v1

latestOpenAPI 3.1.0Copyright Pismo2026-07-247702,7523.1 MB

Customer flex controls

Create customer flex control

Creates flex control for customer. You use flex controls to restrict financial operations. For example, you can set spending and usage limits. See Flexible transaction controls for more information.

To create a cumulative condition, the type can be:

spending_limit to restrict the maximum total amount that can be transacted during an specific period.
usage_limit to evaluate the quantity of transactions. The cumulative control type must also specify the max_limit. The limit_duration and reset_period parameters are optional, but they are linked with the behavior of max_limit.

To create a restriction condition, set type as restriction.

To restrict an operation, the restriction control must specify:

at least one condition in the conditions array.
the required values for attribute, operator, and value in the condition.

Once you create the control, you can't change its type.

This endpoint generates a Customer flex control created event.

NOTE: This endpoint requires an account-specific access token.

post/v1/customers/{customerId}/flex-controls

Path parameters

customerIdnumber required

Example:9999999

Customer ID

Request body

type'authentication' | 'challenge-request' required

Evaluation intention

rule_reference_idstring

If rule_reference_id is set, this program-level flex control, if it exists, overrides this flex control.

namestring required

name

account_idinteger required

Account ID

currency_codestring

ISO 4217 3-letter currency code, For example, 986 = Brazilian real and 840 = US dollar.

max_limitinteger

Maximum spending limit. Once met or exceeded, any subsequent transactions are declined by evaluation control flow. Note that this value is an integer. Since global currencies vary in the number of digits that are allowed after the decimal point, you must convert the actual maximum spending limit into an integer value to use in this field. To do this, use the following formula.

value = floatNumber × 10^X, where X is the number of digits after the decimal separator for the currency as defined in ISO 4217.

For example, if you want to set the value 499.99 for BRL currency transactions, where the number of decimal places is 2, you must set it to 49999 (499.99 × 10²).

If you want to set the value 499 for JPY currency transactions, where the number of decimal places is 0, you must set it to 4999 (4999.0 × 10^0 = 4999.0 × 1 - in other words, the value doesn't change.)

This field is REQUIRED for cumulative controls.

max_transactionsinteger

Maximum number of transactions allowed. Once met or exceeded, subsequent transactions are declined by the evaluation control flow.

max_amountinteger

Maximum accumulated amount allowed. Once met or exceeded, subsequent transactions are declined by the evaluation control flow. Note that the value must be calculated as follows.

value = floatNumber × 10^X, where X is the number of digits after the decimal separator for the currency defined in ISO 4217.

For example, if you want to set the value 499.99 for USD currency transactions, where the number of decimal places is 2, you must set the value to 49999 (499.99 × 10²).

If you want to set the value 499 for JPY currency transactions, where the number of decimal places is 0, you must set the value to 499 (499.0 × 10^0 = 499.0 × 1 - in other words, the value doesn't change).

limit_durationstring

Flex control limit period duration (ISO 8601 format). For example, if a flex control sets a spending limit of $500, and limit_duration is set to one month (P1M), then the user cannot spend more than $500 from the account in any one month period. If limit_duration is not set, then the flex control does not accumulate.

reset_datetimestring date-time

Note: This field has been deprecated, use reset_period instead. The reset datetime (RFC-3339 format) of the control rule.

time_zonestring

IANA Time Zone database, such as "America/New_York". This attribute is used to evaluate the flex control using the desired time zone for condition attributes such as week_day, month_day, time_now, and reset_period. If time_zone is empty, the control is evaluated using the UTC time zone.

card_idsinteger[]

List of card IDs

activeboolean

Is the program calendar strategy active?

deny_codestring

Deny code related to restriction. This code is returned when the evaluation does not meet the conditions.

response_codestring

Network two-digit response code. For example: 00 = approve, 51 = insufficient funds, 57 = card not active, 96 = system failure, etc. For more information, see Validation codes for authorization events. If approve = false, you can use this value to respond to the network.

custom_code'FL2' | 'FL8' | 'FLB' | 'FLE' | 'DCM' | 'VMN' | '998' | 'LUD' | 'LUE' | 'LUT' | 'LGE' | '810' | 'PFT' | 'IAT' | 'BND' | 'ANF' | 'CTE' | 'CED' | 'ZBD' | 'FRB' | 'UBT' | 'FL6' | 'BNF' | 'BNP' | 'BNR' | 'VED' | 'BNU' | 'VEV' | 'UBN' | 'CSU' | 'NPL' | 'OP1' | 'TNF' | 'Z26' | 'Z24' | 'Z29' | 'Z23' | 'Z22'

Internal custom code generated in authorization flow for declined requests, indicating the reason the request was declined.

For more information, see authorization validations.

evaluation_orderinteger

Order in which the control is evaluated. If this value is not provided, the control is evaluated after the controls with the configured evaluation_order value.

card_mode'credit' | 'debit'

Specifies the operational mode of the card.

Example request

{
  "type": "authentication",
  "processing_codes": {
    "credit": "219803",
    "debit": "219803"
  },
  "rule_reference_id": "purchase-1M",
  "name": "Paul Bearer",
  "account_id": 500000,
  "currency_code": "840",
  "max_limit": 1000,
  "max_transactions": 10,
  "max_amount": 100000,
  "limit_duration": "P1M",
  "reset_datetime": "2022-03-08T21:19:55Z",
  "time_zone": "America/Sao_Paulo",
  "reset_period": {
    "week_day": "monday",
    "time": "3:00AM",
    "utc_time": "3:00AM"
  },
  "reset_strategy": {
    "reset_trigger": {
      "authentication_method": [
        "password",
        "sms",
        "email"
      ]
    }
  },
  "conditions": [
    {
      "type": "MERCHANT_NAME_LIST",
      "operator": "eq",
      "data": "10"
    }
  ],
  "active": true,
  "deny_code": "ERR_VAL_BALANCE",
  "response_code": "00",
  "custom_code": "FLB",
  "card_mode": "credit"
}

Response

OK. Successful flex control creation.

idstring uuid required

Flex control ID is auto-generated at creation time.

type'authentication' | 'challenge-request' required

Evaluation intention

rule_reference_idstring

ID of program-level flex control. Only present in generic flex controls created for the entire program.

namestring

name

account_idinteger required

Account ID

customer_idinteger

Customer ID

card_idsnumber[]

Card ID list

currency_codestring

ISO 4217 3-letter currency code, For example, 986 = Brazilian real and 840 = US dollar.

max_limitinteger

value = floatNumber × 10^X, where X is the number of digits after the decimal separator for the currency as defined in ISO 4217.

For example, if you want to set the value 499.99 for BRL currency transactions, where the number of decimal places is 2, you must set it to 49999 (499.99 × 10²).

This field is REQUIRED for cumulative controls.

max_transactionsinteger

Maximum number of transactions allowed. Once met or exceeded, subsequent transactions are declined by the evaluation control flow.

max_amountinteger

Maximum accumulated amount allowed. Once met or exceeded, subsequent transactions are declined by the evaluation control flow. Note that the value must be calculated as follows.

value = floatNumber × 10^X, where X is the number of digits after the decimal separator for the currency defined in ISO 4217.

For example, if you want to set the value 499.99 for USD currency transactions, where the number of decimal places is 2, you must set the value to 49999 (499.99 × 10²).

limit_durationstring

reset_datetimestring date-time

Reset datetime (RFC-3339 format). If reset_datetime is not set, by default it will calculated based on limit_duration period and the current time.

time_zonestring

available_limitinteger

Total available limit to spend, calculated by: max_limit - current_spend_limit. The current_spend_limit, an internal field, is the total amount of all approved transactions in the limit_duration period. It is reset by the evaluation flow when a new transaction is evaluated in the new period according to the reset_datetime.

When available_limit is set in a PATCH request, it resets current_spend_limit. In this case, available_limit cannot be greater than max_limit. Note that available_limit is an integer. Since global currencies vary in the number of digits that are allowed after the decimal point, you must convert the actual maximum spending limit into an integer value to use in this field. To do this, use the following formula:

value = floatNumber * 10^x, where x is the number of digits for the currency as defined in ISO 4217.

For example, if you want to set the value 499.99 for BRL currency transactions, you must set 49999 = 499.99 * 10^2.

On the other hand, the Japanese money system does't use fractions of a yen (the Japanese currency). So, to set the value at 4999 yen, you must set 4999 = 4999.0 * 10^0 = 4999.0 * 1. (In other words, the value doesn't change.)

activeboolean

Is the program calendar strategy active?

deny_codestring

Deny code related to restriction. This code is returned when the evaluation does not meet the conditions.

response_codestring

Internal custom code generated in authorization flow for declined requests, indicating the reason the request was declined.

For more information, see authorization validations.

evaluation_orderinteger

Order in which the control is evaluated. If this value is not provided, the control is evaluated after the controls with the configured evaluation_order value.

card_mode'credit' | 'debit'

Specifies the operational mode of the card.

customizedboolean

Indicates whether the flex control is managed by the user. If customized is false, the flex control is managed by the card's program. Generally speaking, users shouldn't change flex controls created by the program, however it is possible to do so. You can reverse indivdually managing a flex control with a call to Update account flex control or Update customer flex control and setting customized as false.

Example response

{
  "id": "89cbdadc-860b-4275-a5cd-d9d892fd3869",
  "type": "authentication",
  "processing_codes": {
    "credit": "219803",
    "debit": "219803"
  },
  "rule_reference_id": "purchase-1M",
  "name": "Paul Bearer",
  "account_id": 8988000,
  "customer_id": 99999999,
  "card_ids": [
    11111,
    22222
  ],
  "currency_code": "840",
  "max_limit": 1000,
  "max_transactions": 10,
  "max_amount": 100000,
  "limit_duration": "P1M",
  "reset_datetime": "2022-03-08T21:19:55Z",
  "time_zone": "America/Sao_Paulo",
  "reset_period": {
    "week_day": "monday",
    "time": "3:00AM",
    "utc_time": "3:00AM"
  },
  "reset_strategy": {
    "reset_trigger": {
      "authentication_method": [
        "password",
        "sms",
        "email"
      ]
    }
  },
  "available_limit": 300,
  "conditions": [
    {
      "attribute": "balance",
      "operator": "gt",
      "value": "10000"
    }
  ],
  "active": true,
  "deny_code": "ERR_VAL_BALANCE",
  "response_code": "00",
  "custom_code": "FLB",
  "card_mode": "credit",
  "customized": true
}