Country & Acceptance Method Controls

You can now restrict card transactions by country and acceptance method via the Card Controls API. Both control types are added to the card controls object alongside existing controls (categories, merchants, dates, times, locations).

Country controls and acceptance methods can be set when:

• Updating existing card controls via PUT /cards/{cardId}/controls
• Issuing new cards via all three card issue endpoints (POST /cards, instant issue, instant PCI)
• Creating card requests via POST /card-requests - controls are inherited when the request is approved

✨ New: Country Controls

Configure allowlists or blocklists at the card level using ISO 3166-1 alpha-3 country codes.

• ALLOWED: Only transactions in listed countries are permitted (whitelist)
• BLOCKED: Transactions in listed countries are declined (blacklist)

PUT /cards/{cardId}/controls

{
  "countries": {
    "restriction": "ALLOWED",
    "values": ["AUT", "DEU", "CHE"]
  }
}

A new reference endpoint GET /cards/card-controls/supported-countries will return the list of eligible country codes with labels, making it easy to build country selection UIs.

✨ New: Acceptance Method Controls

Restrict which payment methods a card can be used with. Only the ALLOWED restriction is supported; unlisted methods are automatically blocked.

Available methods: ONLINE, MOBILE_WALLET, MANUAL_ENTRY, CONTACTLESS, CHIP_DIP, MAGNETIC_STRIPE, NOT_AVAILABLE, OTHER

PUT /cards/{cardId}/controls

{
  "acceptanceMethods": {
    "type": "ACCEPTANCE_METHOD",
    "restriction": "ALLOWED",
    "values": ["ONLINE", "CONTACTLESS", "CHIP_DIP"]
  }
}

Card Configuration Discovery

The available card configs response (GET /cards/available) now returns a cardControls object for each configuration, indicating which controls are supported. This includes countries, acceptanceMethods, categories, dates, locations, merchants, and times. US card configs return null for country controls.

Endpoints

Callbacks

The existing CARD_CONTROL_UPDATED callback event now includes countries and acceptanceMethods in the payload. This event fires when controls are updated via API or UI.

Constraints

• Country codes must be valid ISO 3166-1 alpha-3 (e.g., DEU, not DE)
• Country controls are not available for US-issued cards (returns 400)
• Acceptance methods only support ALLOWED restriction (no BLOCKED)
• At least one country code must be provided when setting country controls

Questions? Contact your Partner Success manager or email [email protected]