3DS6

Account5

Account Holder11

Auth Rules15

Auth Stream Access (ASA)2

Balance3

Blockchain Recipient2

Book Transfer6

Card21

Card Authorizations1

Card Bulk Orders4

Chargeback9

Credit Product3

Event15

External Bank Account10

External Payments7

Financial Account12

Fraud Report2

Funding Events3

Hold4

Managed Disputes2

Management Operations4

Network Program2

Payment10

Responder Endpoints4

Settlement Report4

Statements15

Status1

Tokenization13

Transaction13

Transaction Monitoring18

Transfer Limits1

Webhooks

3DS1

Auth Stream Access (ASA)1

Event Types62

Tokenization1

Auth Rules

Draft a new rule version

Changed on Oct 20, 2026

Creates a new draft version of a rule that will be ran in shadow mode.

This can also be utilized to reset the draft parameters, causing a draft version to no longer be ran in shadow mode.

post/v2/auth_rules/{auth_rule_token}/draft

Request

Base URL
https://sandbox.lithic.com
URL
https://sandbox.lithic.com/v2/auth_rules/{auth_rule_token}/draft
Auth
API key in header Authorization

Path parameters

auth_rule_tokenstring uuid required

Request body

Example request

{
  "parameters": {
    "filters": {
      "include_mccs": [
        "5542"
      ],
      "exclude_mccs": [
        "5542"
      ],
      "include_countries": [
        "USA"
      ],
      "exclude_countries": [
        "USA"
      ]
    },
    "limit_amount": 10000,
    "limit_cash_amount": 5000
  }
}

Response

Auth Rule

tokenstring uuid required

Auth Rule Token

state'ACTIVE' | 'INACTIVE' required

The state of the Auth Rule

program_levelboolean required

Deprecated: Use entities.include with a PROGRAM entity instead.

Whether the Auth Rule applies to all authorizations on the card program.

card_tokensstring[] required

Deprecated: Use entities.include with CARD entities instead.

Card tokens to which the Auth Rule applies. Cards the rule applies to through a CARD_TAG entity are not listed.

excluded_card_tokensstring[]

Deprecated: Use entities.exclude with CARD entities instead.

Card tokens to which the Auth Rule does not apply. Cards excluded through a CARD_TAG entity are not listed.

excluded_account_tokensstring[]

Deprecated: Use entities.exclude with ACCOUNT entities instead.

Account tokens to which the Auth Rule does not apply.

excluded_business_account_tokensstring[]

Deprecated: Use entities.exclude with BUSINESS_ACCOUNT entities instead.

Business account tokens to which the Auth Rule does not apply.

account_tokensstring[] required

Deprecated: Use entities.include with ACCOUNT entities instead.

Account tokens to which the Auth Rule applies.

business_account_tokensstring[] required

Deprecated: Use entities.include with BUSINESS_ACCOUNT entities instead.

Business Account tokens to which the Auth Rule applies.

type'VELOCITY_LIMIT' | 'MERCHANT_LOCK' | 'CONDITIONAL_ACTION' | 'TYPESCRIPT_CODE' | 'OTHER' required

The type of Auth Rule. For certain rule types, this determines the event stream during which it will be evaluated. For rules that can be applied to one of several event streams, the effective one is defined by the separate event_stream field.

VELOCITY_LIMIT: AUTHORIZATION event stream.
MERCHANT_LOCK: AUTHORIZATION event stream.
CONDITIONAL_ACTION: AUTHORIZATION, THREE_DS_AUTHENTICATION, TOKENIZATION, ACH_CREDIT_RECEIPT, ACH_DEBIT_RECEIPT, CARD_TRANSACTION_UPDATE, or ACH_PAYMENT_UPDATE event stream.
TYPESCRIPT_CODE: AUTHORIZATION, THREE_DS_AUTHENTICATION, TOKENIZATION, ACH_CREDIT_RECEIPT, ACH_DEBIT_RECEIPT, CARD_TRANSACTION_UPDATE, or ACH_PAYMENT_UPDATE event stream.
OTHER: A rule whose type is not exposed through this API. Rules of this type are read-only; OTHER cannot be used when creating a rule.

namestring nullable required

Auth Rule Name

The event stream during which the rule will be evaluated.

lithic_managedboolean required

Indicates whether this auth rule is managed by Lithic. If true, the rule cannot be modified or deleted by the user

Example response

{
  "current_version": {
    "parameters": {
      "filters": {
        "include_mccs": [
          "5542"
        ],
        "exclude_mccs": [
          "5542"
        ],
        "include_countries": [
          "USA"
        ],
        "exclude_countries": [
          "USA"
        ]
      },
      "limit_amount": 10000,
      "limit_cash_amount": 5000
    }
  },
  "draft_version": {
    "parameters": {
      "filters": {
        "include_mccs": [
          "5542"
        ],
        "exclude_mccs": [
          "5542"
        ],
        "include_countries": [
          "USA"
        ],
        "exclude_countries": [
          "USA"
        ]
      },
      "limit_amount": 10000,
      "limit_cash_amount": 5000
    }
  }
}

Changes

Oct 20, 20269798275dc379 Revision changes
- breaking
  removed from the / request property anyOf list
- breaking
  removed subschema #1 subschema #2 from the //// request property oneOf list
- warning
  added the new CARD_AGE enum value to the ////// response property for the response status
- warning
  added the new CARD_AGE enum value to the ////// response property for the response status
- warning
  added the new CARD_PROGRAM_FAMILY enum value to the ////// response property for the response status
- warning
  added the new CARD_PROGRAM_FAMILY enum value to the ////// response property for the response status
- warning
  added the new CARD_STATE enum value to the ////// response property for the response status
- warning
  added the new CARD_STATE enum value to the ////// response property for the response status
- warning
  added the new CARD_TYPE enum value to the ////// response property for the response status
- warning
  added the new CARD_TYPE enum value to the ////// response property for the response status
- warning
  added the new IS_DOMESTIC enum value to the ////// response property for the response status
- warning
  added the new IS_DOMESTIC enum value to the ////// response property for the response status
- warning
  added the new IS_DOMESTIC enum value to the ////// response property for the response status
- warning
  added the new IS_DOMESTIC enum value to the ////// response property for the response status
- warning
  added the new PIN_STATUS enum value to the ////// response property for the response status
- warning
  added the new PIN_STATUS enum value to the ////// response property for the response status
- info
  added subschema #1 subschema #2 to the //// request property anyOf list
- info
  added the new CARD_AGE enum value to the request property /////
- info
  added the new CARD_PROGRAM_FAMILY enum value to the request property /////
- info
  added the new CARD_STATE enum value to the request property /////
- info
  added the new CARD_TYPE enum value to the request property /////
- info
  added the new IS_DOMESTIC enum value to the request property /////
- info
  added the new IS_DOMESTIC enum value to the request property /////
- info
  added the new PIN_STATUS enum value to the request property /////
- info
  added the optional property //// to the response with the status
- info
  added the optional property //// to the response with the status
- info
  added subschema #1 subschema #2 to the ///// response property anyOf list for the response status
- info
  added subschema #1 subschema #2 to the ///// response property anyOf list for the response status
- info
  removed from the // response property anyOf list for the response status
- info
  removed from the // response property anyOf list for the response status
- info
  response property account_tokens deprecated
- info
  response property business_account_tokens deprecated
- info
  response property card_tokens deprecated
- info
  response property excluded_account_tokens deprecated
- info
  response property excluded_business_account_tokens deprecated
- info
  response property excluded_card_tokens deprecated
- info
  response property program_level deprecated
- info
  removed the CONDITIONAL_BLOCK enum value from the response property for the response status
- info
  removed subschema #1 subschema #2 from the ///// response property oneOf list for the response status
- info
  removed subschema #1 subschema #2 from the ///// response property oneOf list for the response status
- info
  added the required property to the response with the status
Sep 1, 2026b61b531b055c Revision changes
- warning
  added the new OTHER enum value to the response property for the response status

Operation history (20 revisions)