Apply Authorization Controls

The POST /api/authorizationControls endpoint allows partners to apply authorization control rules to one or more payment cards. Rules can restrict per-transaction amounts, monthly spending limits, daily ATM withdrawal limits, allowed or blocked merchant categories, and allowed or blocked merchant countries. Each rule is applied independently and the response reports per-card success or failure.

Endpoint

POST /api/authorizationControls

Authentication

Bearer token required. Obtain via:

POST https://api.banking.netevia.dev/api/auth/v2

Include in header: Authorization: Bearer {token}
Token lifetime: 10 minutes. Refresh via POST /api/auth/refresh.

When to use

Use this endpoint when you need to enforce spending controls on a cardholder's payment cards — for example, blocking gambling merchants for a corporate card program, capping daily ATM withdrawals for a prepaid card, or restricting international transactions to specific countries. You can apply multiple rule types in a single call and target multiple cards simultaneously, making it suitable for bulk policy updates across an account or subprofile.

Request Body

Base rule fields (all rule types)

TransactionAmount rule — maximum single-transaction spending limit

MonthlyAmount rule — maximum monthly spend limit

DailyAtmWithdrawal rule — maximum daily ATM withdrawal limit

MerchantCategory rule — allow or block specific merchant category codes

MerchantCountry rule — allow or block transactions by merchant country

{
  "paymentCardIds": [
    "card_abc123",
    "card_def456"
  ],
  "rules": [
    {
      "type": "TransactionAmount",
      "amount": 50000
    },
    {
      "type": "MonthlyAmount",
      "amount": 500000
    },
    {
      "type": "DailyAtmWithdrawal",
      "amount": 30000
    },
    {
      "type": "MerchantCategory",
      "blocked": [
        "BETTING_CASINO_GAMBLING",
        "GOVERNMENT_LICENSED_ON_LINE_CASINO",
        "PACKAGE_STORES_BEER_WINE_AND_LIQUOR"
      ]
    },
    {
      "type": "MerchantCountry",
      "allowed": [
        "USA",
        "CAN",
        "GBR"
      ]
    }
  ]
}

Response

200 OK

Returns an array of result objects, one per payment card ID submitted.

[
  {
    "paymentCardId": "card_abc123",
    "success": true,
    "errors": null
  },
  {
    "paymentCardId": "card_def456",
    "success": false,
    "errors": "Card not found or not eligible for authorization controls."
  }
]

Error Codes

Common Mistakes

• Omitting the type field from a rule object — every rule must include "type" to identify which rule schema applies.
• Providing amount values in dollars instead of cents — all monetary amounts are in the smallest currency unit (cents). $50.00 must be submitted as 50000.
• Setting both allowed and blocked on the same MerchantCategory or MerchantCountry rule — use one or the other, not both, to avoid ambiguous behavior.
• Using ISO 3166 alpha-2 country codes (e.g., "US") instead of the required alpha-3 codes (e.g., "USA") in MerchantCountry rules.
• Submitting a stale Bearer token — tokens expire after 10 minutes. Refresh before making calls in long-running processes.

Related Endpoints

• POST /api/auth/v2 — Obtain a Bearer token
• POST /api/auth/refresh — Refresh an existing Bearer token
• GET /api/paymentCards — Retrieve payment card IDs for a customer
• POST /api/cards — Create a new payment card (physical, virtual, or burner)

Example

curl -X POST https://api.banking.netevia.dev/api/authorizationControls \
  -H "Authorization: Bearer YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "paymentCardIds": [
      "card_abc123"
    ],
    "rules": [
      {
        "type": "TransactionAmount",
        "amount": 50000
      },
      {
        "type": "MerchantCategory",
        "blocked": [
          "BETTING_CASINO_GAMBLING",
          "GOVERNMENT_LICENSED_ON_LINE_CASINO"
        ]
      },
      {
        "type": "MerchantCountry",
        "allowed": [
          "USA",
          "CAN"
        ]
      }
    ]
  }'