---
title: "List program flex controls"
method: GET
path: "/v1/flex-controls"
tags: ["Program flex controls"]
---

# List program flex controls

`GET /v1/flex-controls`

List all flex controls grouped by program, with pagination support.
Results are ordered by program ID in ascending order.

Use the optional `programId` query parameter to filter results to a single program.
If `programId` is provided and no templates are found for that program, a `404` is returned.

If no `programId` is specified and no templates exist at all, an empty paginated response is returned with status `200`.

## Query parameters

- `programId` integer
- `page` integer
- `perPage` integer

## Headers

- `x-tenant` string, required

## Response `200`

OK. Returns paginated flex controls grouped by program.

- ProgramFlexControlsResponse — Paginated response containing flex controls grouped by program
  - `pages` integer, required — Total number of pages
  - `current_page` integer, required — Current page number
  - `per_page` integer, required — Number of programs per page
  - `total_items` integer, required — Total number of programs
  - `programs` ProgramControlsItem[], required — List of programs with their flex controls
    - `program_id` integer, required — Program ID
    - `controls` ProgramControls, required — Collection of restriction and accumulator controls
      - `restriction_controls` FlexControlRestrictionControl[], required — List of restriction controls
        - `name` string, required — Control name
        - `type` string, required — Control type
        - `level` 'account' | 'card', required — Control level (account or card)
        - `processing_codes` ProcessingCodes — Object with the processing codes for credit and debit operations
          - `credit` string — Processing code that identifies the credit operation
          - `debit` string — Processing code that identifies the debit operation
        - `conditions` Condition[] — List of conditions
          - `type` 'INSTALLMENT_NUMBER' | 'PROCESSING_CODE' | 'ACCOUNT_TYPE' | 'ORIGIN' | 'DCC' | 'DOMESTIC' | 'MERCHANT_NAME_LIST' | 'INSTALLMENT_PLAN' | 'AMOUNT' | 'MERCHANT_CATEGORY_CODE' | 'REVERSAL_INDICATOR' | 'AUTHORIZATION_FLOW' | 'ORIGINAL_PROCESSING_CODE' | 'MTI', required — List types and data formats allowed: - `INSTALLMENT_NUMBER` - Integer values - `PROCESSING_CODE` - Alphanumeric strings - `ACCOUNT_TYPE` - Alphanumeric strings - `ORIGIN`- Alphanumeric strings - `DCC`- Boolean values - `DOMESTIC`- Boolean values - `MERCHANT_NAME_LIST` - Alphanumeric strings - `INSTALLMENT_PLAN` - Alphanumeric strings - `AMOUNT` - Numbers with or without decimal places - `MERCHANT_CATEGORY_CODE` - Alphanumeric strings - `REVERSAL_INDICATOR` - Boolean values - `AUTHORIZATION_FLOW` - Either `PAYMENTS` or `NETWORK` - `ORIGINAL_PROCESSING_CODE`- Original processing code or persisted authorization processing code - `MTI` - Message Type Indicator (MTI) - a four-digit numeric field - ISO 8583 standard
          - `operator` 'eq' | 'neq' | 'gt' | 'gte' | 'lt' | 'lte' | 'in' | 'contains' | 'starts_with' | 'ends_with', required — Operator that will be used on this rule evaluation - `eq`: Equals operator, allowed with rules that evaluate data containing strings, numbers, and booleans. - `neq`: Not equals operator, allowed with rules that evaluate data containing strings, numbers, and booleans. - `gt`: Greater than operator, allowed with rules that evaluate data containing numbers. - `gte`: Greater than or equal operator, allowed with rules that evaluate data containing numbers. - `lt`: Less than operator, allowed with rules that evaluate data containing numbers. - `lte`: Less than or equal operator, allowed with rules that evaluate data containing numbers. - `in`: In operator, allowed with rules that use model list as data. Compares if the data is in the configured list. - `contains`: Contains operator, allowed with rules that use model list as data. Compares if the data is part of any string in the configured list. - `starts_with`: Starts with operator, allowed with rules that use model list as data. Verifies whether any string in the list starts with the data value. - `ends_with`: Ends with operator, allowed with rules that use model list as data. Verifies whether any string in the list ends with the data value.
          - `data` string, required — Data used to evaluate this rule against the operator and the information received in the request. This field must be in the format as indicated in `type` and `operator`. **Note:** This field's value can be a model list ID returned from [Create model list](https://developers.pismo.io/pismo-docs/reference/post-org-model-list). A model list contains a list of values for evaluation.
        - `deny_code` string, required — Deny code when control fails
        - `active` boolean, required — Is the control active?
      - `accumulator_controls` FlexControlAccumulatorControl[], required — List of accumulator controls
        - `name` string, required — Control name
        - `type` string, required — Control type
        - `level` 'account' | 'card', required — Control level (account or card)
        - `processing_codes` ProcessingCodes — Object with the processing codes for credit and debit operations
          - `credit` string — Processing code that identifies the credit operation
          - `debit` string — Processing code that identifies the debit operation
        - `max_limit` integer — Maximum spending limit. Once met or exceeded, any subsequent transactions are declined by evaluation control flow. Note that this value is an integer. Since global currencies vary in the number of digits that are allowed after the decimal point, you must convert the actual maximum spending limit into an integer value to use in this field. To do this, use the following formula. value = floatNumber × 10^X, where X is the number of digits after the decimal separator for the currency as defined in ISO 4217. For example, if you want to set the value 499.99 for BRL currency transactions, where the number of decimal places is 2, you must set it to `49999` (499.99 × 10²). If you want to set the value 499 for JPY currency transactions, where the number of decimal places is 0, you must set it to `4999` (4999.0 × 10^0 = 4999.0 × 1 - in other words, the value doesn't change.) This field is **REQUIRED** for cumulative controls.
        - `max_amount` integer — Maximum accumulated amount allowed. Once met or exceeded, subsequent transactions are declined by the evaluation control flow. Note that the value must be calculated as follows. value = floatNumber × 10^X, where X is the number of digits after the decimal separator for the currency defined in ISO 4217. For example, if you want to set the value 499.99 for USD currency transactions, where the number of decimal places is 2, you must set the value to `49999` (499.99 × 10²). If you want to set the value 499 for JPY currency transactions, where the number of decimal places is 0, you must set the value to `499` (499.0 × 10^0 = 499.0 × 1 - in other words, the value doesn't change).
        - `max_transactions` integer — Maximum number of transactions allowed. Once met or exceeded, subsequent transactions are declined by the evaluation control flow.
        - `limit_duration` string — Flex control limit period duration (ISO 8601 format). For example, if a flex control sets a spending limit of $500, and `limit_duration` is set to one month (`P1M`), then the user cannot spend more than $500 from the account in any one month period. If `limit_duration` is not set, then the flex control does not accumulate.
        - `conditions` Condition[] — List of conditions
          - `type` 'INSTALLMENT_NUMBER' | 'PROCESSING_CODE' | 'ACCOUNT_TYPE' | 'ORIGIN' | 'DCC' | 'DOMESTIC' | 'MERCHANT_NAME_LIST' | 'INSTALLMENT_PLAN' | 'AMOUNT' | 'MERCHANT_CATEGORY_CODE' | 'REVERSAL_INDICATOR' | 'AUTHORIZATION_FLOW' | 'ORIGINAL_PROCESSING_CODE' | 'MTI', required — List types and data formats allowed: - `INSTALLMENT_NUMBER` - Integer values - `PROCESSING_CODE` - Alphanumeric strings - `ACCOUNT_TYPE` - Alphanumeric strings - `ORIGIN`- Alphanumeric strings - `DCC`- Boolean values - `DOMESTIC`- Boolean values - `MERCHANT_NAME_LIST` - Alphanumeric strings - `INSTALLMENT_PLAN` - Alphanumeric strings - `AMOUNT` - Numbers with or without decimal places - `MERCHANT_CATEGORY_CODE` - Alphanumeric strings - `REVERSAL_INDICATOR` - Boolean values - `AUTHORIZATION_FLOW` - Either `PAYMENTS` or `NETWORK` - `ORIGINAL_PROCESSING_CODE`- Original processing code or persisted authorization processing code - `MTI` - Message Type Indicator (MTI) - a four-digit numeric field - ISO 8583 standard
          - `operator` 'eq' | 'neq' | 'gt' | 'gte' | 'lt' | 'lte' | 'in' | 'contains' | 'starts_with' | 'ends_with', required — Operator that will be used on this rule evaluation - `eq`: Equals operator, allowed with rules that evaluate data containing strings, numbers, and booleans. - `neq`: Not equals operator, allowed with rules that evaluate data containing strings, numbers, and booleans. - `gt`: Greater than operator, allowed with rules that evaluate data containing numbers. - `gte`: Greater than or equal operator, allowed with rules that evaluate data containing numbers. - `lt`: Less than operator, allowed with rules that evaluate data containing numbers. - `lte`: Less than or equal operator, allowed with rules that evaluate data containing numbers. - `in`: In operator, allowed with rules that use model list as data. Compares if the data is in the configured list. - `contains`: Contains operator, allowed with rules that use model list as data. Compares if the data is part of any string in the configured list. - `starts_with`: Starts with operator, allowed with rules that use model list as data. Verifies whether any string in the list starts with the data value. - `ends_with`: Ends with operator, allowed with rules that use model list as data. Verifies whether any string in the list ends with the data value.
          - `data` string, required — Data used to evaluate this rule against the operator and the information received in the request. This field must be in the format as indicated in `type` and `operator`. **Note:** This field's value can be a model list ID returned from [Create model list](https://developers.pismo.io/pismo-docs/reference/post-org-model-list). A model list contains a list of values for evaluation.
        - `deny_code` string, required — Deny code when control fails
        - `active` boolean, required — Is the control active?

## Other responses

- `400` — Bad request. Returned in the following cases: - The `x-tenant` header is missing. - The `programId` query parameter is not a positive integer. - Pagination parameters are zero or cannot be parsed as integers.
- `404` — Not found. Returned when `programId` is specified but no flex controls are found for that program.
- `500` — Internal server error.

---

[API](https://skmtc.net/pismo/apis/platform-authentication.md) · [All operations](https://skmtc.net/pismo/apis/platform-authentication/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/pismo/platform-authentication/revisions/935b62e16de4/schema)