v1

latestOpenAPI 3.1.0Copyright Pismo2026-07-247702,7523.1 MB

Account flex controls

Create account flex control

Creates flex control for account. You use flex controls to restrict financial operations. For example, you can set spending and usage limits. For more information, refer to Flexible transaction controls.

To create a cumulative condition, the type can be:

spending_limit to restrict the maximum total amount that can be transacted during an specific period.
usage_limit to evaluate the quantity of transactions. The cumulative control type must also specify the max_limit. The limit_duration and reset_period parameters are optional, but they are linked with the behavior of max_limit.

To create a restriction condition, set type as restriction.

To restrict an operation, the restriction control must specify:

at least one condition in the conditions array.
the required values for attribute, operator, and value in the condition.

Once you create the control, you can't change its type.

This endpoint generates an Account flex control created event.

NOTE: This endpoint requires an account-specific access token.

post/v1/accounts/{accountId}/flex-controls

Path parameters

accountIdnumber required

Example:9999999

Account ID

Request body

type'authentication' | 'challenge-request' required

Evaluation intention

namestring required

name

beneficiary_idstring

Account beneficiary ID

override_controlsstring[]

List of existing flex control IDs to override. The platform ignores these controls and only evaluates the new flex control.

currency_codestring

ISO 4217 3-letter currency code, For example, 986 = Brazilian real and 840 = US dollar.

time_zonestring

IANA Time Zone database, such as "America/New_York". This attribute is used to evaluate the flex control using the desired time zone for condition attributes such as week_day, month_day, time_now, and reset_period. If time_zone is empty, the control is evaluated using the UTC time zone.

max_limitinteger

Maximum spending limit. Once met or exceeded, any subsequent transactions are declined by evaluation control flow. Note that this value is an integer. Since global currencies vary in the number of digits that are allowed after the decimal point, you must convert the actual maximum spending limit into an integer value to use in this field. To do this, use the following formula.

value = floatNumber × 10^X, where X is the number of digits after the decimal separator for the currency as defined in ISO 4217.

For example, if you want to set the value 499.99 for BRL currency transactions, where the number of decimal places is 2, you must set it to 49999 (499.99 × 10²).

If you want to set the value 499 for JPY currency transactions, where the number of decimal places is 0, you must set it to 4999 (4999.0 × 10^0 = 4999.0 × 1 - in other words, the value doesn't change.)

This field is REQUIRED for cumulative controls.

limit_durationstring

Flex control limit period duration (ISO 8601 format). For example, if a flex control sets a spending limit of $500, and limit_duration is set to one month (P1M), then the user cannot spend more than $500 from the account in any one month period. If limit_duration is not set, then the flex control does not accumulate.

reset_datetimestring date-time

Note: This field has been deprecated. The field reset_period has replaced reset_datetime. The reset datetime (RFC-3339 format) of the flex control.

deny_codestring required

Deny code related to restriction. This code is returned when the evaluation does not meet the conditions.

response_codestring

Network two-digit response code. For example: 00 = approve, 51 = insufficient funds, 57 = card not active, 96 = system failure, etc. For more information, see Validation codes for authorization events. If approve = false, you can use this value to respond to the network.

custom_code'FL2' | 'FL8' | 'FLB' | 'FLE' | 'DCM' | 'VMN' | '998' | 'LUD' | 'LUE' | 'LUT' | 'LGE' | '810' | 'PFT' | 'IAT' | 'BND' | 'ANF' | 'CTE' | 'CED' | 'ZBD' | 'FRB' | 'UBT' | 'FL6' | 'BNF' | 'BNP' | 'BNR' | 'VED' | 'BNU' | 'VEV' | 'UBN' | 'CSU' | 'NPL' | 'OP1' | 'TNF' | 'Z26' | 'Z24' | 'Z29' | 'Z23' | 'Z22'

Internal custom code generated in authorization flow for declined requests, indicating the reason the request was declined.

For more information, see authorization validations.

evaluation_orderinteger

Order in which the control is evaluated. If this value is not provided, the control is evaluated after the controls with the configured evaluation_order value.

activeboolean

Is the program calendar strategy active?

Example request

{
  "type": "authentication",
  "processing_codes": {
    "credit": "219803",
    "debit": "219803"
  },
  "name": "Paul Bearer",
  "beneficiary_id": "8497225d-2096-4b92-990e-f73bd21bc48c",
  "override_controls": [
    "spending-limit-id-1",
    "spending-limit-id-2"
  ],
  "currency_code": "840",
  "time_zone": "America/Sao_Paulo",
  "max_limit": 1000,
  "limit_duration": "P1M",
  "reset_datetime": "2022-03-08T21:19:55Z",
  "reset_period": {
    "week_day": "monday",
    "time": "3:00AM",
    "utc_time": "3:00AM"
  },
  "conditions": [
    {
      "type": "MERCHANT_NAME_LIST",
      "operator": "eq",
      "data": "10"
    }
  ],
  "deny_code": "ERR_VAL_BALANCE",
  "response_code": "00",
  "custom_code": "FLB",
  "active": true
}

Response

OK. Successful flex control creation.

idstring uuidv4 required

Flex control ID

deny_codestring required

Deny code related to restriction. This code is returned when the evaluation does not meet the conditions.

namestring required

name

type'authentication' | 'challenge-request' required

Evaluation intention

rule_reference_idstring

Flex control template ID

beneficiary_idstring

Account beneficiary ID

override_controlsstring[]

List of existing flex control IDs to override. The platform ignores these controls and only evaluates the new flex control.

descriptionstring

Flex control description

currency_codestring

ISO 4217 3-letter currency code, For example, 986 = Brazilian real and 840 = US dollar.

time_zonestring

max_limitinteger

value = floatNumber × 10^X, where X is the number of digits after the decimal separator for the currency as defined in ISO 4217.

For example, if you want to set the value 499.99 for BRL currency transactions, where the number of decimal places is 2, you must set it to 49999 (499.99 × 10²).

This field is REQUIRED for cumulative controls.

available_limitinteger

Total available limit to spend, calculated by: max_limit - current_spend_limit. The current_spend_limit, an internal field, is the total amount of all approved transactions in the limit_duration period. It is reset by the evaluation flow when a new transaction is evaluated in the new period according to the reset_datetime.

When available_limit is set in a PATCH request, it resets current_spend_limit. In this case, available_limit cannot be greater than max_limit. Note that available_limit is an integer. Since global currencies vary in the number of digits that are allowed after the decimal point, you must convert the actual maximum spending limit into an integer value to use in this field. To do this, use the following formula:

value = floatNumber * 10^x, where x is the number of digits for the currency as defined in ISO 4217.

For example, if you want to set the value 499.99 for BRL currency transactions, you must set 49999 = 499.99 * 10^2.

On the other hand, the Japanese money system does't use fractions of a yen (the Japanese currency). So, to set the value at 4999 yen, you must set 4999 = 4999.0 * 10^0 = 4999.0 * 1. (In other words, the value doesn't change.)

limit_durationstring

reset_datetimestring date-time

Reset datetime (RFC-3339 format) for the control rule. If reset_datetime is not set, a default is calculated based on limit_duration period and the current time. This field should only be specified when type is either spending_limit or usage_limit.