Changelog

v1.2.0 - August 2026

POST /partner/cardholders and PATCH /partner/cardholders/{id} now accept optional residence address fields (residenceCountryCode, residenceStateProvince, residenceCity, residenceAddressDetail, postalCode) on share-token KYC. These are a fallback for cardholders verified with a travel document, which carries no residential address to extract — an address extracted from the KYC session always takes precedence. Supply all five fields or none; a partially-filled address is ignored. See Card holders.
Documented the restricted countries and regions where cardholders cannot be onboarded, and how that rejection surfaces via cardholder.kyc.updated.

PATCH /partner/cards/{id}/limits now accepts a spendControl body with per-transaction-type velocity caps (sales, cash) across perTransaction, daily, monthly, and allTime horizons. See the Spend control guide.
Card object exposes a spendControl field summarising caps and (where the card program reports it) accrued spend.

The legacy body { "limit": <number|null> } on PATCH /partner/cards/{id}/limits continues to work for one release. It is mapped to { "spendControl": { "sales": { "allTime": <n> }, "cash": { "allTime": <n> } } }. The top-level limit field on the card object is now derived from spendControl.sales.allTime and is marked deprecated.

Initial release of the Contro Partner API.

Card Programs - list and retrieve available card programs
Cardholders - create, list, get, update cardholders with KYC initiation and status
Cards - issue, activate, freeze, unfreeze, cancel cards with spending limit management and transaction history
Balance - check partner balance and list balance transactions
Webhooks - configure webhook URL/secret/events, list delivery events, retry failed deliveries
Usage & Billing - usage summaries and detailed records by billing period

API key authentication via x-contro-api-key header with sandbox (sk_test_*) and production (sk_live_*) keys
Cursor-based pagination across all list endpoints
HMAC-SHA256 webhook signature verification
Rate limiting at 1,000 requests per minute
Consistent error format across all endpoints