Skip to content
rigid.fi

Create a spend control on a cardholder

POST/v1/cardholders/{id}/authorization-controls

Requires an API client bearer token.

Places a spend control on this cardholder — binding every card they own, not one card (`scope`/`scope_id` are derived from the path; a body that sets either is rejected). Requires an Idempotency-Key header.

Parameters

Path parameters

NameRequiredDescription
idrequired

Header parameters

NameRequiredDescription
Idempotency-Keyrequired

Client-chosen. An identical retry with the same key returns the stored response; reusing the key with a different payload returns 409.

Request body

mcc_allowarray of string
mcc_denyarray of string
country_allowarray of string
country_denyarray of string
channels_denyarray of "pos" | "ecommerce" | "atm" | "moto"
entry_mode_denyarray of "contactless" | "chip" | "magstripe" | "manual"
max_amountstring

Example

curl -X POST https://api.rigid.fi/v1/cardholders/{id}/authorization-controls \
  -H "Authorization: Bearer $RIGID_API_TOKEN" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: $(uuidgen)" \
  -d '{
  "mcc_allow": [
    "string"
  ],
  "mcc_deny": [
    "string"
  ],
  "country_allow": [
    "string"
  ],
  "country_deny": [
    "string"
  ],
  "channels_deny": [
    "pos"
  ],
  "entry_mode_deny": [
    "contactless"
  ]
}'

Responses

201

The created spend control.

mcc_allowarray of string
mcc_denyarray of string
country_allowarray of string
country_denyarray of string
channels_denyarray of "pos" | "ecommerce" | "atm" | "moto"
entry_mode_denyarray of "contactless" | "chip" | "magstripe" | "manual"
max_amountstring
idstringrequired
activebooleanrequired
400

Validation error

typestringrequired
titlestringrequired
statusintegerrequired
detailstring
instancestring
401

Authentication required

typestringrequired
titlestringrequired
statusintegerrequired
detailstring
instancestring
403

Forbidden

typestringrequired
titlestringrequired
statusintegerrequired
detailstring
instancestring
404

Cardholder not found

typestringrequired
titlestringrequired
statusintegerrequired
detailstring
instancestring
409

Idempotency-Key reused with a different payload

typestringrequired
titlestringrequired
statusintegerrequired
detailstring
instancestring
422

The body set scope or scope_id (both are derived from the path), or named no restriction at all

typestringrequired
titlestringrequired
statusintegerrequired
detailstring
instancestring
500

Internal server error

typestringrequired
titlestringrequired
statusintegerrequired
detailstring
instancestring