Get Authorization Controls

The GET /api/authorizationControls endpoint returns the active authorization control rules configured for payment cards associated with the authenticated user. Each rule governs a specific dimension of card usage, such as per-transaction spending limits, monthly spending caps, daily ATM withdrawal limits, allowed or blocked merchant categories, and allowed or blocked merchant countries. Partners use this endpoint to inspect and audit the security and spending policy layer applied to their customers' cards.

Endpoint

GET /api/authorizationControls

Authentication

Bearer token required. Obtain via:

POST https://api.banking.netevia.dev/api/auth/v2

Include in header: Authorization: Bearer {token}
Token lifetime: 10 minutes. Refresh via POST /api/auth/refresh.

When to use

Use this endpoint when you need to display a card's current spending controls to a cardholder or administrator, verify that a specific rule is active before attempting a transaction, or audit compliance of card policies across multiple cards. It is also useful when troubleshooting declined transactions where a merchant category or country restriction may be the cause.

Query Parameters

Response

200 OK

authorizationControls item

rule object — TransactionAmount

rule object — MonthlyAmount

rule object — DailyAtmWithdrawal

rule object — MerchantCategory

rule object — MerchantCountry

[
  {
    "userProfileId": 10234,
    "paymentCardId": "card_abc123def456",
    "formFactor": null,
    "last4": null,
    "cardholder": null,
    "authorizationControls": [
      {
        "id": 1,
        "type": "TransactionAmount",
        "rule": {
          "type": "TransactionAmount",
          "id": "rule_001",
          "amount": 50000
        }
      },
      {
        "id": 2,
        "type": "MonthlyAmount",
        "rule": {
          "type": "MonthlyAmount",
          "id": "rule_002",
          "amount": 500000
        }
      },
      {
        "id": 3,
        "type": "DailyAtmWithdrawal",
        "rule": {
          "type": "DailyAtmWithdrawal",
          "id": "rule_003",
          "amount": 30000,
          "merchantCategoryRule": null
        }
      },
      {
        "id": 4,
        "type": "MerchantCategory",
        "rule": {
          "type": "MerchantCategory",
          "id": "rule_004",
          "allowed": [
            "GROCERY_STORES_SUPERMARKETS",
            "SERVICE_STATIONS",
            "DRUG_STORES_AND_PHARMACIES"
          ],
          "blocked": [
            "BETTING_CASINO_GAMBLING",
            "PACKAGE_STORES_BEER_WINE_AND_LIQUOR"
          ]
        }
      },
      {
        "id": 5,
        "type": "MerchantCountry",
        "rule": {
          "type": "MerchantCountry",
          "id": "rule_005",
          "allowed": ["USA", "CAN", "GBR"],
          "blocked": null
        }
      }
    ]
  }
]

Error Codes

Common Mistakes

• Passing raw card numbers in paymentCardIds instead of the Netevia internal card ID (paymentCardId) returned when the card was created.
• Expecting deprecated fields (formFactor, last4, cardholder) to be populated — these are marked deprecated and may return null.
• Interpreting a null allowed list as "nothing is allowed." A null allowed array means no allowlist is in effect (all categories/countries are permitted unless individually blocked).
• Interpreting a null blocked list as "nothing is blocked." A null blocked array means no blocklist is in effect.
• Forgetting that amount values are in cents (integer). A value of 50000 represents $500.00, not $50,000.

Related Endpoints

• POST /api/authorizationControls — Create a new authorization control rule for a payment card.
• PUT /api/authorizationControls/{id} — Update an existing authorization control rule.
• DELETE /api/authorizationControls/{id} — Remove an authorization control rule from a payment card.
• GET /api/paymentCards — List payment cards for the authenticated user.

Example

curl -X GET "https://api.banking.netevia.dev/api/authorizationControls?paymentCardIds=card_abc123def456&paymentCardIds=card_xyz789ghi012" \
  -H "Authorization: Bearer YOUR_TOKEN" \
  -H "Content-Type: application/json"