Control card spending
Beta
Last updated: March 22, 2023
Card spending controls help you to manage your card spending budget and prevent fraud. You do this by applying controls to a card.
A control can contain one or both of the following rules:
- a velocity spending limit, which determines how much a card can spend over a given period of time
- a merchant category code (MCC) allowlist or blocklist rule, which determines the types of businesses a card can process transactions from
For example, you can apply a control that allows a card to spend up to €500 per month at food businesses.
You can apply multiple controls to a card, but the strictest control will always override the others. In the following example, the second control overrides the first control:
- allow the card to spend up to €500 per month at food businesses
- limit the card's overall spending to €400 per month
Controls are set per card, so a cardholder can have a unique set of spending controls applied to each card they've been issued.
As spending controls are applied per card, you'll need to retrieve the required card's ID before you can apply the required controls.
If you've just created a card, you'll find the card ID in the response's id field.
Alternatively, you can use the following endpoint to retrieve a list of cards issued to the specified cardholder:
get
https://api.checkout.com/issuing/cardholders/{cardholderId}/cards
From the list of cards returned in the response, make a note of the id value of the card you want to apply spending controls to.
A velocity limit determines how much a card can spend over a given period of time. For example, you can apply a velocity limit which caps the overall card spending to €1000 per month:
post
https://api.checkout.com/issuing/controls
You also have the option to apply more granular velocity limits, by specifying which MCCs the given velocity limit applies to. For example, you can apply a velocity limit which caps the spending at food businesses to €500 per month:
Information
The MCC list for a given velocity limit is set separately to the overall MCC rules.
You can apply multiple velocity limits to a card by sending separate requests to the endpoint. For example, by applying both of the previous example velocity limits, the cardholder would be able to:
- spend up to €1000 per month
- spend up to €500 per month at food businesses, without exceeding the overall €1000 monthly limit
After creating a velocity limit control, you can use the API to retrieve the control using its ID if you need to update it at a later date. You can also retrieve a list of all controls applied to a specified card.
An MCC rule determines the types of businesses a card can process transactions from.
You do this by by supplying a list of MCCs to either allow or block. For example, you can block all authorization requests coming from gambling institutions.
post
https://api.checkout.com/issuing/controls
While you can specify which MCCs to block using multiple rules, you can only use a single rule to define which MCCs to allow. If you need to update an MCC control's allowlist, update the control itself.
After creating an MCC rule control, you can use the API to retrieve the control using its ID if you need to update it at a later date. You can also retrieve a list of all controls applied to a specified card.
You can use the API to update an existing control, or remove it from a card entirely.
You can update an existing velocity limit to change the limit amount, period of time, or the list of MCCs it applies to.
Similarly, you can add or remove MCCs from your MCC blocklist or allowlist rule.
put
https://api.checkout.com/issuing/controls/{control_id}
Removing a control from a card deletes the control entirely.
To apply an equivalent control at a later date, you'll need to create a new velocity limit or MCC rule.
delete
https://api.checkout.com/issuing/controls/{control_id}