> ## Documentation Index > Fetch the complete documentation index at: https://www.marqeta.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # Create a merchant identifier (MID) exemption > Exempt an individual merchant from authorization controls by merchant identifier (MID). POST/authcontrols/exemptmids Exempt an individual merchant from authorization controls by merchant identifier (MID). Transactions originating from this MID ignore any otherwise applicable authorization controls. > [!NOTE] > > **Note**\ > You can create MID exemptions in your user sandbox. However, you must work with your Marqeta representative to create MID exemptions in a production environment. ## Request body | Fields | Description | | - | - | | association object Optional | Defines the group of users to which the authorization control applies. This object is required if the `merchant_scope` object is not included in your request. Your request can include both the `association` and `merchant_scope` objects. If you include this object in your request, you must populate one or more of its fields. If no fields are populated, the authorization control applies to all users. **Allowable Values:** `card_product_token`, `user_token` | | association.**card\_product\_token** string Optional | Unique identifier of a card product. Specify a card product token in the `card_product_token` field to apply the authorization control to all users holding active cards associated with the card product. Pass either `card_product_token` or `user_token`, not both. **Allowable Values:** 1–36 chars | | association.**user\_token** string Optional | Unique identifier of a user. Specify a user token in the `user_token` field to apply the authorization control to a single user. Pass either `card_product_token` or `user_token`, not both. **Allowable Values:** 1–36 chars | | end\_time datetime Optional | Date and time when the exception ends, in UTC. **Allowable Values:** datetime **Format:** yyyy-MM-ddThh:mm:ssZ | | merchant\_group\_token string Optional | Unique identifier of the merchant group to be exempted. This field is required if there is no entry in the `mid` field. Pass either this field or the `mid` field, not both. For information about merchant groups, see [Merchant Groups](https://www.marqeta.com/docs/core-api/merchant-groups/). **Allowable Values:** 1–36 chars | | mid string Optional | Merchant to be exempted. This field is required if there is no entry in the `merchant_group_token` field. Use either this field or the `merchant_group_token` field, not both. If you include this field in your request, use the exact MID value as it appears in the `card_acceptor.mid` field of your Gateway JIT Funding request or transaction webhook. Marqeta performs an exact match on this value — no normalization or formatting is applied. If a merchant presents multiple MID formats across transactions, for example with or without leading zeros, create an exemption for each observed form, or use a merchant group that includes all observed forms. **Allowable Values:** 1–36 chars | | name string Required | Name of the merchant identifier authorization control exemption. **Allowable Values:** 255 char max | | start\_time datetime Optional | Date and time when the exception starts, in UTC. **Allowable Values:** datetime **Format:** yyyy-MM-ddThh:mm:ssZ | | token string Optional | Unique identifier of the merchant identifier authorization control exemption. If you do not include a token, the system will generate one automatically. This token is necessary for use in other API calls, so we recommend that rather than let the system generate one, you use a simple string that is easy to remember. This value cannot be updated. **Allowable Values:** 36 char max | ## Sample request body ```json JSON lines wrap theme={null} { "token": "my_exempt_token", "name": "my_exempt_mid", "association": { "card_product_token": "my_card_product" }, "mid": "12345678901" } ``` ## Response body | Fields | Description | | - | - | | active boolean Conditionally returned | Indicates whether the merchant identifier authorization control exception is active. This field is returned if it exists in the resource. **Allowable Values:** `true`, `false` | | association object Conditionally returned | Defines the group of users to which the authorization control applies. This object is required if the `merchant_scope` object is not included in your request. Your request can include both the `association` and `merchant_scope` objects. If you include this object in your request, you must populate one or more of its fields. If no fields are populated, the authorization control applies to all users. **Allowable Values:** `card_product_token`, `user_token` | | association.**card\_product\_token** string Conditionally returned | Unique identifier of a card product. Specify a card product token in the `card_product_token` field to apply the authorization control to all users holding active cards associated with the card product. Pass either `card_product_token` or `user_token`, not both. **Allowable Values:** 1–36 chars | | association.**user\_token** string Conditionally returned | Unique identifier of a user. Specify a user token in the `user_token` field to apply the authorization control to a single user. Pass either `card_product_token` or `user_token`, not both. **Allowable Values:** 1–36 chars | | created datetime Conditionally returned | Date and time when the resource was created, in UTC. This field is returned if it exists in the resource. **Allowable Values:** datetime **Format:** yyyy-MM-ddThh:mm:ssZ | | end\_time datetime Conditionally returned | Date and time when the exception ends, in UTC. This field is returned if it exists in the resource. **Allowable Values:** datetime **Format:** yyyy-MM-ddThh:mm:ssZ | | last\_updated datetime Conditionally returned | Date and time when the resource was last updated, in UTC. This field is returned if it exists in the resource. **Allowable Values:** datetime **Format:** yyyy-MM-ddThh:mm:ssZ | | merchant\_group\_token string Conditionally returned | Unique identifier of the merchant group to be exempted. This field is returned if it exists in the resource. **Allowable Values:** 1–36 chars | | mid string Conditionally returned | Merchant to be exempted. This field is returned if it exists in the resource. **Allowable Values:** 1–36 chars | | name string Returned | Name of the merchant identifier authorization control exemption. **Allowable Values:** 255 char max | | start\_time datetime Conditionally returned | Date and time when the exception starts, in UTC. This field is returned if it exists in the resource. **Allowable Values:** datetime **Format:** yyyy-MM-ddThh:mm:ssZ | | token string Conditionally returned | Unique identifier of the merchant identifier authorization control exemption. This field is always returned. **Allowable Values:** Existing merchant identifier authorization control exemption token | ## Sample response body ```json JSON lines wrap theme={null} { "token": "my_exempt_token", "name": "my_exempt_mid", "association": { "card_product_token": "my_card_product" }, "mid": "12345678901", "active": true, "created_time": "2022-06-19T13:22:07Z", "last_modified_time": "2022-06-19T13:22:07Z" } ``` ## Related topics - [Merchant Identifier (MID) Exemptions Overview](https://www.marqeta.com/docs/core-api/authorization-controls/merchant-identifier-exemptions.md) - [Authorization Controls Overview](https://www.marqeta.com/docs/core-api/authorization-controls.md) - [List merchant identifier (MID) exemptions](https://www.marqeta.com/docs/core-api/authorization-controls/merchant-identifier-exemptions/list-merchant-identifier-mid-exemptions.md) - [Retrieve a merchant identifier (MID) exemption](https://www.marqeta.com/docs/core-api/authorization-controls/merchant-identifier-exemptions/retrieve-merchant-identifier-mid-exemption.md) - [Update a merchant identifier (MID) exemption](https://www.marqeta.com/docs/core-api/authorization-controls/merchant-identifier-exemptions/update-merchant-identifier-mid-exemption.md)