Create a merchant identifier (MID) exemption - Marqeta Docs

POST//

Exempt an individual merchant from authorization controls by merchant identifier (MID). Transactions originating from this MID ignore any otherwise applicable authorization controls.

Note
You can create MID exemptions in your user sandbox. However, you must work with your Marqeta representative to create MID exemptions in a production environment.

Request body

Fields	Description
association object Optional	Defines the group of users to which the authorization control applies. This object is required if the `merchant_scope` object is not included in your request. Your request can include both the `association` and `merchant_scope` objects. If you include this object in your request, you must populate one or more of its fields. If no fields are populated, the authorization control applies to all users. Allowable Values: `card_product_token`, `user_token`
association.card_product_token string Optional	Unique identifier of a card product. Specify a card product token in the `card_product_token` field to apply the authorization control to all users holding active cards associated with the card product. Pass either `card_product_token` or `user_token`, not both. Allowable Values: 1–36 chars
association.user_token string Optional	Unique identifier of a user. Specify a user token in the `user_token` field to apply the authorization control to a single user. Pass either `card_product_token` or `user_token`, not both. Allowable Values: 1–36 chars
end_time datetime Optional	Date and time when the exception ends, in UTC. Allowable Values: datetime Format: yyyy-MM-ddThh:mm:ssZ
merchant_group_token string Optional	Unique identifier of the merchant group to be exempted. This field is required if there is no entry in the `mid` field. Pass either this field or the `mid` field, not both. For information about merchant groups, see Merchant Groups. Allowable Values: 1–36 chars
mid string Optional	Merchant to be exempted. This field is required if there is no entry in the `merchant_group_token` field. Use either this field or the `merchant_group_token` field, not both. If you include this field in your request, use the exact MID value as it appears in the `card_acceptor.mid` field of your Gateway JIT Funding request or transaction webhook. Marqeta performs an exact match on this value — no normalization or formatting is applied. If a merchant presents multiple MID formats across transactions, for example with or without leading zeros, create an exemption for each observed form, or use a merchant group that includes all observed forms. Allowable Values: 1–36 chars
name string Required	Name of the merchant identifier authorization control exemption. Allowable Values: 255 char max
start_time datetime Optional	Date and time when the exception starts, in UTC. Allowable Values: datetime Format: yyyy-MM-ddThh:mm:ssZ
token string Optional	Unique identifier of the merchant identifier authorization control exemption. If you do not include a token, the system will generate one automatically. This token is necessary for use in other API calls, so we recommend that rather than let the system generate one, you use a simple string that is easy to remember. This value cannot be updated. Allowable Values: 36 char max

Sample request body

JSON

{
  "token": "my_exempt_token",
  "name": "my_exempt_mid",
  "association": {
    "card_product_token": "my_card_product"
  },
  "mid": "12345678901"
}

Response body

Fields	Description
active boolean Conditionally returned	Indicates whether the merchant identifier authorization control exception is active. This field is returned if it exists in the resource. Allowable Values: `true`, `false`
association object Conditionally returned	Defines the group of users to which the authorization control applies. This object is required if the `merchant_scope` object is not included in your request. Your request can include both the `association` and `merchant_scope` objects. If you include this object in your request, you must populate one or more of its fields. If no fields are populated, the authorization control applies to all users. Allowable Values: `card_product_token`, `user_token`
association.card_product_token string Conditionally returned	Unique identifier of a card product. Specify a card product token in the `card_product_token` field to apply the authorization control to all users holding active cards associated with the card product. Pass either `card_product_token` or `user_token`, not both. Allowable Values: 1–36 chars
association.user_token string Conditionally returned	Unique identifier of a user. Specify a user token in the `user_token` field to apply the authorization control to a single user. Pass either `card_product_token` or `user_token`, not both. Allowable Values: 1–36 chars
created datetime Conditionally returned	Date and time when the resource was created, in UTC. This field is returned if it exists in the resource. Allowable Values: datetime Format: yyyy-MM-ddThh:mm:ssZ
end_time datetime Conditionally returned	Date and time when the exception ends, in UTC. This field is returned if it exists in the resource. Allowable Values: datetime Format: yyyy-MM-ddThh:mm:ssZ
last_updated datetime Conditionally returned	Date and time when the resource was last updated, in UTC. This field is returned if it exists in the resource. Allowable Values: datetime Format: yyyy-MM-ddThh:mm:ssZ
merchant_group_token string Conditionally returned	Unique identifier of the merchant group to be exempted. This field is returned if it exists in the resource. Allowable Values: 1–36 chars
mid string Conditionally returned	Merchant to be exempted. This field is returned if it exists in the resource. Allowable Values: 1–36 chars
name string Returned	Name of the merchant identifier authorization control exemption. Allowable Values: 255 char max
start_time datetime Conditionally returned	Date and time when the exception starts, in UTC. This field is returned if it exists in the resource. Allowable Values: datetime Format: yyyy-MM-ddThh:mm:ssZ
token string Conditionally returned	Unique identifier of the merchant identifier authorization control exemption. This field is always returned. Allowable Values: Existing merchant identifier authorization control exemption token

Sample response body

JSON

{
  "token": "my_exempt_token",
  "name": "my_exempt_mid",
  "association": {
    "card_product_token": "my_card_product"
  },
  "mid": "12345678901",
  "active": true,
  "created_time": "2022-06-19T13:22:07Z",
  "last_modified_time": "2022-06-19T13:22:07Z"
}