Card control profiles

Last updated: April 30, 2025

Card control profiles help you manage spending controls for a large group of cards from a single source. You create a control profile and set it as the target of specific controls. You then add cards to the profile, which automatically inherit the controls.

You can apply controls to restrict card spending to:

Certain types of business, using the merchant category code (MCC)
Specific merchants, using the merchant identifier (MID)

Create a control profile.
Create a control targeting the profile.
Add a card to the profile.

You can then:

View all your control profiles, or all profiles applied to a specific card.
View the details of a specific profile.
Update the profile name.
Delete a profile.
Remove cards from a profile.

A control profile can be targeted by up to 10 controls.
You can add an unlimited number of cards to a profile.
You can create up to a maximum of 100 control profiles.
You cannot add velocity controls to control profiles.

During a transaction, controls that target any profile the card is added to are evaluated alongside any card-level controls. When a control profile or card has multiple controls, the strictest control always overrides the others.

In the following example, the second control overrides the first control:

Allow the card to spend up to 500 EUR per month at food businesses
Limit the card's overall spending to 400 EUR per month

If multiple Allow controls apply to a card, they are applied cumulatively. That is, they do not block each other in order to avoid declined transactions.

This applies:

To MID and MCC controls
When all the controls are created by the same owner – the owner can be you or Checkout.com
Whether the controls are applied at card level, or inherited from a control profile or card product

For example, you create a control targeting a control profile that allows spending at airline and hotel MCCs only. You later apply another control to a specific card linked to that profile that allows spending for taxi MCCs only. Both controls cumulatively apply to the card, so it can only spend at airline, hotel, and taxi MCCs.

Controls are not retroactive. Transactions approved before a control is applied are not affected by the control.

Information

For guidance on how to view the details of a specific control, and update or delete controls, see Manage controls.

Call the Create a control profile endpoint, and provide a profile name.

post

https://api.checkout.com/issuing/controls/control-profiles


1{
2  "name": "Low Risk MCC Profile"
3}

The response returns the control profile id, which you need for the next step. For example, cpr_j4mvlui5qotufgvaeqwhvlbfna.


1{
2  "id": "cpr_j4mvlui5qotufgvaeqwhvlbfna",
3  "name": "Low Risk MCC Profile",
4  "created_date": "2024-03-12T18:13:45.7155085Z",
5  "last_modified_date": "2024-03-12T18:13:45.7155085Z",
6  "_links": {
7    "self": {
8      "href": "https://api.checkout.com/issuing/controls/control-profiles/cpr_j4mvlui5qotufgvaeqwhvlbfna",
9      "actions": [
10        "GET"
11      ],
12      "types": [
13        "application/json"
14      ]
15    }
16  }
17}

To create a control that targets the control profile, call the Create a control endpoint:

target_id field – Provide the control profile id you want the control to target.
description field – Optionally, provide a description for the control.

For an MCC control:

control_type field – Set to mcc_limit.
mcc_limit object:
- type field – Set to allow or block the MCCs.
- mcc_list field – List the relevant MCCs.

For an MID control:

control_type field – Set to mid_limit.
mid_limit object:
- type field – Set to allow or block the MIDs.
- mid_list field – List the relevant MIDs.

Information

You can only use one rule to specify which MCCs to allow. If you need to update an MCC control's allowlist, update the control itself.

post

https://api.checkout.com/issuing/controls


1{
2  "description": "Allow the card to be used only in restaurants and supermarkets",
3  "control_type": "mcc_limit",
4  "target_id": "cpr_j4mvlui5qotufgvaeqwhvlbfna",
5  "mcc_limit": {
6    "type": "allow",
7    "mcc_list": [
8      "5932",
9      "5411"
10    ]
11  }
12}

The response returns the control id, which you need for the next step. For example, ctr_gp7vkmxayztufjz6top5bjcdra.


1{
2  "id": "ctr_gp7vkmxayztufjz6top5bjcdra",
3  "description": "Allow the card to be used only in restaurants and supermarkets",
4  "control_type": "mcc_limit",
5  "target_id": "cpr_j4mvlui5qotufgvaeqwhvlbfna",
6  "created_date": "2023-03-12T18:20:12Z",
7  "last_modified_date": "2023-03-12T18:20:12Z",
8  "_links": {
9    "self": {
10      "href": "https://api.checkout.com/issuing/controls/ctr_gp7vkmxayztufjz6top5bjcdra",
11      "actions": [
12        "GET"
13      ],
14      "types": [
15        "application/json"
16      ]
17    }
18  },
19  "mcc_limit": {
20    "type": "allow",
21    "mcc_list": [
22      "5932",
23      "5411"
24    ]
25  }
26}

To add a card to the control profile, call the Add target to control profile endpoint, and provide the following path parameters:

{controlProfileId} path parameter – Provide the control profile id returned in the Create a control profile response – for example, cpr_j4mvlui5qotufgvaeqwhvlbfna.
{targetId} path parameter – Provide the card id you want to add to the control profile – for example, crd_abcdef1ghijklmn23opq45r6st.

Information

Alternatively, when you issue a card, you can add it to a control profile using the control_profiles field.

post

https://api.checkout.com/issuing/controls/control-profiles/{controlProfileId}/add/{targetId}


1{
2  "_links": {
3    "self": {
4      "href": "https://api.checkout.com/issuing/controls/control-profiles/cpr_j4mvlui5qotufgvaeqwhvlbfna",
5      "actions": [
6        "GET"
7      ],
8      "types": [
9        "application/json"
10      ]
11    }
12  }
13}

Information

If you renew a card, the new card is automatically added to any control profile the original card was added to.

You can view all control profiles created for your account using the Dashboard and the API.

Sign in to the Dashboard.
Go to Issuing > Card program.
Select the Card control profiles tab.
Each profile lists:
- Allowed/blocked MCCs
- Allowed/blocked MIDs

The control profile IDs are not listed.

You can call the Get all control profiles endpoint as follows:

To retrieve the ID for a control profile to add or remove controls, or to view all control profiles created for your account, do not provide query parameters.

To view all control profiles applied to a specific card, provide the card id as the {target_id} query parameter.

get

https://api.checkout.com/issuing/controls/control-profiles?target_id=crd_abcdef1ghijklmn23opq45r6st

The response returns an array of objects, one for each control profile, containing:

The profile's name and id – for example, cpr_j4mvlui5qotufgvaeqwhvlbfna
Timestamps for when you created and last updated the profile


1{
2  "control_profiles": [
3    {
4      "id": "cpr_j4mvlui5qotufgvaeqwhvlbfna",
5      "name": "Low Risk MCC Profile",
6      "created_date": "2024-03-12T18:13:45.7155085Z",
7      "last_modified_date": "2024-03-13T15:44:56.7155085Z"
8    },
9    {
10      "id": "cpr_53mkhdc4jjlu5jcryx76bjbrgm",
11      "name": "Medium Risk MCC Profile",
12      "created_date": "2024-05-05T10:43:13.7155085Z",
13      "last_modified_date": "2024-06-17T06:32:18.7155085Z"
14    },
15    {
16      "id": "cpr_p1ma3rclvgcu3pn5tsdgb3e3a4",
17      "name": "High Risk MCC Profile",
18      "created_date": "2024-02-29T12:55:55.7155085Z",
19      "last_modified_date": "2024-03-01T10:12:12.7155085Z"
20    }
21  ]
22}

To view the details of a specific control profile, call the Get control profile details endpoint, and provide the control profile id as the {controlProfileId} path parameter. For example, cpr_j4mvlui5qotufgvaeqwhvlbfna.

get

https://api.checkout.com/issuing/controls/control-profiles/{controlProfileId}

The response returns the profile's name and id, and timestamps for when you created and last updated the profile.


1{
2  "control_profiles": [
3    {
4      "id": "cpr_j4mvlui5qotufgvaeqwhvlbfna",
5      "name": "Low Risk MCC Profile",
6      "created_date": "2024-03-12T18:13:45.7155085Z",
7      "last_modified_date": "2024-03-13T15:44:56.7155085Z"
8    },
9    {
10      "id": "cpr_53mkhdc4jjlu5jcryx76bjbrgm",
11      "name": "Medium Risk MCC Profile",
12      "created_date": "2024-05-05T10:43:13.7155085Z",
13      "last_modified_date": "2024-06-17T06:32:18.7155085Z"
14    },
15    {
16      "id": "cpr_p1ma3rclvgcu3pn5tsdgb3e3a4",
17      "name": "High Risk MCC Profile",
18      "created_date": "2024-02-29T12:55:55.7155085Z",
19      "last_modified_date": "2024-03-01T10:12:12.7155085Z"
20    }
21  ]
22}

Call the Update a control profile endpoint, and provide the control profile id as the {controlProfileId} path parameter. For example, cpr_j4mvlui5qotufgvaeqwhvlbfna.

In the request payload, provide the new profile name in the name field.

patch

https://api.checkout.com/issuing/controls/control-profiles/{controlProfileId}


1{
2  "name": "Low Risk MCC Profile"
3}

The response returns the profile's id and new name, and timestamps for when you created and last updated the profile.


1{
2  "id": "cpr_j4mvlui5qotufgvaeqwhvlbfna",
3  "name": "Low Risk MCC Profile",
4  "created_date": "2024-03-12T18:13:45.7155085Z",
5  "last_modified_date": "2024-03-12T18:13:45.7155085Z",
6  "_links": {
7    "self": {
8      "href": "https://api.checkout.com/issuing/controls/control-profiles/cpr_j4mvlui5qotufgvaeqwhvlbfna",
9      "actions": [
10        "GET"
11      ],
12      "types": [
13        "application/json"
14      ]
15    }
16  }
17}

You can remove a card from a control profile if you no longer want the profile's controls to apply to that card.

Call the Remove card from control profile endpoint, and provide the following path parameters:

{controlProfileId} – Provide the control profile id you want to remove the card from – for example, cpr_j4mvlui5qotufgvaeqwhvlbfna.
{targetId} – Provide the card id you want to remove – for example, crd_abcdef1ghijklmn23opq45r6st.

Information

To remove a renewed card from a control profile, you must remove the original card from the profile.

post

https://api.checkout.com/issuing/controls/control-profiles/{controlProfileId}/remove/{targetId}


1{
2  "_links": {
3    "self": {
4      "href": "https://api.checkout.com/issuing/controls/control-profiles/cpr_j4mvlui5qotufgvaeqwhvlbfna",
5      "actions": [
6        "GET"
7      ],
8      "types": [
9        "application/json"
10      ]
11    }
12  }
13}

Call the Delete a control profile endpoint, and provide its id as the {controlProfileId} path parameter. For example, cpr_j4mvlui5qotufgvaeqwhvlbfna.

delete

https://api.checkout.com/issuing/controls/control-profiles/{controlProfileId}


1{
2  "_links": {
3    "self": {
4      "href": "https://api.checkout.com/issuing/controls/control-profiles/cpr_j4mvlui5qotufgvaeqwhvlbfna",
5      "actions": [
6        "GET"
7      ],
8      "types": [
9        "application/json"
10      ]
11    }
12  }
13}

Card control profiles

How it works

Profile specifications

Control hierarchy

Cumulative allow controls

Control retroactivity

Information

Create a control profile

Request example

Response example

Create a control targeting a control profile

Information

Request example

Response example

Add a card to a control profile

Information

Response example

Information

View control profiles

View control profiles in the Dashboard

View control profiles using the API

Response example

View control profile details

Response example

Update control profile name

Request example

Response example

Remove card from control profile

Information

Response example

Delete a control profile

Response example