---
title: "Add a new authorisation rule"
method: POST
path: "/v3/spend/applications/{clientId}/spend-controls/rules"
tags: ["spend-controls"]
---

# Add a new authorisation rule

`POST /v3/spend/applications/{clientId}/spend-controls/rules`

Creates an authorisation rule. It won't be enabled unless it is [applied](/api-reference/spend-controls/spendcontrolsruleapply).

{% admonition type="warning" %}
An `ALLOW` rule permits only the transactions that match the specified criteria and blocks all others. For instance, a rule allowing `SGD` transactions will block all transactions that are not in `SGD`.
{% /admonition %}

## Path parameters

- `clientId` string, required

## Headers

- `X-External-Correlation-Id` string, uuid

## Request body

- object
  - `type` 'MCC' | 'CURRENCY' — The type of authorisation rule.
  - `operation` 'ALLOW' | 'BLOCK' — Determines whether the transactions should be allowed or blocked.
  - `description` string — The description of the authorisation rule.
  - `values` string[] — A list of values based on the `type` of rule. For example, setting `MCC` as `type` requires `values` to be set as `["1234", "5678"]`.

## Response `200`

The created rule.

- Rule
  - `id` integer — The unique ID for the authorisation rule.
  - `type` 'MCC' | 'CURRENCY' — The type of authorisation rule.
  - `operation` 'ALLOW' | 'BLOCK' — Determines whether the transactions should be allowed or blocked.
  - `description` string — The description of the authorisation rule.
  - `values` string[] — A list of values based on the `type` of rule configured.

## Other responses

- `429` — Rate limit exceeded. Retry after the number of seconds specified in the `Retry-After` header.

---

[API](https://skmtc.net/wise/apis/platform-api.md) · [All operations](https://skmtc.net/wise/apis/platform-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/wise/platform-api/revisions/4907a1d269ab/schema)