---
title: "Apply PTC CSV"
method: POST
path: "/gw/api/v1/restrictions"
tags: ["preTradeComplianceRestrictions"]
---

# Apply PTC CSV

`POST /gw/api/v1/restrictions`

Applies previously verified CSV changes. Requires two tokens:

**Authorization header** — RS256-signed JWT containing an `accountId` claim, used to identify the master account. A missing or invalid token does not return HTTP 401; the request proceeds and fails at validation with `success: false`.

**Request body** — a separate RS256-signed JWT (validity: 1 minute) whose payload contains the request claims (`userName`, `requestId`, `payload`, and optionally `isEmpTrack`). The `requestId` must match a prior successful `/csv/v2/verify` call.

Failures that occur before the body JWT payload is parsed (inactive token, missing payload) return `success: false` without a `requestId` field.<br><br>**Scope**: `restrictions.write`<br>**Security Policy**: `Signed JWT`

## Headers

- `Authorization` string, required

## Request body

- string, jwt

## Response `200`

Always HTTP 200. Inspect the `success` field to determine the outcome. All failure conditions — authentication, authorization, validation, and internal errors — return `success: false`.

- CSVResponse — Response body for all CSV endpoints. Always returned with HTTP 200.
  - `success` boolean, required — Indicates whether the operation succeeded.
  - `requestId` integer — Echoed from the request. Absent only on early apply failures (inactive body token, missing payload) where the `requestId` has not yet been parsed.
  - `message` union — `OK` on success. On failure, either a plain string describing the error or a JSON object for structured bridge validation errors.
    - string
    - object

---

[API](https://skmtc.net/interactivebrokers/apis/api-reference.md) · [All operations](https://skmtc.net/interactivebrokers/apis/api-reference/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/interactivebrokers/api-reference/revisions/67f9f562c2c6/schema)