POST or PUT call from a role that does not have Program Manager permissions will receive a 403 error if its association field is null, or if it includes all of the fields in the request body. Avoid this by passing a valid user_token or card_product_token in the velocity control’s association object, indicating that the request is specific to a user or card product, and not program-wide. You should also only include the specific fields you want to update, because a PUT or POST with values for all fields is interpreted as a change that requires Program Manager permissions.
See Controlling Spending for a tutorial that walks you through the creation of a spend control.
Note Each program supports a maximum of 90 spend controls (velocity controls and authorization controls combined). The limit of 90 spend controls applies at the program level only; it does not affect the number of user-level spend controls you can use.