---
title: "Update bank account restriction"
method: POST
path: "/v0/bank/account-restrictions/{bank-account-restriction-id}/actions/update"
tags: ["Bank account restrictions"]
---

# Update bank account restriction

`POST /v0/bank/account-restrictions/{bank-account-restriction-id}/actions/update`

Updates a bank account restriction.

Allows you to change the restriction type, reason code, and/or legal status of an
active restriction. Notes are always required to provide context for the change.

Only the fields you include in the request body will be updated. Omitted fields
are left unchanged.

## Path parameters

- `bank-account-restriction-id` string, required

## Request body

- object
  - `restriction-type` 'block' | 'freeze'
  - `restriction-reason-code` 'fraud-app-perpetrator' | 'customer-request' | 'dormant' | 'other' | 'terrorist-financing' | 'law-enforcement' | 'sanctions' | 'risk-appetite' | 'deceased' | 'fraud-app-victim' | 'fraud-3rd-party' | 'money-laundering' | 'fraud-1st-party'
  - `restriction-legal-status` 'not-applicable' | 'conviction-confirmed' | 'formal-charge-filed' | 'suspected'
  - `notes` string, required

## Response `200`

OK

- object — A bank account restriction.
  - `lift-bank-account-restriction-url` union — Link to lift a bank account restriction.
    - string
    - string
  - `restriction-status` union, required
    - 'lifted' | 'active'
    - string
  - `restriction-legal-status` union
    - 'not-applicable' | 'conviction-confirmed' | 'formal-charge-filed' | 'suspected'
    - string
  - `bank-account-restriction-url` union, required — Link to a bank account restriction.
    - string
    - string
  - `created-at` string, date-time, required — ISO 8601 formatted date-time.
  - `update-bank-account-restriction-url` union — Link to update a bank account restriction.
    - string
    - string
  - `bank-account-restriction-events-url` union, required — Link to events for a bank account restriction.
    - string
    - string
  - `restriction-reason-code` union
    - 'suspicious' | 'fraud-app-perpetrator' | 'customer-request' | 'dormant' | 'other' | 'terrorist-financing' | 'law-enforcement' | 'sanctions' | 'risk-appetite' | 'deceased' | 'fraud-app-victim' | 'fraud-3rd-party' | 'money-laundering' | 'fraud' | 'high-risk-pep' | 'fraud-1st-party'
    - string
  - `restriction-type` union
    - 'block' | 'freeze'
    - string
  - `account-url` union, required — Link to the bank account resource.
    - string
    - string
  - `restriction-applied-by` union, required
    - object
      - `restriction-applied-by-type` 'ops-user', required
    - object
      - `restriction-applied-by-type` 'user', required
      - `user-url` string, required — Link to the user.
      - `user-username` string — The username.

## Other responses

- `400` — Bad Request
- `401` — Requires an API key to continue
- `403` — Forbidden
- `404` — Not Found
- `422` — The restriction is not active or can only be updated by Griffin
- `500` — Internal Server Error

---

[API](https://skmtc.net/griffin/apis/the-griffin-api.md) · [All operations](https://skmtc.net/griffin/apis/the-griffin-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/griffin/the-griffin-api/revisions/178ed43d543b/schema)