Set merchant country

Set Merchant Country Spend Rule

The Set Merchant Country Spend Rule endpoint allows partners to define which countries a payment card may or may not transact with. By specifying allowed and/or blocked country lists using ISO 3166 alpha-3 codes, partners can enforce regional spending restrictions and compliance requirements on a per-card basis. This rule is evaluated at transaction time and applied in addition to any other spend rules configured for the card.

Endpoint

POST /api/spendRules/merchantCountry

Authentication

Bearer token required. Obtain via:

POST https://api.banking.netevia.dev/api/auth/v2

Include in header: Authorization: Bearer {token}
Token lifetime: 10 minutes. Refresh via POST /api/auth/refresh.

When to use

Use this endpoint when you need to restrict or permit card spending based on the merchant's country of operation. This is useful for corporate cards that should only be used domestically, for compliance with sanctions or regional financial regulations, or to limit cardholder spending to a defined set of approved countries. Configure after a payment card is issued and before the cardholder begins transacting.

Request Body

{
  "paymentCardId": "card_9f3a21bc4e7d8012",
  "allowed": [
    "USA",
    "CAN",
    "GBR",
    "DEU",
    "FRA"
  ],
  "blocked": [
    "PRK",
    "IRN",
    "SYR"
  ]
}

Response

200 OK

A 200 status indicates the merchant country spend rule was successfully created or updated for the specified payment card. The response body on success is empty or a simple confirmation object.

{}

Error Codes

Common Mistakes

• Supplying ISO 3166-1 alpha-2 codes (e.g., "US") instead of the required alpha-3 format (e.g., "USA"). All country values must be three-letter ISO 3166-1 alpha-3 codes.
• Omitting paymentCardId — this field is required and the request will be rejected without it.
• Setting both allowed and blocked lists without understanding precedence: if a country appears in both lists, verify that your intended behavior is accounted for in downstream rule evaluation.
• Sending an empty array [] when you intend no restriction — use null or omit the field entirely to indicate no list is active.

Related Endpoints

• POST /api/spendRules/merchantCategory — Set allowed or blocked merchant category codes (MCCs) for a payment card
• POST /api/spendRules/spendingLimit — Define spending limit rules for a payment card
• GET /api/spendRules/{paymentCardId} — Retrieve all spend rules currently configured for a payment card

Example

curl -X POST https://api.banking.netevia.dev/api/spendRules/merchantCountry \
  -H "Authorization: Bearer YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "paymentCardId": "card_9f3a21bc4e7d8012",
    "allowed": [
      "USA",
      "CAN",
      "GBR",
      "DEU",
      "FRA"
    ],
    "blocked": [
      "PRK",
      "IRN",
      "SYR"
    ]
  }'