---
title: "Create a control"
method: POST
path: "/issuing/controls"
tags: ["Controls"]
---

# Create a control

`POST /issuing/controls`

## Request

- Base URL: `https://{prefix}.api.sandbox.checkout.com`
- URL: `https://{prefix}.api.sandbox.checkout.com/issuing/controls`
- Auth: OAuth 2
  - Client credentials
  - Token URL: `string` scopes: `issuing:controls-write`
- TypeScript: <https://skmtc.dev/checkout/apis/checkout-com-api-reference/docs/issuing/controls/post.ts> (a function with typed inputs; its response is checked against the schema)

Creates a control and applies it to the specified target.

## Headers

- `Cko-Idempotency-Key` string

## Request body

- union: The control to create.
  - object
    - `description` string: A description for the control.
    - `control_type` 'velocity_limit' | 'mcc_limit' | 'mid_limit', required: The control's type. A `velocity_limit` determines how much can be spent over a given period of time. An `mcc_limit` determines the types of businesses from which transactions can be processed. A `mid_limit` specifies the merchants from whom transactions can be processed.
    - `target_id` string, required: The ID of the card or control profile to apply the control to. Note that control profiles cannot be a target for `velocity_limit` controls.
    - `velocity_limit` VelocityLimit, required: The velocity limit, which determines how much a target card can spend over a given timeframe.
      - `amount_limit` integer, required: The amount the target can spend, in minor units.
      - `velocity_window` VelocityWindow, required: The period of time over which the specified `amount_limit` can be spent.
        - `type` 'daily' | 'weekly' | 'monthly' | 'all_time', required: The velocity window's unit of time.
      - `mcc_list` string[]: The list of <a href= "https://www.checkout.com/docs/resources/codes/merchant-category-codes">merchant category codes</a> (MCCs) that the velocity limit applies to, as four-digit ISO 18245 codes.
      - `mid_list` MidCode[]: The list of merchant identification (MID) codes to allow or block transactions from. <br/> You can provide either `mcc_list` or `mid_list`, but not both.
  - object
    - `description` string: A description for the control.
    - `control_type` 'velocity_limit' | 'mcc_limit' | 'mid_limit', required: The control's type. A `velocity_limit` determines how much can be spent over a given period of time. An `mcc_limit` determines the types of businesses from which transactions can be processed. A `mid_limit` specifies the merchants from whom transactions can be processed.
    - `target_id` string, required: The ID of the card or control profile to apply the control to. Note that control profiles cannot be a target for `velocity_limit` controls.
    - `mcc_limit` MccLimit, required: The <a href= "https://www.checkout.com/docs/resources/codes/merchant-category-codes">merchant category code (MCC)</a> rule, which determines the types of businesses transactions can be processed from.
      - `type` 'allow' | 'block', required: Sets whether to allow or block the list of MCCs supplied.
      - `mcc_list` string[], required: The list of <a href= "https://www.checkout.com/docs/resources/codes/merchant-category-codes">MCCs</a> to allow or block transactions from, as 4-digit ISO 18245 codes.
  - object
    - `description` string: A description for the control.
    - `control_type` 'velocity_limit' | 'mcc_limit' | 'mid_limit', required: The control's type. A `velocity_limit` determines how much can be spent over a given period of time. An `mcc_limit` determines the types of businesses from which transactions can be processed. A `mid_limit` specifies the merchants from whom transactions can be processed.
    - `target_id` string, required: The ID of the card or control profile to apply the control to. Note that control profiles cannot be a target for `velocity_limit` controls.
    - `mid_limit` MidLimit, required: The merchant identification (MID) code rule, which determines the merchants from whom transactions can be processed.
      - `type` 'allow' | 'block', required: Sets whether to allow or block the list of MIDs supplied.
      - `mid_list` MidCode[], required: The list of merchant identification (MID) codes to allow or block transactions from.

## Response `201`

Control created successfully

- union: The control's details.
  - object
    - `id` string, required: The control's unique identifier.
    - `description` string: A description for the control.
    - `control_type` 'velocity_limit', required: The control's type. A `velocity_limit` determines how much can be spent over a given period of time. An `mcc_limit` determines the types of businesses from which transactions can be processed. A `mid_limit` specifies the merchants from whom transactions can be processed.
    - `target_id` string, required: The ID of the card or control profile.
    - `is_editable` boolean, required: Indicates whether you can change this control. <br> `false` This is an immutable control applied by Checkout.com and you cannot change it. <br> `true` You applied this control and can change it.
    - `created_date` string, date-time, required
    - `last_modified_date` string, date-time, required
    - `_links` ControlLinks, required: The links related to the control.
      - `self` IssuingLink, required
        - `href` string, required: The link URL.
        - `actions` string[], required: The HTTP Methods that can be performed on the link.
        - `types` string[], required: The Content Types for the link to the resource
    - `velocity_limit` VelocityLimit, required: The velocity limit, which determines how much a target card can spend over a given timeframe.
      - `amount_limit` integer, required: The amount the target can spend, in minor units.
      - `velocity_window` VelocityWindow, required: The period of time over which the specified `amount_limit` can be spent.
        - `type` 'daily' | 'weekly' | 'monthly' | 'all_time', required: The velocity window's unit of time.
      - `mcc_list` string[]: The list of <a href= "https://www.checkout.com/docs/resources/codes/merchant-category-codes">merchant category codes</a> (MCCs) that the velocity limit applies to, as four-digit ISO 18245 codes.
      - `mid_list` MidCode[]: The list of merchant identification (MID) codes to allow or block transactions from. <br/> You can provide either `mcc_list` or `mid_list`, but not both.
  - object
    - `id` string, required: The control's unique identifier.
    - `description` string: A description for the control.
    - `control_type` 'mcc_limit', required: The control's type. A `velocity_limit` determines how much can be spent over a given period of time. An `mcc_limit` determines the types of businesses from which transactions can be processed. A `mid_limit` specifies the merchants from whom transactions can be processed.
    - `target_id` string, required: The ID of the card or control profile.
    - `is_editable` boolean, required: Indicates whether you can change this control. <br> `false` This is an immutable control applied by Checkout.com and you cannot change it. <br> `true` You applied this control and can change it.
    - `created_date` string, date-time, required
    - `last_modified_date` string, date-time, required
    - `_links` ControlLinks, required: The links related to the control.
      - `self` IssuingLink, required
        - `href` string, required: The link URL.
        - `actions` string[], required: The HTTP Methods that can be performed on the link.
        - `types` string[], required: The Content Types for the link to the resource
    - `mcc_limit` MccLimit, required: The <a href= "https://www.checkout.com/docs/resources/codes/merchant-category-codes">merchant category code (MCC)</a> rule, which determines the types of businesses transactions can be processed from.
      - `type` 'allow' | 'block', required: Sets whether to allow or block the list of MCCs supplied.
      - `mcc_list` string[], required: The list of <a href= "https://www.checkout.com/docs/resources/codes/merchant-category-codes">MCCs</a> to allow or block transactions from, as 4-digit ISO 18245 codes.
  - object
    - `id` string, required: The control's unique identifier.
    - `description` string: A description for the control.
    - `control_type` 'mid_limit', required: The control's type. A `velocity_limit` determines how much can be spent over a given period of time. An `mcc_limit` determines the types of businesses from which transactions can be processed. A `mid_limit` specifies the merchants from whom transactions can be processed.
    - `target_id` string, required: The ID of the card or control profile.
    - `is_editable` boolean, required: Indicates whether you can change this control. <br> `false` This is an immutable control applied by Checkout.com and you cannot change it. <br> `true` You applied this control and can change it.
    - `created_date` string, date-time, required
    - `last_modified_date` string, date-time, required
    - `_links` ControlLinks, required: The links related to the control.
      - `self` IssuingLink, required
        - `href` string, required: The link URL.
        - `actions` string[], required: The HTTP Methods that can be performed on the link.
        - `types` string[], required: The Content Types for the link to the resource
    - `mid_limit` MidLimit, required: The merchant identification (MID) code rule, which determines the merchants from whom transactions can be processed.
      - `type` 'allow' | 'block', required: Sets whether to allow or block the list of MIDs supplied.
      - `mid_list` MidCode[], required: The list of merchant identification (MID) codes to allow or block transactions from.

## Other responses

- `401`: Unauthorized
- `404`: Target not found
- `422`: Invalid data was sent
- `500`: Internal Server Error
- `503`: Service Unavailable

---

[API](https://skmtc.dev/checkout/apis/checkout-com-api-reference.md) - [All operations](https://skmtc.dev/checkout/apis/checkout-com-api-reference/llms.txt) - [OpenAPI document](https://skmtc.dev/checkout/apis/checkout-com-api-reference/revisions/0f1abdb1c3e9?raw)