Authorization Rules [Beta]

Learn how to create, update and apply simple rules on card transactions.

An authorization rule (Auth Rule) is a control you can set to better manage the transactions on your cards. It enables you to allow or block transactions in specific countries, allow or block transactions at specific merchant types, or run a ZIP code check (where available) during transaction authorization.

To minimize conflict, any given entity (program, account, card) that makes up your program can only have one Auth Rule directly applied to it. However, any higher-level entity's Auth Rule will apply to all entities below it - e.g., a given card's transactions will be subject to the Auth Rule applied to the account that the card belongs to AND the Auth Rule applied to the program that the card belongs to.

Click to enlargeClick to enlarge

Click to enlarge

Auth Rule Schema

{
  "token": String,
  "allowed_countries": List, 
  "blocked_countries": List, 
  "allowed_mcc": List,
  "blocked_mcc": List, 
  "avs_type": String, 
  "state": String,
  "program_level": Boolean, 
  "card_tokens": List,
  "account_tokens": List, 
  "previous_auth_rule_tokens": List
}
tokenGlobally unique identifier for the Auth Rule
allowed_countriesCountries in which the Auth Rule will permit transactions, listed in uppercase ISO 3166-1 alpha-3 three character abbreviations. Note that Lithic maintains a list of countries in which all transactions are blocked; "allowing" those countries in an Auth Rule will not override the Lithic-wide restrictions
blocked_countriesCountries in which the Auth Rule will decline transactions, listed in uppercase ISO 3166-1 alpha-3 three character abbreviations
allowed_mccMerchant category codes for which the Auth Rule will permit transactions, listed in ISO 18245 four-digits. Note that Lithic maintains a list of MCCs for which all transactions are blocked; "allowing" those MCCs in an Auth Rule will not override the Lithic-wide restrictions
blocked_mccMerchant category codes for which the Auth Rule will decline transactions, listed in ISO 18245 four-digits
avs_typeAddress verification process that confirms whether address information entered at point of transaction, if applicable, matches the address on file for a given card. Currently limited to ZIP code checks (ZIP_ONLY). The ZIP code on file with the account that the card belongs to will be checked
stateIndicates whether the Auth Rule is ACTIVE or INACTIVE
program_levelBoolean indicating whether the Auth Rule will be applied at the program level
card_tokensArray of card_token(s) identifying the cards that the Auth Rule will apply to
account_tokensArray of account_token(s) identifying the accounts that the Auth Rule will apply to
previous_auth_rule_tokensIdentifier for the Auth Rule(s) that a new Auth Rule replaced; will be returned only if an Auth Rule is applied to an entity that previously already had one applied

🚧

Note that the use of MCC or country restrictions beyond the terms included in your cardholder agreement with end-users may require additional steps to ensure compliance with card network policies. Use of these restrictions is an agreement from the API user that the restrictions are in compliance with your cardholder agreement terms. Reach out to your Customer Success rep for additional support.

Create Auth Rules

Creates an authorization rule and applies it at the program, account, or card level.

πŸ“˜

If an Auth Rule is created and applied to an entity (or entities) to which an Auth Rule has already been applied, the new Auth Rule will replace the previous Auth Rule, and an identifier for the previous Auth Rule(s) will be returned as previous_auth_rule_tokens.

This endpoint will reject an attempt to create an Auth Rule that conflicts with an existing Auth Rule that applies to the target entity. For example, if a program level Auth Rule blocks transactions in Canada, and an attempt is made to create a card level Auth Rule to allow transactions in Canada (on a card belonging to that program), the POST /auth_rules call will be rejected.

POST https://api.lithic.com/v1/auth_rules

Sample Request

curl https://api.lithic.com/v1/auth_rules \
  -X POST \
  -H "Authorization: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '
{
      "allowed_countries":["USA"],
      "allowed_mcc":["3000", "3001"],
      "avs_type":"ZIP_ONLY",
      "program_level": true
}
'

Sample Response

{
    "allowed_countries": ["USA"],
    "blocked_countries": [],
    "allowed_mcc": ["3000", "3001"],
    "blocked_mcc": [],
    "avs_type": "ZIP_ONLY",
    "token": "d39e680e-af95-47ad-a78e-2415a0c8a81f",
    "program_level": true,
    "state": "ACTIVE",
    "card_tokens": [],
    "account_tokens": [],
    "previous_auth_rule_tokens": []
}

To successfully create an Auth Rule, at least one type of control parameter (country control, MCC control, AVS control) and only one type of entity parameter (card, account, program-level) should be included in the request.

allowed_countries (optional)List of countries in which the Auth Rule will permit transactions. E.g., to allow transactions in the US and Canada only, input "USA" and "CAN".
List. Permitted values: List of uppercase ISO 3166-1 alpha-3 three character abbreviations.

Note that only this field OR blocked_countries can be used for a given Auth Rule.
blocked_countries (optional)List of countries in which the Auth Rule will automatically decline transactions. E.g., to block transactions in the US and Canada only, input "USA" and "CAN".
List. Permitted values: List of uppercase ISO 3166-1 alpha-3 three character abbreviations.

Note that only this field OR allowed_countries can be used for a given Auth Rule.
allowed_mcc (optional)List of merchant category codes for which the Auth Rule will permit transactions. E.g., to permit transactions only at Shoe Stores, input "5661". Refer to Supported Merchant Category Codes (MCCs) for supported MCCs.
List. Permitted values: List of ISO 18245 four-digit MCCs.

Note that only this field OR blocked_mcc can be used for a given Auth Rule.
blocked_mcc (optional)List of merchant category codes for which the Auth Rule will automatically decline transactions. E.g., to block transactions only at Shoe Stores, input "5661". Refer to Supported Merchant Category Codes (MCCs) for supported MCCs.
List. Permitted values: List of ISO 18245 four-digit MCCs.

Note that only this field OR allowed_mcc can be used for a given Auth Rule.
avs_type (optional)Address verification process that confirms whether address information entered at point of transaction, if applicable, matches the address on file for a given card (based on the verification_address object contained within the account object that the card is created under). Currently limited to ZIP code checks only.
String. Permitted values: ZIP_ONLY.
card_tokens (optional)List of card_token(s) identifying the cards that the Auth Rule will apply to.
List. Permitted values: List of 36-digit version 4 UUIDs (including hyphens).

Note that if this parameter is included, account_tokens and program_level cannot. However, one of the three parameters must be included.
account_tokens (optional)List of account_token(s) identifying the accounts that the Auth Rule will apply to.
List. Permitted values: List of 36-digit version 4 UUIDs (including hyphens).

Note that if this parameter is included, card_tokens and program_level cannot. However, one of the three parameters must be included.
program_level (optional)Boolean indicating whether the Auth Rule should be applied at the program level (true if yes; false if no)
String. Permitted values: true, false.

Note that if this parameter is included, card_tokens and account_tokens cannot. However, one of the three parameters must be included.

Update Auth Rules

Update the properties associated with an existing authorization rule.

PUT https://api.lithic.com/v1/auth_rules/{auth_rule_token}

Sample Request

curl https://api.lithic.com/v1/auth_rules/d39e680e-af95-47ad-a78e-2415a0c8a81f \
  -X PUT \
  -H "Authorization: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '
{
      "allowed_countries":["USA","CAN"],
      "blocked_mcc":["3000","3001"],
      "avs_type":"ZIP_ONLY"
}
'

Sample Response

{
    "allowed_countries": ["USA","CAN"],
    "blocked_countries": [],
    "allowed_mcc": ["3000","3001"],
    "blocked_mcc": [],
    "avs_type": "ZIP_ONLY",
    "token": "d39e680e-af95-47ad-a78e-2415a0c8a81f",
    "program_level": true,
    "state": "ACTIVE",
    "card_tokens": [],
    "account_tokens": []
}

To update an Auth Rule, at least one type of control parameter (country control, MCC control, AVS control) should be included in the request. Note that using this endpoint will update the entire configuration of the Auth Rule, not just the parameters passed in.

allowed_countries (optional)List of countries in which the Auth Rule will permit transactions. E.g., to allow transactions in the US and Canada only, input "USA" and "CAN".
List. Permitted values: List of uppercase ISO 3166-1 alpha-3 three character abbreviations.

Note that only this field OR blocked_countries can be used for a given Auth Rule.
blocked_countries (optional)List of countries in which the Auth Rule will automatically decline transactions. E.g., to block transactions in the US and Canada only, input "USA" and "CAN".
List. Permitted values: List of uppercase ISO 3166-1 alpha-3 three character abbreviations.

Note that only this field OR allowed_countries can be used for a given Auth Rule.
allowed_mcc (optional)List of merchant category codes for which the Auth Rule will permit transactions. E.g., to permit transactions only at Shoe Stores, input "5661". Refer to Supported Merchant Category Codes (MCCs) for supported MCCs.
List. Permitted values: List of ISO 18245 four-digit MCCs.

Note that only this field OR blocked_mcc can be used for a given Auth Rule.
blocked_mcc (optional)List of merchant category codes for which the Auth Rule will automatically decline transactions. E.g., to block transactions only at Shoe Stores, input "5661". Refer to Supported Merchant Category Codes (MCCs) for supported MCCs.
List. Permitted values: List of ISO 18245 four-digit MCCs.

Note that only this field OR allowed_mcc can be used for a given Auth Rule.
avs_type (optional)Address verification process that confirms whether address information entered at point of transaction, if applicable, matches the address on file for a given card (based on the verification_address object contained within the account object that the card is created under). Currently limited to ZIP code checks only.
String. Permitted values: ZIP_ONLY.

List Auth Rules

List the properties and entities (program, accounts, and cards) associated with an existing authorization rule. If no Auth Rule token is provided, this endpoint will return all of the Auth Rules under the program.

GET https://api.lithic.com/v1/auth_rules/{auth_rule_token}

Sample Request

curl https://api.lithic.com/v1/auth_rules/d39e680e-af95-47ad-a78e-2415a0c8a81f \
  -X GET \
  -H "Authorization: YOUR_API_KEY" \
  -H "Content-Type: application/json" 

Sample Response

[
 {
    "allowed_countries":["USA","CAN"],
    "blocked_countries": [],
    "allowed_mcc": [],
    "blocked_mcc": ["3000","3001"],
    "avs_type": "ZIP_ONLY",
    "token": "d39e680e-af95-47ad-a78e-2415a0c8a81f",
    "program_level": true,
    "state": "ACTIVE",
    "card_tokens": [],
    "account_tokens": []
 }
]

Apply Auth Rule to Entity

Applies an existing authorization rule to a program, account(s), or card(s).

If an Auth Rule is applied via this endpoint to an entity that already had an Auth Rule applied, an identifier for the previous Auth Rule (now no longer applied to that entity) will be returned as previous_auth_rule_tokens. Note that any Auth Rule not applied to an entity will be automatically deactivated (i.e., status will be set to INACTIVE).

POST https://api.lithic.com/v1/auth_rules/{auth_rule_token}/apply

Sample Request

curl https://api.lithic.com/v1/auth_rules/d39e680e-af95-47ad-a78e-2415a0c8a81f/apply \
  -X POST \
  -H "Authorization: YOUR_API_KEY" \
  -H "Content-Type: application/json" 
  -d '
{
      "account_tokens": ["ecbd1d58-0299-48b3-84da-6ed7f5bf9ec3"]
}
'

Sample Response

{
    "allowed_countries":["USA","CAN"],
    "blocked_countries": [],
    "allowed_mcc": [],
    "blocked_mcc": ["3000","3001"],
    "avs_type": "ZIP_ONLY",
    "token": "d39e680e-af95-47ad-a78e-2415a0c8a81f",
    "program_level": true,
    "state": "ACTIVE",
    "card_tokens": [],
    "account_tokens": ["ecbd1d58-0299-48b3-84da-6ed7f5bf9ec3"],
    "previous_auth_rule_tokens": []
}
card_tokens (optional)List of card_token(s) identifying the cards that the Auth Rule will apply to.
List. Permitted values: List of 36-digit version 4 UUIDs (including hyphens).

Note that if this parameter is included, account_tokens and program_level cannot. However, one of the three parameters must be included.
account_tokens (optional)List of account_token(s) identifying the accounts that the Auth Rule will apply to.
List. Permitted values: List of 36-digit version 4 UUIDs (including hyphens).

Note that if this parameter is included, card_tokens and program_level cannot. However, one of the three parameters must be included.
program_level (optional)Boolean indicating whether the Auth Rule should be applied at the program level (true if yes; false if no)
String. Permitted values: true, false.

Note that if this parameter is included, card_tokens and account_tokens cannot. However, one of the three parameters must be included.

Remove Auth Rule from Entity

Remove an existing authorization rule from a program, account(s), or card(s). Note that any Auth Rule not applied to an entity will be automatically deactivated (i.e., status will be set to INACTIVE).

DELETE https://api.lithic.com/v1/auth_rules/remove

Sample Request

curl https://api.lithic.com/v1/auth_rules/remove/ \
  -X DELETE \
  -H "Authorization: YOUR_API_KEY" \
  -H "Content-Type: application/json" 
  -d '
{
      "account_tokens":["ecbd1d58-0299-48b3-84da-6ed7f5bf9ec1"]
}
'

Sample Response

{
    "account_tokens": ["ecbd1d58-0299-48b3-84da-6ed7f5bf9ec1"],
    "card_tokens": [],
    "program_level": false,
    "previous_auth_rule_tokens": ["d39e680e-af95-47ad-a78e-2415a0c8a81f"]
}
card_tokens (optional)List of card_token(s) identifying the cards that the Auth Rule will apply to.
List. Permitted values: List of 36-digit version 4 UUIDs (including hyphens).

Note that if this parameter is included, account_tokens and program_level cannot. However, one of the three parameters must be included.
account_tokens (optional)List of account_token(s) identifying the accounts that the Auth Rule will apply to.
List. Permitted values: List of 36-digit version 4 UUIDs (including hyphens).

Note that if this parameter is included, card_tokens and program_level cannot. However, one of the three parameters must be included.
program_level (optional)Boolean indicating whether the Auth Rule should be applied at the program level (true if yes; false if no)
String. Permitted values: true, false.

Note that if this parameter is included, card_tokens and account_tokens cannot. However, one of the three parameters must be included.

Supported Merchant Category Codes (MCCs)

Lithic supports the below set of merchant category codes (MCCs) for use in Auth Rules.

Note that codes are subject to change and may differ by card network. The below codes and descriptions are for informational purposes only, and Lithic cannot guarantee that each will match those maintained by the networks.

Please refer to network-published MCC materials for the most recent information. We also recommend referring to actual data from past transactions on your cards to build the list of MCCs that you would like to allow or block via an Auth Rule.

Supported MCCs:
MCCDescription
0742Veterinary Services
0763Agricultural Co-operatives
0780Horticultural and Landscaping Services
1520General Contractors-Residential and Commercial
1711Air Conditioning, Heating, and Plumbing Contractors
1731Electrical Contractors
1740Insulation, Masonry, Plastering, Stonework, and Tile Setting Contractors
1750Carpentry Contractors
1761Roofing and Siding, Sheet Metal Work Contractors
1771Concrete Work Contractors
1799Contractors, Special Trade – Not Elsewhere Classified
2741Miscellaneous Publishing and Printing
2791Typesetting, Plate Making, and Related Services
2842Sanitation, Polishing, and Specialty Cleaning Preparations
3000-3299, 4511Airlines, Air Carriers
3351-3441Car Rental Agencies
3501-3790, 3816, 3835Lodging – Hotels, Motels, Resorts
4011Railroads – Freight
4111Transportation – Suburban and Local Commuter Passenger, including Ferries
4112Passenger Railways
4119Ambulance Services
4121Limousines and Taxicabs
4131Bus Lines
4214Motor Freight Carriers, Trucking – Local/Long Distance, Moving and Storage Companies, Local Delivery
4215Courier Services – Air and Ground, Freight Forwarders
4225Public Warehousing – Farm Products, Refrigerated Goods, Household Goods Storage
4411Cruise Lines
4457Boat Leases and Boat Rentals
4468Marinas, Marine Service/Supplies
4511Air Carriers, Airlines – Not Elsewhere Classified
4582Airports, Airport Terminals, Flying Fields (does not include merchants located within airport terminals)
4722Travel Agencies and Tour Operators
4784Bridge and Road Fees, Tolls
4789Transportation Services – Not Elsewhere Classified
4812Telecommunications Equipment Including Telephone Sales
4814Telecommunication Services (Including Prepaid and Recurring Phone Services)
4816Computer Network/Information Services
4821Telegraph Services
4829Money Transfer
4899Cable, Satellite, and Other Pay Television and Radio Services
4900Utilities – Electric, Gas, Heating Oil, Sanitary, Water
5013Motor Vehicle Supplies and New Parts
5021Office and Commercial Furniture
5039Construction Materials – Not Elsewhere Classified
5044Office, Photographic, Photocopy, and Microfilm Equipment
5045Computers, Computer Peripheral Equipment, Software
5046Commercial Equipment – Not Elsewhere Classified
5047Dental/Laboratory/Medical/Ophthalmic Hospital Equipment and Supplies
5051Metal Service Centers and Offices
5065Electrical Parts and Equipment
5072Hardware Equipment and Supplies
5074Plumbing and Heating Equipment
5085Industrial Supplies – Not Elsewhere Classified
5094Precious Stones and Metals, Watches and Jewelry
5099Durable Goods – Not Elsewhere Classified
5111Stationery, Office Supplies, Printing, and Writing Paper
5122Drugs, Drug Proprietors, and Druggists Sundries
5131Piece Goods, Notions, and Other Dry Goods
5137Men's, Women's, and Children's Uniforms and Commercial Clothing
5139Commercial Footwear
5169Chemicals and Allied Products – Not Elsewhere Classified
5172Petroleum and Petroleum Products
5192Books, Periodicals, and Newspapers
5193Florists Supplies, Nursery Stock, and Flowers
5198Paints, Varnishes, and Supplies
5199Nondurable Goods – Not Elsewhere Classified
5200Home Supply Warehouse Stores
5211Building Materials, Lumber Stores
5231Glass, Paint, Wallpaper Stores
5251Hardware Stores
5261Lawn and Garden Supply Stores
5271Mobile Home Dealers
5300Wholesale Clubs
5309Duty Free Stores
5310Discount Stores
5311Department Stores
5331Variety Stores
5399Miscellaneous General Merchandise Stores
5411Grocery Stores, Supermarkets
5422Freezer, Locker Meat Provisioners
5441Candy, Nut, Confectionery Stores
5451Dairy Products Stores
5462Bakeries
5499Miscellaneous Food Stores – Convenience Stores, Markets, Specialty Stores
5511Automobile and Truck Dealers – Sales, Service, Repairs, Parts, and Leasing
5521Automobile and Truck Dealers – (Used Only) – Sales
5531Auto Store, Home Supply Stores
5532Automotive Tire Stores
5533Automotive Parts, Accessories Stores
5541Service Stations (with or without Ancillary Services)
5542Fuel Dispenser, Automated
5551Boat Dealers
5561Camper Dealers, Recreational and Utility Trailers
5571Motorcycle Shops and Dealers
5592Motor Home Dealers
5598Snowmobile Dealers
5599Miscellaneous Automotive, Aircraft, and Farm Equipment Dealers – Not Elsewhere Classified
5611Men’s and Boy’s Clothing and Accessories Stores
5621Women's Ready to Wear Stores
5631Women’s Accessory and Specialty Shops
5641Children's and Infants' Wear Stores
5651Family Clothing Stores
5655Sports Apparel, Riding Apparel Stores
5661Shoe Stores
5681Furriers and Fur Shops
5691Men’s and Women’s Clothing Stores
5697Alterations, Mending, Seamstresses, Tailors
5698Wig and Toupee Shops
5699Accessory and Apparel Stores – Miscellaneous
5712Equipment, Furniture, and Home Furnishings Stores (except Appliances)
5713Floor Covering Stores
5714Drapery, Window Covering and Upholstery Stores
5718Fireplace, Fireplace Screens, and Accessories Stores
5719Miscellaneous Home Furnishing Specialty Stores
5722Household Appliance Stores
5732Electronic Sales
5733Music Stores – Musical Instruments, Pianos, Sheet Music
5734Computer Software Stores
5735Record Shops
5811Caterers
5812Eating Places, Restaurants
5813Bars, Cocktail Lounges, Discotheques, Nightclubs, and Taverns – Drinking Places (Alcoholic Beverages)
5814Fast Food Restaurants
5815Digital Goods – Audiovisual Media Including Books, Movies, and Music
5816Digital Goods – Games
5817Digital Goods – Software Applications (Excluding Games)
5818Digital Goods – Multi-Category
5912Drug Stores, Pharmacies
5921Package Stores, Beer, Wine, and Liquor
5931Second Hand Stores, Used Merchandise Stores
5932Antique Shops – Sales, Repairs, and Restoration Services
5933Pawn Shops
5935Salvage and Wrecking Yards
5937Antique Reproduction Stores
5940Bicycle Shops – Sales and Service
5941Sporting Goods Stores
5942Book Stores
5943Office, School Supply, and Stationery Stores
5944Clock, Jewelry, Watch, and Silverware Store
5945Game, Toy, and Hobby Shops
5946Camera and Photographic Supply Stores
5947Card, Gift, Novelty, and Souvenir Shops
5948Leather Goods and Luggage Stores
5949Fabric, Needlework, Piece Goods, and Sewing Stores
5950Crystal and Glassware Stores
5960Direct Marketing – Insurance Services
5961Mail Order Houses Including Catalog Order Stores
5962Direct Marketing – Travel-Related Arrangement Services
5963Door-to-Door Sales
5964Direct Marketing – Catalog Merchants
5965Direct Marketing – Combination Catalog and Retail Merchants
5966Direct Marketing – Outbound Telemarketing Merchants
5967Direct Marketing – Inbound Telemarketing Merchants
5968Direct Marketing – Continuity/Subscription Merchants
5969Direct Marketing – Other Direct Marketers – Not Elsewhere Classified
5970Artist Supply Stores, Craft Shops
5971Art Dealers and Galleries
5972Stamp and Coin Stores – Philatelic and Numismatic Supplies
5973Religious Goods Stores
5975Hearing Aids – Sales, Service, Supply Stores
5976Orthopedic Goods – Artifical Limb Stores
5977Cosmetic Stores
5978Typewriter Stores – Rentals, Sales, Service
5983Fuel Dealers – Coal, Fuel Oil, Liquefied Petroleum, Wood
5992Florists
5993Cigar Stores and Stands
5994News Dealers and Newsstands
5995Pet Shops – Pet Food and Supplies
5996Swimming Pools – Sales and Supplies
5997Electric Razor Stores – Sales and Service
5998Tent and Awning Shops
5999Miscellaneous and Specialty Retail Stores
6010Financial Institutions – Manual Cash Disbursements
6011Financial Institutions - Automated Cash Disbursements (e.g., ATM)
6012Financial Institutions – Merchandise and Services
6051Quasi Cash – Merchant (e.g., travelers cheques, foreign currency, money orders)
6211Securities – Brokers/Dealers
6300Insurance Sales, Underwriting, and Premiums
6381Insurance Premiums
6513Real Estate Agents and Managers – Rentals
7011Lodging – Hotels, Motels, Resorts – Not Elsewhere Classified
7012Timeshares
7032Recreational and Sporting Camps
7033Campgrounds and Trailer Parks
7210Cleaning, Garment and Laundry Services
7211Laundry Services – Family and Commercial
7216Dry Cleaners
7217Carpet and Upholstery Cleaning
7221Photographic Studios
7230Barber and Beauty Shops
7251Hat Cleaning Shops, Shoe Repair Shops, Shoe Shine Parlors
7261Funeral Service and Crematories
7273Dating Services
7276Tax Preparation Service
7277Debt, Marriage, Personal – Counseling Service
7278Buying/Shopping Clubs, Services
7296Clothing Rental – Costumes, Uniforms, Formal Wear
7297Massage Parlors
7298Health and Beauty Spas
7299Other Services – Not Elsewhere Classified
7311Advertising Services
7321Consumer Credit Reporting Agencies
7332Blueprinting and Photocopying Services
7333Commercial Art, Graphics, Photography
7338Quick Copy, Reproduction and Blueprinting Services
7339Stenographic and Secretarial Support Services
7342Exterminating and Disinfecting Services
7349Cleaning and Maintenance, Janitorial Services
7361Employment Agencies, Temporary Help Services
7372Computer Programming, Data Processing, and Integrated Systems Design Services
7375Information Retrieval Services
7379Computer Maintenance, Repair, and Services – Not Elsewhere Classified
7392Consulting, Management, and Public Relations Services
7393Detective Agencies, Protective Agencies, Security Services including Armored Cars, Guard Dogs
7394Equipment Rental and Leasing Services, Furniture Rental, Tool Rental
7395Photo Developing, Photofinishing Laboratories
7399Business Services – Not Elsewhere Classified
7512Automobile Rental Agency – Not Elsewhere Classified
7513Truck Rental
7519Motor Home and Recreational Vehicle Rental
7523Automobile Parking Lots and Garages
7531Automotive Body Repair Shops
7534Tire Retreading and Repair Shops
7535Automotive Paint Shops
7538Automotive Service Shops
7542Car Washes
7549Towing Services
7622Electronic Repair Shops
7623Air Conditioning and Refrigeration Repair Shops
7629Appliance Repair Shops, Electrical and Small
7631Clock, Jewelry, and Watch Repair Shops
7641Furniture – Reupholstery and Repair, Refinishing
7692Welding Repair
7699Miscellaneous Repair Shops and Related Services
7800Government Owned Lottery
7801Government-Licensed Casinos (Online or Internet Gambling)
7802Government-Licensed Horse/Dog Racing
7829Motion Picture and Video Tape Production and Distribution
7832Motion Picture Theaters
7841Video Entertainment Rental Stores
7911Dance Halls, Studios and Schools
7922Theatrical Producers (except Motion Pictures), Ticket Agencies
7929Bands, Orchestras, and Miscellaneous Entertainers – Not Elsewhere Classified
7932Pool and Billiard Establishments
7933Bowling Alleys
7941Athletic Fields, Commercial Sports, Professional Sports Clubs, Sports Promoters
7991Tourist Attractions and Exhibits
7992Golf Courses, Public
7993Video Amusement Game Supplies
7994Video Game Arcades/Establishments
7995Gambling Transactions
7996Amusement Parks, Carnivals, Circuses, Fortune Tellers
7997Clubs – Country Clubs, Membership (Athletic, Recreation, Sports), Private Golf Courses
7998Aquariums, Dolphinariums, Zoos, and Seaquariums
7999Recreation Services – Not Elsewhere Classified
8011Doctors – Not Elsewhere Classified
8021Dentists, Orthodontists
8031Osteopathic Physicians
8041Chiropractors
8042Optometrists, Ophthalmologists
8043Opticians, Opticians Goods, and Eyeglasses
8044Optical Goods and Eyeglasses
8049Chiropodists, Podiatrists
8050Nursing and Personal Care Facilities
8062Hospitals
8071Dental and Medical Laboratories
8099Health Practitioners, Medical Services – Not Elsewhere Classified
8111Attorneys, Legal Services
8211Schools, Elementary and Secondary
8220Colleges, Universities, Professional Schools, and Junior Colleges
8241Schools, Correspondence
8244Schools, Business and Secretarial
8249Schools, Trade and Vocational
8299Schools and Educational Services – Not Elsewhere Classified
8351Child Care Services
8398Organizations, Charitable and Social Service
8641Associations – Civic, Social, and Fraternal
8651Organizations, Political
8661Organizations, Religious
8675Automobile Associations
8699Organizations, Membership – Not Elsewhere Classified
8734Testing Laboratories (Non-Medical)
8911Architectural, Engineering, and Surveying Services
8931Accounting, Auditing, and Bookkeeping Services
8999Professional Services – Not Elsewhere Classified
9211Court Costs including Alimony and Child Support
9222Fines
9223Bail and Bond Payments
9311Tax Payments
9399Government Services – Not Elsewhere Classified
9402Postal Services – Government Only

Auth Rules FAQ

How do Auth Rules at various entity levels interact with each other? When multiple Auth Rules apply to a given transaction, the most restrictive set of conditions will apply. For example, if an account-level Auth Rule allows transactions in the US and Canada, and a card-level Auth Rule allows for only the US, transactions on that card will be restricted to the US only. In an example with MCC controls, if a program-level Auth Rule blocks MCC 1234 and a card-level Auth Rule allows MCC 5678, then transactions on that card will be permitted only on MCC 5678.
What are best practices to manage Auth Rules at scale? We recommend applying Auth Rules at the highest-level entity possible. For example, if you know that all of your cards will only ever be used on a set of 3 MCCs, we recommend applying that Auth Rule to your program. This will make your Auth Rule easier to manage if you need to add a fourth MCC to the allowed list, as opposed to updating an Auth Rule and applying it to many individual cards.
How do country restrictions work for e-commerce? Country restrictions are based on the country parameter contained in the merchant schema part of a transaction object - i.e., country of card acceptor. This data tends to be highly accurate for card-present transactions, but can be less accurate for e-commerce transactions. For cards that will have a large number of e-commerce use cases, we recommend conducting testing for specific merchants before implementing a country restriction.
Which merchant category codes can be used in an Auth Rule? See the above Supported Merchant Category Codes (MCCs) section for a detailed list of MCCs that can be used. Since MCC data quality can differ by merchant, we recommend that you build your allowed/blocked list with caution and by referencing prior data on your cards wherever possible to ensure coverage of all use cases.
How do Auth Rules work if I already have ASA implemented? In the transaction flow, any Auth Rules that apply to your program, account, or card will be checked before you are sent an ASA request. In other words, the transaction will be automatically declined before an ASA request is generated if the transaction's attributes violate any of the configured Auth Rules.

Did this page help you?