User Authorization Control Deletion

User Authorization Control Deletion

The Delete Authorization Controls endpoint allows authenticated partners to remove specified authorization controls from one or more payment cards. Deleting a control means the associated security rules or spending thresholds will no longer be enforced for the targeted card. Changes take effect immediately upon a successful response.

Endpoint

DELETE /api/authorizationControls

Authentication

Bearer token required. Obtain via:

POST https://api.banking.netevia.dev/api/auth/v2

Include in header: Authorization: Bearer {token}
Token lifetime: 10 minutes. Refresh via POST /api/auth/refresh.

When to use

Use this endpoint when a previously applied authorization control is no longer needed — for example, when a spending limit or merchant-category restriction on a card should be lifted. It is also used when decommissioning a card or resetting its controls before applying a new rule set. Only users with sufficient permissions may delete authorization controls to protect the integrity of the banking system's security configuration.

Request Body

The request body is a JSON array of detach request objects. Each object targets one payment card and lists the control IDs to remove from it.

[
  {
    "paymentCardId": "card_abc123def456",
    "authorizationControlIds": [101, 102, 105]
  },
  {
    "paymentCardId": "card_xyz789ghi012",
    "authorizationControlIds": [200]
  }
]

Response

200 OK

A 200 OK response indicates all specified authorization controls were successfully deleted. No response body is returned.

Error Codes

Common Mistakes

• Sending a single object instead of an array — the request body must always be a JSON array, even when targeting a single card.
• Providing authorizationControlIds that do not belong to the specified paymentCardId, which will result in a 404 or no-op.
• Omitting paymentCardId when it is needed to identify the card; without it the platform cannot resolve which card's controls to delete.
• Using an expired Bearer token — tokens expire after 10 minutes and must be refreshed before making this call.

Related Endpoints

• GET /api/authorizationControls — Retrieve existing authorization controls for a payment card
• POST /api/authorizationControls — Create and attach new authorization controls to a payment card
• PUT /api/authorizationControls — Update existing authorization controls on a payment card

Example

curl -X DELETE https://api.banking.netevia.dev/api/authorizationControls \
  -H "Authorization: Bearer YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '[
    {
      "paymentCardId": "card_abc123def456",
      "authorizationControlIds": [101, 102, 105]
    }
  ]'