> ## Documentation Index
> Fetch the complete documentation index at: https://www.marqeta.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Retrieve authorization control

> Retrieve a specific authorization control.

GET/authcontrols/\{token}

Retrieve a specific authorization control.

## URL path parameters

| Fields | Description |
| - | - |
| token string  Required | Existing authorization control token. Send a `GET` request to `/authcontrols` to retrieve authorization control tokens. **Allowable Values:**  Existing `authcontrol` token |

## URL query parameters

| Fields | Description |
| - | - |
| fields string  Optional | Comma-delimited list of fields to return (`field_1,field_2`, and so on). Leave blank to return all fields. **Allowable Values:**  Comma-delimited list of fields, or blank |

## Response body

| Fields | Description |
| - | - |
| active boolean  Conditionally returned | Indicates whether the authorization control is active. This field is returned if it exists in the resource. **Allowable Values:**  `true`, `false` |
| association object  Conditionally returned | Defines the group of users to which the authorization control applies. This object is required if the `merchant_scope` object is not included in your request. Your request can include both the `association` and `merchant_scope` objects. If you include this object in your request, you must populate one or more of its fields. If no fields are populated, the authorization control applies to all users. **Allowable Values:**  `card_product_token`, `user_token` |
| association.**card\_product\_token** string  Conditionally returned | Unique identifier of a card product. Specify a card product token in the `card_product_token` field to apply the authorization control to all users holding active cards associated with the card product. Pass either `card_product_token` or `user_token`, not both. **Allowable Values:**  1–36 chars |
| association.**user\_token** string  Conditionally returned | Unique identifier of a user. Specify a user token in the `user_token` field to apply the authorization control to a single user. Pass either `card_product_token` or `user_token`, not both. **Allowable Values:**  1–36 chars |
| end\_time datetime  Conditionally returned | Date and time when the exception ends, in UTC. This field is returned if it exists in the resource. **Allowable Values:**  datetime **Format:** yyyy-MM-ddThh:mm:ssZ |
| merchant\_scope object  Conditionally returned | Defines the group of merchants to which the authorization control applies. This object is required if the `association` object is not included in your request. Your request can include both the `merchant_scope` and `association` objects. If you include this object in your request, you must populate one or more of its fields. If no fields are populated, the authorization control applies to all merchants. **Allowable Values:**  `mcc`, `mcc_group`, `merchant_group_token`, `mid` |
| merchant\_scope.**mcc** string  Conditionally returned | Merchant Category Code (MCC). Identifies the type of goods or services provided by the merchant. Enter a value to control access to a particular type of product or service. See [Controlling Spending](https://www.marqeta.com/docs/developer-guides/controlling-spending.md) for links to more information about merchant category codes. **Allowable Values:**  1–4 chars |
| merchant\_scope.**mcc\_group** string  Conditionally returned | Token identifying a group of MCCs. Enter a value to control access to a group of product or service types. **Allowable Values:**  1–36 chars |
| merchant\_scope.**merchant\_group\_token** string  Conditionally returned | Unique identifier of a merchant group. Enter a value to control access to a group of merchants. **Allowable Values:**  1–36 chars |
| merchant\_scope.**mid** string  Conditionally returned | Merchant identifier (MID). Identifies a specific merchant. Enter a value to control access to a particular merchant. Use the exact MID value as it appears in the `card_acceptor.mid` field of your Gateway JIT Funding request or transaction webhook. Marqeta performs an exact match on this value — no normalization or formatting is applied. **Allowable Values:**  1–36 chars |
| name string  Returned | Name of the authorization control. **Allowable Values:**  255 char max |
| start\_time datetime  Conditionally returned | Date and time when the exception goes into effect, in UTC. This field is returned if it exists in the resource. **Allowable Values:**  datetime **Format:** yyyy-MM-ddThh:mm:ssZ |
| token string  Conditionally returned | Unique identifier of the authorization control. This field is returned if it exists in the resource. **Allowable Values:**  1–36 chars |

## Sample response body

```json JSON lines wrap theme={null}
{
  "token": "my_authcontrol",
  "name": "My Auth Control",
  "active": true,
  "association": {
    "user_token": "my_user_01"
  },
  "merchant_scope": {
    "mid": "98765"
  }
}
```


## Related topics

- [Authorization Controls Overview](https://www.marqeta.com/docs/core-api/authorization-controls.md)
- [Update authorization control](https://www.marqeta.com/docs/core-api/authorization-controls/update-authorization-control.md)
- [List authorization controls](https://www.marqeta.com/docs/core-api/authorization-controls/list-authorization-controls.md)
- [Authorization Controls Object](https://www.marqeta.com/docs/core-api/authorization-controls/authorization-controls-object.md)
- [Create authorization control](https://www.marqeta.com/docs/core-api/authorization-controls/create-authorization-control.md)