> ## Documentation Index
> Fetch the complete documentation index at: https://www.marqeta.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# List authorization controls

> List all authorization controls associated with a specific user or card product, or list all authorization controls defined in your program.

GET/authcontrols

List all authorization controls associated with a specific user or card product, or list all authorization controls defined in your program.

Include either a `user` or a `card_product` query parameter to indicate the user or card product whose associated authorization controls you want to retrieve (do not include both).

To list all authorization controls for your program, omit the `user` and `card_product` query parameters from your request.

## URL query parameters

| Fields | Description |
| - | - |
| card\_product string  Optional | Unique identifier of the card product whose associated authorization controls you want to retrieve. Enter the string "null" to list authorization controls that are not associated with a card product. **Allowable Values:**  Existing `card_product` token, or "null" |
| user string  Optional | Unique identifier of the user whose associated authorization controls you want to retrieve. Enter the string "null" to list authorization controls that are not associated with a user. **Allowable Values:**  Existing user token, or "null" |
| active string  Optional | Filters the returned authorization controls by active state. **Allowable Values:**  `true`, `false`, `all` **Default value:** `true` |
| count integer  Optional | The number of resources to retrieve. **Allowable Values:**  1-10 **Default value:** 5 |
| start\_index integer  Optional | Sort order index of the first resource in the returned array. **Allowable Values:**  Any integer |
| fields string  Optional | Comma-delimited list of fields to return (`field_1,field_2`, and so on). Leave blank to return all fields. **Allowable Values:**  Comma-delimited list of fields, or blank |
| sort\_by string  Optional | Field on which to sort. Use any field in the resource model, or one of the system fields `lastModifiedTime` or `createdTime`. Prefix the field name with a hyphen (`-`) to sort in descending order. Omit the hyphen to sort in ascending order. **Allowable Values:**  `createdTime`, `lastModifiedTime`, or any field in the resource model **Default value:** `-lastModifiedTime` |

## Response body

| Fields | Description |
| - | - |
| count integer  Conditionally returned | Number of resources retrieved. This field is returned if there are resources in your returned array. **Allowable Values:**  1-10 |
| data array of objects  Conditionally returned | Array of objects in a returned resource. Objects are returned as appropriate to your query. **Allowable Values:**  Valid array of one or more authorization control objects |
| data\[].**active** boolean  Conditionally returned | Indicates whether the authorization control is active. This field is returned if it exists in the resource. **Allowable Values:**  `true`, `false` |
| data\[].**association** object  Conditionally returned | Defines the group of users to which the authorization control applies. This object is required if the `merchant_scope` object is not included in your request. Your request can include both the `association` and `merchant_scope` objects. If you include this object in your request, you must populate one or more of its fields. If no fields are populated, the authorization control applies to all users. **Allowable Values:**  `card_product_token`, `user_token` |
| data\[].association.**card\_product\_token** string  Conditionally returned | Unique identifier of a card product. Specify a card product token in the `card_product_token` field to apply the authorization control to all users holding active cards associated with the card product. Pass either `card_product_token` or `user_token`, not both. **Allowable Values:**  1–36 chars |
| data\[].association.**user\_token** string  Conditionally returned | Unique identifier of a user. Specify a user token in the `user_token` field to apply the authorization control to a single user. Pass either `card_product_token` or `user_token`, not both. **Allowable Values:**  1–36 chars |
| data\[].**end\_time** datetime  Conditionally returned | Date and time when the exception ends, in UTC. This field is returned if it exists in the resource. **Allowable Values:**  datetime **Format:** yyyy-MM-ddThh:mm:ssZ |
| data\[].**merchant\_scope** object  Conditionally returned | Defines the group of merchants to which the authorization control applies. This object is required if the `association` object is not included in your request. Your request can include both the `merchant_scope` and `association` objects. If you include this object in your request, you must populate one or more of its fields. If no fields are populated, the authorization control applies to all merchants. **Allowable Values:**  `mcc`, `mcc_group`, `merchant_group_token`, `mid` |
| data\[].merchant\_scope.**mcc** string  Conditionally returned | Merchant Category Code (MCC). Identifies the type of goods or services provided by the merchant. Enter a value to control access to a particular type of product or service. See [Controlling Spending](https://www.marqeta.com/docs/developer-guides/controlling-spending.md) for links to more information about merchant category codes. **Allowable Values:**  1–4 chars |
| data\[].merchant\_scope.**mcc\_group** string  Conditionally returned | Token identifying a group of MCCs. Enter a value to control access to a group of product or service types. **Allowable Values:**  1–36 chars |
| data\[].merchant\_scope.**merchant\_group\_token** string  Conditionally returned | Unique identifier of a merchant group. Enter a value to control access to a group of merchants. **Allowable Values:**  1–36 chars |
| data\[].merchant\_scope.**mid** string  Conditionally returned | Merchant identifier (MID). Identifies a specific merchant. Enter a value to control access to a particular merchant. Use the exact MID value as it appears in the `card_acceptor.mid` field of your Gateway JIT Funding request or transaction webhook. Marqeta performs an exact match on this value — no normalization or formatting is applied. **Allowable Values:**  1–36 chars |
| data\[].**name** string  Returned | Name of the authorization control. **Allowable Values:**  255 char max |
| data\[].**start\_time** datetime  Conditionally returned | Date and time when the exception goes into effect, in UTC. This field is returned if it exists in the resource. **Allowable Values:**  datetime **Format:** yyyy-MM-ddThh:mm:ssZ |
| data\[].**token** string  Conditionally returned | Unique identifier of the authorization control. This field is returned if it exists in the resource. **Allowable Values:**  1–36 chars |
| end\_index integer  Conditionally returned | Sort order index of the last resource in the returned array. This field is returned if there are resources in your returned array. **Allowable Values:**  Any integer |
| is\_more boolean  Conditionally returned | A value of `true` indicates that more unreturned resources exist. A value of `false` indicates that no more unreturned resources exist. This field is returned if there are resources in your returned array. **Allowable Values:**  `true`, `false` |
| start\_index integer  Conditionally returned | Sort order index of the first resource in the returned array. This field is returned if there are resources in your returned array. **Allowable Values:**  Any integer |

## Sample response body

```json JSON lines wrap theme={null}
{
  "count": 1,
  "start_index": 0,
  "end_index": 0,
  "is_more": false,
  "data": [
    {
      "token": "my_authcontrol",
      "name": "My Auth Control",
      "active": true,
      "association": {
        "user_token": "my_user_01"
      },
      "merchant_scope": {
        "mcc": "5111"
      }
    }
  ]
}
```


## Related topics

- [Authorization Controls Overview](https://www.marqeta.com/docs/core-api/authorization-controls.md)
- [Retrieve authorization control](https://www.marqeta.com/docs/core-api/authorization-controls/retrieve-authorization-control.md)
- [How to configure spend controls](https://www.marqeta.com/docs/how-to-configure-spend-controls.md)
- [List velocity controls](https://www.marqeta.com/docs/core-api/velocity-controls/list-velocity-controls.md)
- [Limits and Controls in Europe](https://www.marqeta.com/docs/developer-guides/mq-eu-limits-controls.md)