POST/
Limit where a user can make transactions to a single merchant or group of merchants. If multiple authorization controls apply to the same user, the limits of all controls are combined.
Request body
| Fields | Description |
|---|---|
| active boolean Optional | Indicates whether the authorization control is active. Allowable Values: true, falseDefault value: true |
| association object Optional | Defines the group of users to which the authorization control applies. This object is required if the merchant_scope object is not included in your request. Your request can include both the association and merchant_scope objects.If you include this object in your request, you must populate one or more of its fields. If no fields are populated, the authorization control applies to all users. Allowable Values: card_product_token, user_token |
| association.card_product_token string Optional | Unique identifier of a card product. Specify a card product token in the card_product_token field to apply the authorization control to all users holding active cards associated with the card product.Pass either card_product_token or user_token, not both.Allowable Values: 1–36 chars |
| association.user_token string Optional | Unique identifier of a user. Specify a user token in the user_token field to apply the authorization control to a single user.Pass either card_product_token or user_token, not both.Allowable Values: 1–36 chars |
| end_time datetime Optional | Date and time when the exception ends, in UTC. Allowable Values: datetime Format: yyyy-MM-ddThh:mm:ssZ |
| merchant_scope object Optional | Defines the group of merchants to which the authorization control applies. This object is required if the association object is not included in your request. Your request can include both the merchant_scope and association objects.If you include this object in your request, you must populate one or more of its fields. If no fields are populated, the authorization control applies to all merchants. Allowable Values: mcc, mcc_group, merchant_group_token, mid |
| merchant_scope.mcc string Optional | Merchant Category Code (MCC). Identifies the type of goods or services provided by the merchant. Enter a value to control access to a particular type of product or service. See Controlling Spending for links to more information about merchant category codes. Allowable Values: 1–4 chars |
| merchant_scope.mcc_group string Optional | Token identifying a group of MCCs. Enter a value to control access to a group of product or service types. Allowable Values: 1–36 chars |
| merchant_scope.merchant_group_token string Optional | Unique identifier of a merchant group. Enter a value to control access to a group of merchants. Allowable Values: 1–36 chars |
| merchant_scope.mid string Optional | Merchant identifier (MID). Identifies a specific merchant. Enter a value to control access to a particular merchant. Use the exact MID value as it appears in the card_acceptor.mid field of your Gateway JIT Funding request or transaction webhook. Marqeta performs an exact match on this value — no normalization or formatting is applied.Allowable Values: 1–36 chars |
| name string Required | Name of the authorization control. Allowable Values: 255 char max |
| start_time datetime Optional | Date and time when the exception goes into effect, in UTC. Allowable Values: datetime Format: yyyy-MM-ddThh:mm:ssZ |
| token string Optional | Unique identifier of the authorization control. If you do not include a token, the system will generate one automatically. This token is necessary for use in other API calls, so we recommend that rather than let the system generate one, you use a simple string that is easy to remember. This value cannot be updated. Allowable Values: 1–36 chars |
Sample request body
JSON
{
"merchant_scope": {
"mid": "98765"
},
"association": {
"user_token": "my_user_01"
},
"token": "my_authcontrol",
"name": "My Auth Control"
}
Response body
| Fields | Description |
|---|---|
| active boolean Conditionally returned | Indicates whether the authorization control is active. This field is returned if it exists in the resource. Allowable Values: true, false |
| association object Conditionally returned | Defines the group of users to which the authorization control applies. This object is required if the merchant_scope object is not included in your request. Your request can include both the association and merchant_scope objects.If you include this object in your request, you must populate one or more of its fields. If no fields are populated, the authorization control applies to all users. Allowable Values: card_product_token, user_token |
| association.card_product_token string Conditionally returned | Unique identifier of a card product. Specify a card product token in the card_product_token field to apply the authorization control to all users holding active cards associated with the card product.Pass either card_product_token or user_token, not both.Allowable Values: 1–36 chars |
| association.user_token string Conditionally returned | Unique identifier of a user. Specify a user token in the user_token field to apply the authorization control to a single user.Pass either card_product_token or user_token, not both.Allowable Values: 1–36 chars |
| end_time datetime Conditionally returned | Date and time when the exception ends, in UTC. This field is returned if it exists in the resource. Allowable Values: datetime Format: yyyy-MM-ddThh:mm:ssZ |
| merchant_scope object Conditionally returned | Defines the group of merchants to which the authorization control applies. This object is required if the association object is not included in your request. Your request can include both the merchant_scope and association objects.If you include this object in your request, you must populate one or more of its fields. If no fields are populated, the authorization control applies to all merchants. Allowable Values: mcc, mcc_group, merchant_group_token, mid |
| merchant_scope.mcc string Conditionally returned | Merchant Category Code (MCC). Identifies the type of goods or services provided by the merchant. Enter a value to control access to a particular type of product or service. See Controlling Spending for links to more information about merchant category codes. Allowable Values: 1–4 chars |
| merchant_scope.mcc_group string Conditionally returned | Token identifying a group of MCCs. Enter a value to control access to a group of product or service types. Allowable Values: 1–36 chars |
| merchant_scope.merchant_group_token string Conditionally returned | Unique identifier of a merchant group. Enter a value to control access to a group of merchants. Allowable Values: 1–36 chars |
| merchant_scope.mid string Conditionally returned | Merchant identifier (MID). Identifies a specific merchant. Enter a value to control access to a particular merchant. Use the exact MID value as it appears in the card_acceptor.mid field of your Gateway JIT Funding request or transaction webhook. Marqeta performs an exact match on this value — no normalization or formatting is applied.Allowable Values: 1–36 chars |
| name string Returned | Name of the authorization control. Allowable Values: 255 char max |
| start_time datetime Conditionally returned | Date and time when the exception goes into effect, in UTC. This field is returned if it exists in the resource. Allowable Values: datetime Format: yyyy-MM-ddThh:mm:ssZ |
| token string Conditionally returned | Unique identifier of the authorization control. This field is returned if it exists in the resource. Allowable Values: 1–36 chars |
Sample response body
JSON
{
"token": "my_authcontrol",
"name": "My Auth Control",
"active": true,
"association": {
"user_token": "my_user_01"
},
"merchant_scope": {
"mid": "98765"
}
}