_found, conflict, rate_limited, server_error, or service_unavailable.
messagestringrequired: Human-readable explanation, safe to show to end users.
codestringrequired: Stable machine-readable code in CATEGORY_NNN form (e.g. NOT_FOUND_006, AUTH_010, GEN_002).
request_idstring: Correlation id for support requests. Echoes the x-request-id request header when one was supplied.
errorsobject: Field-level validation messages keyed by field name. Present on 400/422 validation failures only.

401Unauthorized - Missing or expired token, an MCP OAuth token used against the REST API, or no access to this business

Schema: ErrorResponse

errorstringrequired: Error category: validation_error, unauthorized, forbidden, not_found, conflict, rate_limited, server_error, or service_unavailable.
messagestringrequired: Human-readable explanation, safe to show to end users.
codestringrequired: Stable machine-readable code in CATEGORY_NNN form (e.g. NOT_FOUND_006, AUTH_010, GEN_002).
request_idstring: Correlation id for support requests. Echoes the x-request-id request header when one was supplied.
errorsobject: Field-level validation messages keyed by field name. Present on 400/422 validation failures only.

403Forbidden - Insufficient permissions

Schema: ErrorResponse

errorstringrequired: Error category: validation_error, unauthorized, forbidden, not_found, conflict, rate_limited, server_error, or service_unavailable.
messagestringrequired: Human-readable explanation, safe to show to end users.
codestringrequired: Stable machine-readable code in CATEGORY_NNN form (e.g. NOT_FOUND_006, AUTH_010, GEN_002).
request_idstring: Correlation id for support requests. Echoes the x-request-id request header when one was supplied.
errorsobject: Field-level validation messages keyed by field name. Present on 400/422 validation failures only.

404Not Found - Resource does not exist

Schema: ErrorResponse

errorstringrequired: Error category: validation_error, unauthorized, forbidden, not_found, conflict, rate_limited, server_error, or service_unavailable.
messagestringrequired: Human-readable explanation, safe to show to end users.
codestringrequired: Stable machine-readable code in CATEGORY_NNN form (e.g. NOT_FOUND_006, AUTH_010, GEN_002).
request_idstring: Correlation id for support requests. Echoes the x-request-id request header when one was supplied.
errorsobject: Field-level validation messages keyed by field name. Present on 400/422 validation failures only.

422Validation Error

Schema: ErrorResponse

errorstringrequired: Error category: validation_error, unauthorized, forbidden, not_found, conflict, rate_limited, server_error, or service_unavailable.
messagestringrequired: Human-readable explanation, safe to show to end users.
codestringrequired: Stable machine-readable code in CATEGORY_NNN form (e.g. NOT_FOUND_006, AUTH_010, GEN_002).
request_idstring: Correlation id for support requests. Echoes the x-request-id request header when one was supplied.
errorsobject: Field-level validation messages keyed by field name. Present on 400/422 validation failures only.

Code samples

PATCH/api/v1/credit/programs/{program_id}

bash

curl -X PATCH 'https://api.ondayzero.com/api/v1/credit/programs/{program_id}' \
  -H 'Authorization: Bearer dz_your_token' \
  -H 'x-business-id: YOUR_BUSINESS_ID' \
  -H 'Content-Type: application/json' \
  -d '{
  "display_name": "string",
  "status": "string",
  "lending_model": "string",
  "limit_min_cents": 0,
  "limit_max_cents": 0,
  "allowed_term_days": []
}'