---
title: "Create Protection Bulletin rule"
method: POST
path: "/v1/bulletin/setup"
tags: ["Rules"]
---

# Create Protection Bulletin rule

`POST /v1/bulletin/setup`

Register a new Protection Bulletin setup rule. This feature is available for Elo, Mastercard and Visa.

When you set a card rule, for example, when a card status is changed to `LOST`, it is automatically added to the Protection Bulletin.

This operation executes asynchronously. When complete, a [Bulletin rule event](https://developers.pismo.io/events/docs/bulletin-bulletin-rule-1) is generated.

**Notes:** 
  * This endpoint takes an account token - an access token encoded with a Pismo account ID. Tokens can expire quickly, which can result in a <b>401 Unauthorized</b> message.
  * Deactivating a rule after it has been created requires re-calling this endpoint  with `active` set to `false`.

## Headers

- `Authorization` string, required

## Request body

- union
  - BulletinSetupEloModel — Register a Elo Protection Bulletin setup.
    - `active` boolean, required — Is the program calendar strategy active?
    - `program_id` number, required — Pismo program ID.
    - `allowed_status` object[] — If `allowed_status` is passed, the Pismo Protection Bulletin service starts monitoring [Card updated events](https://developers.pismo.io/events/docs/cards-update-1). The `status_pismo` status determines if the card is sent to the network via the Protection Bulletin.
      - `status_pismo` string — Pismo card status. For more information, see [Card lifecycle and statuses](https://developers.pismo.io/pismo-docs/docs/card-lifecycle-and-statuses).
      - `default_purge_days` number — After the specified number of days, a request to remove the card will be automatically sent to the network through the Protection Bulletin. The `default_purge_days` field is optional, and if not provided, no action will be taken to remove this card from the Protection Bulletin.
  - BulletinSetupMastercardModel — Register a Mastercard Protection Bulletin setup.
    - `active` boolean, required — Is the program calendar strategy active?
    - `ica` string, required — Interbank Card Association (ICA) number - a six-digit account number that identifies a financial institution or third-party processor operating in the Mastercard network. **REQUIRED** for Mastercard. It must be padded with leading zeros.
    - `program_id` number, required — Pismo program ID.
    - `allowed_status` object[] — If `allowed_status` is provided, the Pismo Protection Bulletin service starts monitoring [Card updated events](https://developers.pismo.io/events/docs/cards-update-1). The `status_pismo` status determines if the card is sent to the network via the Protection Bulletin.
      - `status_pismo` string — Pismo card status. For more information, see [Card lifecycle and statuses](https://developers.pismo.io/pismo-docs/docs/card-lifecycle-and-statuses).
      - `status_network` 'C' | 'F' | 'G' | 'L' | 'O' | 'P' | 'S' | 'U' | 'V' | 'X' — Network status equivalent to Pismo status. **REQUIRED** for Mastercard. `C` - Credit `F` - Fraud `G` - ATM Premium Listing `L` - Lost `O` - Other `P` - Capture card `S` - Stolen `U` - Unauthorized use `V` - Premium listing `X` - Counterfeit Mastercard documentation: Customer Interface Specification - DE 120 (Record Data) Layout for MCC102 - Field ID 2 (Entry Reason).
      - `default_purge_days` number — After the specified number of days, a request to remove the card will be automatically sent to the network through the Protection Bulletin. The `default_purge_days` field is optional, and if not provided, no action will be taken to remove this card from the Protection Bulletin.
  - BulletinSetupVisaModel — Register a Visa Protection Bulletin setup.
    - `active` boolean, required — Is the program calendar strategy active?
    - `bid` string, required — Business ID (BID) number - a six-digit account number through which Visa bills their clients. **REQUIRED** for Visa. It **must** be padded with leading zeros.
    - `program_id` number, required — Pismo program ID.
    - `region_code` string[], required — Region code contains one or more Account Screen Authorization File (ASAF) region codes that define the distribution of a Visa cardholder account number in Card Recovery Bulletin Service files. **REQUIRED** for Visa. `0` - No Bulletin / V.I.P. Only (cannot be combined with other region codes) `A` - All Asia-Pacific region countries `B` - All Central Europe, Middle East, and Africa (CEMEA) region countries. `C` - All Visa Canada `D` - National Card Recovery Bulletin `E` - All European countries `F` - All Latin America and Caribbean (LAC) region countries Region codes can be in any order, except no other region code can be specified in combination with region code 0. Visa documentation: VisaNet Authorization-Only Online Messages – Technical Specifications - Table 215: Field 127E.2 Account Screen Authorization File (ASAF) Region Codes
    - `allowed_status` object[], required — When passed, the Pismo Protection Bulletin service starts monitoring [Card updated events](https://developers.pismo.io/events/docs/cards-update-1). The `status_pismo` status determines if the card is sent to the network via the Protection Bulletin.
      - `status_pismo` string, required — Pismo card status. For more information, see [Card lifecycle and statuses](https://developers.pismo.io/pismo-docs/docs/card-lifecycle-and-statuses).
      - `status_network` '04' | '05' | '07' | '11' | '14' | '41' | '43' | '46' | '54', required — Network status equivalent to Pismo status. **REQUIRED** for Visa. `04` - Pickup card `05` - Do not honor `07` - Pickup card, special condition `11` - Approval for **VIP** `14` - Invalid account number (no such number) `41` - Lost card, pickup `43` - Stolen card, pickup `46` - Closed account `54` - Expired card Visa documentation: VisaNet Authorization-Only Online Messages – Technical Specifications - Table 214: Field 127E.1 Account Screen Authorization File (ASAF) Action Codes.
      - `default_purge_days` number, required — After the specified number of days, a request to remove the card is automatically sent to the Protection Bulletin.

## Response `202`

Accepted

## Other responses

- `400` — Bad Request
- `401` — Unauthorized
- `404` — Not Found
- `422` — Unprocessable Entity
- `500` — Internal Server Error
- `504` — Gateway Timeout

---

[API](https://skmtc.net/pismo/apis/platform-authentication.md) · [All operations](https://skmtc.net/pismo/apis/platform-authentication/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/pismo/platform-authentication/revisions/935b62e16de4/schema)