--- title: "Promote a rule version" method: POST path: "/v2/auth_rules/{auth_rule_token}/promote" tags: ["Auth Rules"] --- # Promote a rule version `POST /v2/auth_rules/{auth_rule_token}/promote` Promotes the draft version of an Auth rule to the currently active version such that it is enforced in the respective stream. ## Path parameters - `auth_rule_token` string, uuid, required ## Response `200` Auth Rule - AuthRule - `token` string, uuid, required — Auth Rule Token - `state` 'ACTIVE' | 'INACTIVE', required — The state of the Auth Rule - `program_level` boolean, required — Whether the Auth Rule applies to all authorizations on the card program. - `card_tokens` string[], required — Card tokens to which the Auth Rule applies. - `excluded_card_tokens` string[] — Card tokens to which the Auth Rule does not apply. - `excluded_account_tokens` string[] — Account tokens to which the Auth Rule does not apply. - `excluded_business_account_tokens` string[] — Business account tokens to which the Auth Rule does not apply. - `account_tokens` string[], required — Account tokens to which the Auth Rule applies. - `business_account_tokens` string[], required — Business Account tokens to which the Auth Rule applies. - `type` 'CONDITIONAL_BLOCK' | 'VELOCITY_LIMIT' | 'MERCHANT_LOCK' | 'CONDITIONAL_ACTION' | 'TYPESCRIPT_CODE', required — The type of Auth Rule. For certain rule types, this determines the event stream during which it will be evaluated. For rules that can be applied to one of several event streams, the effective one is defined by the separate `event_stream` field. - `CONDITIONAL_BLOCK`: Deprecated. Use `CONDITIONAL_ACTION` instead. AUTHORIZATION event stream. - `VELOCITY_LIMIT`: AUTHORIZATION event stream. - `MERCHANT_LOCK`: AUTHORIZATION event stream. - `CONDITIONAL_ACTION`: AUTHORIZATION, THREE_DS_AUTHENTICATION, TOKENIZATION, ACH_CREDIT_RECEIPT, or ACH_DEBIT_RECEIPT event stream. - `TYPESCRIPT_CODE`: AUTHORIZATION, THREE_DS_AUTHENTICATION, TOKENIZATION, ACH_CREDIT_RECEIPT, or ACH_DEBIT_RECEIPT event stream. - `current_version` CurrentVersion, nullable, required - `parameters` union, required — Parameters for the Auth Rule - ConditionalBlockParameters — Deprecated: Use CONDITIONAL_ACTION instead. - `conditions` object[], required - `attribute` 'MCC' | 'COUNTRY' | 'CURRENCY' | 'MERCHANT_ID' | 'DESCRIPTOR' | 'LIABILITY_SHIFT' | 'PAN_ENTRY_MODE' | 'TRANSACTION_AMOUNT' | 'RISK_SCORE' | 'CARD_TRANSACTION_COUNT_15M' | 'CARD_TRANSACTION_COUNT_1H' | 'CARD_TRANSACTION_COUNT_24H' | 'CARD_STATE' | 'PIN_ENTERED' | 'PIN_STATUS' | 'WALLET_TYPE' | 'ADDRESS_MATCH', required — The attribute to target. The following attributes may be targeted: * `MCC`: A four-digit number listed in ISO 18245. An MCC is used to classify a business by the types of goods or services it provides. * `COUNTRY`: Country of entity of card acceptor. Possible values are: (1) all ISO 3166-1 alpha-3 country codes, (2) QZZ for Kosovo, and (3) ANT for Netherlands Antilles. * `CURRENCY`: 3-character alphabetic ISO 4217 code for the merchant currency of the transaction. * `MERCHANT_ID`: Unique alphanumeric identifier for the payment card acceptor (merchant). * `DESCRIPTOR`: Short description of card acceptor. * `LIABILITY_SHIFT`: Indicates whether chargeback liability shift to the issuer applies to the transaction. Valid values are `NONE`, `3DS_AUTHENTICATED`, or `TOKEN_AUTHENTICATED`. * `PAN_ENTRY_MODE`: The method by which the cardholder's primary account number (PAN) was entered. Valid values are `AUTO_ENTRY`, `BAR_CODE`, `CONTACTLESS`, `ECOMMERCE`, `ERROR_KEYED`, `ERROR_MAGNETIC_STRIPE`, `ICC`, `KEY_ENTERED`, `MAGNETIC_STRIPE`, `MANUAL`, `OCR`, `SECURE_CARDLESS`, `UNSPECIFIED`, `UNKNOWN`, `CREDENTIAL_ON_FILE`, or `ECOMMERCE`. * `TRANSACTION_AMOUNT`: The base transaction amount (in cents) plus the acquirer fee field in the settlement/cardholder billing currency. This is the amount the issuer should authorize against unless the issuer is paying the acquirer fee on behalf of the cardholder. * `RISK_SCORE`: Network-provided score assessing risk level associated with a given authorization. Scores are on a range of 0-999, with 0 representing the lowest risk and 999 representing the highest risk. For Visa transactions, where the raw score has a range of 0-99, Lithic will normalize the score by multiplying the raw score by 10x. * `CARD_TRANSACTION_COUNT_15M`: The number of transactions on the card in the trailing 15 minutes before the authorization. * `CARD_TRANSACTION_COUNT_1H`: The number of transactions on the card in the trailing hour up and until the authorization. * `CARD_TRANSACTION_COUNT_24H`: The number of transactions on the card in the trailing 24 hours up and until the authorization. * `CARD_STATE`: The current state of the card associated with the transaction. Valid values are `CLOSED`, `OPEN`, `PAUSED`, `PENDING_ACTIVATION`, `PENDING_FULFILLMENT`. * `PIN_ENTERED`: Indicates whether a PIN was entered during the transaction. Valid values are `TRUE`, `FALSE`. * `PIN_STATUS`: The current state of card's PIN. Valid values are `NOT_SET`, `OK`, `BLOCKED`. * `WALLET_TYPE`: For transactions using a digital wallet token, indicates the source of the token. Valid values are `APPLE_PAY`, `GOOGLE_PAY`, `SAMSUNG_PAY`, `MASTERPASS`, `MERCHANT`, `OTHER`, `NONE`. * `ADDRESS_MATCH`: Lithic's evaluation result comparing transaction's address data with the cardholder KYC data if it exists. Valid values are `MATCH`, `MATCH_ADDRESS_ONLY`, `MATCH_ZIP_ONLY`,`MISMATCH`,`NOT_PRESENT`. - `operation` 'IS_ONE_OF' | 'IS_NOT_ONE_OF' | 'MATCHES' | 'DOES_NOT_MATCH' | 'IS_EQUAL_TO' | 'IS_NOT_EQUAL_TO' | 'IS_GREATER_THAN' | 'IS_GREATER_THAN_OR_EQUAL_TO' | 'IS_LESS_THAN' | 'IS_LESS_THAN_OR_EQUAL_TO' | 'IS_AFTER' | 'IS_BEFORE' | 'CONTAINS_ANY' | 'CONTAINS_ALL' | 'CONTAINS_NONE', required — The operation to apply to the attribute - `value` union, required - string — A regex string, to be used with `MATCHES` or `DOES_NOT_MATCH` - integer — A number, to be used with `IS_GREATER_THAN`, `IS_GREATER_THAN_OR_EQUAL_TO`, `IS_LESS_THAN`, `IS_LESS_THAN_OR_EQUAL_TO`, `IS_EQUAL_TO`, or `IS_NOT_EQUAL_TO` - string[] — An array of strings, to be used with `IS_ONE_OF` or `IS_NOT_ONE_OF` - string, date-time — A timestamp, to be used with `IS_AFTER` or `IS_BEFORE` - VelocityLimitParameters - `scope` 'CARD' | 'ACCOUNT', required — The scope the velocity is calculated for - `period` union, required - object - `duration` integer, required — The size of the trailing window to calculate Spend Velocity over in seconds. The minimum value is 10 seconds, and the maximum value is 2678400 seconds (31 days). - `type` 'CUSTOM', required - object — Velocity over the current day since 00:00 / 12 AM in Eastern Time - `type` 'DAY', required - object — Velocity over the current week since 00:00 / 12 AM in Eastern Time on specified `day_of_week` - `type` 'WEEK', required - `day_of_week` integer — The day of the week to start the week from. Following ISO-8601, 1 is Monday and 7 is Sunday. Defaults to Monday if not specified. - object — Velocity over the current month since 00:00 / 12 AM in Eastern Time on specified `day_of_month`. - `type` 'MONTH', required - `day_of_month` integer — The day of the month to start from. Accepts values from 1 to 31, and will reset at the end of the month if the day exceeds the number of days in the month. Defaults to the 1st of the month if not specified. - object — Velocity over the current year since 00:00 / 12 AM in Eastern Time on specified `month` and `day_of_month`. This validates the month and day of the year to start from is a real date. In the event that February 29th is selected, in non-leap years, the window will start from February 28th. - `type` 'YEAR', required - `day_of_month` integer — The day of the month to start from. Defaults to the 1st of the month if not specified. - `month` integer — The month to start from. 1 is January and 12 is December. Defaults to January if not specified. - `filters` VelocityLimitFilters - `include_mccs` string[], nullable — Merchant Category Codes to include in the velocity calculation. Transactions not matching this MCC will not be included in the calculated velocity. - `exclude_mccs` string[], nullable — Merchant Category Codes to exclude from the velocity calculation. Transactions matching this MCC will be excluded from the calculated velocity. - `include_countries` string[], nullable — ISO-3166-1 alpha-3 Country Codes to include in the velocity calculation. Transactions not matching any of the provided will not be included in the calculated velocity. - `exclude_countries` string[], nullable — ISO-3166-1 alpha-3 Country Codes to exclude from the velocity calculation. Transactions matching any of the provided will be excluded from the calculated velocity. - `include_pan_entry_modes` string[], nullable — PAN entry modes to include in the velocity calculation. Transactions not matching any of the provided will not be included in the calculated velocity. - `limit_amount` integer, nullable — The maximum amount of spend velocity allowed in the period in minor units (the smallest unit of a currency, e.g. cents for USD). Transactions exceeding this limit will be declined. - `limit_count` integer, nullable — The number of spend velocity impacting transactions may not exceed this limit in the period. Transactions exceeding this limit will be declined. A spend velocity impacting transaction is a transaction that has been authorized, and optionally settled, or a force post (a transaction that settled without prior authorization). - MerchantLockParameters - `merchants` union[], required — A list of merchant locks defining specific merchants or groups of merchants (based on descriptors or IDs) that the lock applies to. - union — Represents a specific merchant lock based on their ID or descriptor. Each merchant object allows transaction rules to work at a granular level and requires at least one of merchant_id or descriptor. - object - … - object - … - Conditional3dsActionParameters - `action` 'DECLINE' | 'CHALLENGE', required - `conditions` object[], required - `attribute` 'MCC' | 'COUNTRY' | 'CURRENCY' | 'MERCHANT_ID' | 'DESCRIPTOR' | 'TRANSACTION_AMOUNT' | 'RISK_SCORE' | 'MESSAGE_CATEGORY' | 'ADDRESS_MATCH', required — The attribute to target. The following attributes may be targeted: * `MCC`: A four-digit number listed in ISO 18245. An MCC is used to classify a business by the types of goods or services it provides. * `COUNTRY`: Country of entity of card acceptor. Possible values are: (1) all ISO 3166-1 alpha-3 country codes, (2) QZZ for Kosovo, and (3) ANT for Netherlands Antilles. * `CURRENCY`: 3-character alphabetic ISO 4217 code for the merchant currency of the transaction. * `MERCHANT_ID`: Unique alphanumeric identifier for the payment card acceptor (merchant). * `DESCRIPTOR`: Short description of card acceptor. * `TRANSACTION_AMOUNT`: The base transaction amount (in cents) plus the acquirer fee field in the settlement/cardholder billing currency. This is the amount the issuer should authorize against unless the issuer is paying the acquirer fee on behalf of the cardholder. * `RISK_SCORE`: Mastercard only: Assessment by the network of the authentication risk level, with a higher value indicating a higher amount of risk. * `MESSAGE_CATEGORY`: The category of the authentication being processed. * `ADDRESS_MATCH`: Lithic's evaluation result comparing transaction's address data with the cardholder KYC data if it exists. Valid values are `MATCH`, `MATCH_ADDRESS_ONLY`, `MATCH_ZIP_ONLY`,`MISMATCH`,`NOT_PRESENT`. - `operation` 'IS_ONE_OF' | 'IS_NOT_ONE_OF' | 'MATCHES' | 'DOES_NOT_MATCH' | 'IS_EQUAL_TO' | 'IS_NOT_EQUAL_TO' | 'IS_GREATER_THAN' | 'IS_GREATER_THAN_OR_EQUAL_TO' | 'IS_LESS_THAN' | 'IS_LESS_THAN_OR_EQUAL_TO' | 'IS_AFTER' | 'IS_BEFORE' | 'CONTAINS_ANY' | 'CONTAINS_ALL' | 'CONTAINS_NONE', required — The operation to apply to the attribute - `value` union, required - string — A regex string, to be used with `MATCHES` or `DOES_NOT_MATCH` - integer — A number, to be used with `IS_GREATER_THAN`, `IS_GREATER_THAN_OR_EQUAL_TO`, `IS_LESS_THAN`, `IS_LESS_THAN_OR_EQUAL_TO`, `IS_EQUAL_TO`, or `IS_NOT_EQUAL_TO` - string[] — An array of strings, to be used with `IS_ONE_OF` or `IS_NOT_ONE_OF` - string, date-time — A timestamp, to be used with `IS_AFTER` or `IS_BEFORE` - ConditionalAuthorizationActionParameters - `action` 'DECLINE' | 'CHALLENGE', required - `conditions` object[], required - `attribute` 'MCC' | 'COUNTRY' | 'CURRENCY' | 'MERCHANT_ID' | 'DESCRIPTOR' | 'LIABILITY_SHIFT' | 'PAN_ENTRY_MODE' | 'TRANSACTION_AMOUNT' | 'CASH_AMOUNT' | 'RISK_SCORE' | 'CARD_TRANSACTION_COUNT_15M' | 'CARD_TRANSACTION_COUNT_1H' | 'CARD_TRANSACTION_COUNT_24H' | 'CARD_DECLINE_COUNT_15M' | 'CARD_DECLINE_COUNT_1H' | 'CARD_DECLINE_COUNT_24H' | 'CARD_STATE' | 'PIN_ENTERED' | 'PIN_STATUS' | 'WALLET_TYPE' | 'TRANSACTION_INITIATOR' | 'ADDRESS_MATCH' | 'SERVICE_LOCATION_STATE' | 'SERVICE_LOCATION_POSTAL_CODE' | 'CARD_AGE' | 'ACCOUNT_AGE', required — The attribute to target. The following attributes may be targeted: * `MCC`: A four-digit number listed in ISO 18245. An MCC is used to classify a business by the types of goods or services it provides. * `COUNTRY`: Country of entity of card acceptor. Possible values are: (1) all ISO 3166-1 alpha-3 country codes, (2) QZZ for Kosovo, and (3) ANT for Netherlands Antilles. * `CURRENCY`: 3-character alphabetic ISO 4217 code for the merchant currency of the transaction. * `MERCHANT_ID`: Unique alphanumeric identifier for the payment card acceptor (merchant). * `DESCRIPTOR`: Short description of card acceptor. * `LIABILITY_SHIFT`: Indicates whether chargeback liability shift to the issuer applies to the transaction. Valid values are `NONE`, `3DS_AUTHENTICATED`, or `TOKEN_AUTHENTICATED`. * `PAN_ENTRY_MODE`: The method by which the cardholder's primary account number (PAN) was entered. Valid values are `AUTO_ENTRY`, `BAR_CODE`, `CONTACTLESS`, `ECOMMERCE`, `ERROR_KEYED`, `ERROR_MAGNETIC_STRIPE`, `ICC`, `KEY_ENTERED`, `MAGNETIC_STRIPE`, `MANUAL`, `OCR`, `SECURE_CARDLESS`, `UNSPECIFIED`, `UNKNOWN`, `CREDENTIAL_ON_FILE`, or `ECOMMERCE`. * `TRANSACTION_AMOUNT`: The base transaction amount (in cents) plus the acquirer fee field in the settlement/cardholder billing currency. This is the amount the issuer should authorize against unless the issuer is paying the acquirer fee on behalf of the cardholder. * `CASH_AMOUNT`: The cash amount of the transaction in minor units (cents). This represents the amount of cash being withdrawn or advanced. * `RISK_SCORE`: Network-provided score assessing risk level associated with a given authorization. Scores are on a range of 0-999, with 0 representing the lowest risk and 999 representing the highest risk. For Visa transactions, where the raw score has a range of 0-99, Lithic will normalize the score by multiplying the raw score by 10x. * `CARD_TRANSACTION_COUNT_15M`: The number of transactions on the card in the trailing 15 minutes before the authorization. * `CARD_TRANSACTION_COUNT_1H`: The number of transactions on the card in the trailing hour up and until the authorization. * `CARD_TRANSACTION_COUNT_24H`: The number of transactions on the card in the trailing 24 hours up and until the authorization. * `CARD_DECLINE_COUNT_15M`: The number of declined transactions on the card in the trailing 15 minutes before the authorization. * `CARD_DECLINE_COUNT_1H`: The number of declined transactions on the card in the trailing hour up and until the authorization. * `CARD_DECLINE_COUNT_24H`: The number of declined transactions on the card in the trailing 24 hours up and until the authorization. * `CARD_STATE`: The current state of the card associated with the transaction. Valid values are `CLOSED`, `OPEN`, `PAUSED`, `PENDING_ACTIVATION`, `PENDING_FULFILLMENT`. * `PIN_ENTERED`: Indicates whether a PIN was entered during the transaction. Valid values are `TRUE`, `FALSE`. * `PIN_STATUS`: The current state of card's PIN. Valid values are `NOT_SET`, `OK`, `BLOCKED`. * `WALLET_TYPE`: For transactions using a digital wallet token, indicates the source of the token. Valid values are `APPLE_PAY`, `GOOGLE_PAY`, `SAMSUNG_PAY`, `MASTERPASS`, `MERCHANT`, `OTHER`, `NONE`. * `TRANSACTION_INITIATOR`: The entity that initiated the transaction indicates the source of the token. Valid values are `CARDHOLDER`, `MERCHANT`, `UNKNOWN`. * `ADDRESS_MATCH`: Lithic's evaluation result comparing transaction's address data with the cardholder KYC data if it exists. Valid values are `MATCH`, `MATCH_ADDRESS_ONLY`, `MATCH_ZIP_ONLY`,`MISMATCH`,`NOT_PRESENT`. * `SERVICE_LOCATION_STATE`: The state/province code (ISO 3166-2) where the cardholder received the service, e.g. "NY". When a service location is present in the network data, the service location state is used. Otherwise, falls back to the card acceptor state. * `SERVICE_LOCATION_POSTAL_CODE`: The postal code where the cardholder received the service, e.g. "10001". When a service location is present in the network data, the service location postal code is used. Otherwise, falls back to the card acceptor postal code. * `CARD_AGE`: The age of the card in seconds at the time of the authorization. * `ACCOUNT_AGE`: The age of the account holder's account in seconds at the time of the authorization. - `operation` 'IS_ONE_OF' | 'IS_NOT_ONE_OF' | 'MATCHES' | 'DOES_NOT_MATCH' | 'IS_EQUAL_TO' | 'IS_NOT_EQUAL_TO' | 'IS_GREATER_THAN' | 'IS_GREATER_THAN_OR_EQUAL_TO' | 'IS_LESS_THAN' | 'IS_LESS_THAN_OR_EQUAL_TO' | 'IS_AFTER' | 'IS_BEFORE' | 'CONTAINS_ANY' | 'CONTAINS_ALL' | 'CONTAINS_NONE', required — The operation to apply to the attribute - `value` union, required - string — A regex string, to be used with `MATCHES` or `DOES_NOT_MATCH` - integer — A number, to be used with `IS_GREATER_THAN`, `IS_GREATER_THAN_OR_EQUAL_TO`, `IS_LESS_THAN`, `IS_LESS_THAN_OR_EQUAL_TO`, `IS_EQUAL_TO`, or `IS_NOT_EQUAL_TO` - string[] — An array of strings, to be used with `IS_ONE_OF` or `IS_NOT_ONE_OF` - string, date-time — A timestamp, to be used with `IS_AFTER` or `IS_BEFORE` - ConditionalAchActionParameters - `action` union, required - object - `type` 'APPROVE', required — Approve the ACH transaction - object - `type` 'RETURN', required — Return the ACH transaction - `code` 'R01' | 'R02' | 'R03' | 'R04' | 'R05' | 'R06' | 'R07' | 'R08' | 'R09' | 'R10' | 'R11' | 'R12' | 'R13' | 'R14' | 'R15' | 'R16' | 'R17' | 'R18' | 'R19' | 'R20' | 'R21' | 'R22' | 'R23' | 'R24' | 'R25' | 'R26' | 'R27' | 'R28' | 'R29' | 'R30' | 'R31' | 'R32' | 'R33' | 'R34' | 'R35' | 'R36' | 'R37' | 'R38' | 'R39' | 'R40' | 'R41' | 'R42' | 'R43' | 'R44' | 'R45' | 'R46' | 'R47' | 'R50' | 'R51' | 'R52' | 'R53' | 'R61' | 'R62' | 'R67' | 'R68' | 'R69' | 'R70' | 'R71' | 'R72' | 'R73' | 'R74' | 'R75' | 'R76' | 'R77' | 'R80' | 'R81' | 'R82' | 'R83' | 'R84' | 'R85', required — NACHA return code to use when returning the transaction. Note that the list of available return codes is subject to an allowlist configured at the program level - `conditions` object[], required - `attribute` 'COMPANY_NAME' | 'COMPANY_ID' | 'TIMESTAMP' | 'TRANSACTION_AMOUNT' | 'SEC_CODE' | 'MEMO', required — The attribute to target. The following attributes may be targeted: * `COMPANY_NAME`: The name of the company initiating the ACH transaction. * `COMPANY_ID`: The company ID (also known as Standard Entry Class (SEC) Company ID) of the entity initiating the ACH transaction. * `TIMESTAMP`: The timestamp of the ACH transaction in ISO 8601 format. * `TRANSACTION_AMOUNT`: The amount of the ACH transaction in minor units (cents). * `SEC_CODE`: Standard Entry Class code indicating the type of ACH transaction. Valid values include PPD (Prearranged Payment and Deposit Entry), CCD (Corporate Credit or Debit Entry), WEB (Internet-Initiated/Mobile Entry), TEL (Telephone-Initiated Entry), and others. * `MEMO`: Optional memo or description field included with the ACH transaction. - `operation` 'IS_ONE_OF' | 'IS_NOT_ONE_OF' | 'MATCHES' | 'DOES_NOT_MATCH' | 'IS_EQUAL_TO' | 'IS_NOT_EQUAL_TO' | 'IS_GREATER_THAN' | 'IS_GREATER_THAN_OR_EQUAL_TO' | 'IS_LESS_THAN' | 'IS_LESS_THAN_OR_EQUAL_TO' | 'IS_AFTER' | 'IS_BEFORE' | 'CONTAINS_ANY' | 'CONTAINS_ALL' | 'CONTAINS_NONE', required — The operation to apply to the attribute - `value` union, required - string — A regex string, to be used with `MATCHES` or `DOES_NOT_MATCH` - integer — A number, to be used with `IS_GREATER_THAN`, `IS_GREATER_THAN_OR_EQUAL_TO`, `IS_LESS_THAN`, `IS_LESS_THAN_OR_EQUAL_TO`, `IS_EQUAL_TO`, or `IS_NOT_EQUAL_TO` - string[] — An array of strings, to be used with `IS_ONE_OF` or `IS_NOT_ONE_OF` - string, date-time — A timestamp, to be used with `IS_AFTER` or `IS_BEFORE` - ConditionalTokenizationActionParameters - `action` union, required - object - `type` 'DECLINE', required — Decline the tokenization request - `reason` 'ACCOUNT_SCORE_1' | 'DEVICE_SCORE_1' | 'ALL_WALLET_DECLINE_REASONS_PRESENT' | 'WALLET_RECOMMENDED_DECISION_RED' | 'CVC_MISMATCH' | 'CARD_EXPIRY_MONTH_MISMATCH' | 'CARD_EXPIRY_YEAR_MISMATCH' | 'CARD_INVALID_STATE' | 'CUSTOMER_RED_PATH' | 'INVALID_CUSTOMER_RESPONSE' | 'NETWORK_FAILURE' | 'GENERIC_DECLINE' | 'DIGITAL_CARD_ART_REQUIRED' — Reason code for declining the tokenization request - object - `type` 'REQUIRE_TFA', required — Require two-factor authentication for the tokenization request - `reason` 'WALLET_RECOMMENDED_TFA' | 'SUSPICIOUS_ACTIVITY' | 'DEVICE_RECENTLY_LOST' | 'TOO_MANY_RECENT_ATTEMPTS' | 'TOO_MANY_RECENT_TOKENS' | 'TOO_MANY_DIFFERENT_CARDHOLDERS' | 'OUTSIDE_HOME_TERRITORY' | 'HAS_SUSPENDED_TOKENS' | 'HIGH_RISK' | 'ACCOUNT_SCORE_LOW' | 'DEVICE_SCORE_LOW' | 'CARD_STATE_TFA' | 'HARDCODED_TFA' | 'CUSTOMER_RULE_TFA' | 'DEVICE_HOST_CARD_EMULATION' — Reason code for requiring two-factor authentication - `conditions` object[], required - `attribute` 'TIMESTAMP' | 'TOKENIZATION_CHANNEL' | 'TOKENIZATION_SOURCE' | 'TOKEN_REQUESTOR_NAME' | 'WALLET_ACCOUNT_SCORE' | 'WALLET_DEVICE_SCORE' | 'WALLET_RECOMMENDED_DECISION' | 'WALLET_RECOMMENDATION_REASONS' | 'TOKEN_REQUESTOR_ID' | 'WALLET_TOKEN_STATUS' | 'CARD_STATE', required — The attribute to target. The following attributes may be targeted: * `TIMESTAMP`: The timestamp of the tokenization request in ISO 8601 format. * `TOKENIZATION_CHANNEL`: The channel through which the tokenization request was initiated. Valid values are `DIGITAL_WALLET`, `MERCHANT`. * `TOKENIZATION_SOURCE`: The source of the tokenization request. Valid values are `ACCOUNT_ON_FILE`, `MANUAL_PROVISION`, `PUSH_PROVISION`, `CHIP_DIP`, `CONTACTLESS_TAP`, `TOKEN`, `UNKNOWN`. * `TOKEN_REQUESTOR_NAME`: The name of the entity requesting the token. Valid values are `ALT_ID`, `AMAZON_ONE`, `AMERICAN_EXPRESS_TOKEN_SERVICE`, `ANDROID_PAY`, `APPLE_PAY`, `FACEBOOK`, `FITBIT_PAY`, `GARMIN_PAY`, `GOOGLE_PAY`, `GOOGLE_VCN`, `ISSUER_HCE`, `MICROSOFT_PAY`, `NETFLIX`, `SAMSUNG_PAY`, `UNKNOWN`, `VISA_CHECKOUT`. * `WALLET_ACCOUNT_SCORE`: Risk score for the account in the digital wallet. Numeric value where lower numbers indicate higher risk (e.g., 1 = high risk, 2 = medium risk). * `WALLET_DEVICE_SCORE`: Risk score for the device in the digital wallet. Numeric value where lower numbers indicate higher risk (e.g., 1 = high risk, 2 = medium risk). * `WALLET_RECOMMENDED_DECISION`: The decision recommended by the digital wallet provider. Valid values include APPROVE, DECLINE, REQUIRE_ADDITIONAL_AUTHENTICATION. * `WALLET_RECOMMENDATION_REASONS`: List of reasons provided by the digital wallet provider for the recommended decision. Valid values are: - Common: `ACCOUNT_CARD_TOO_NEW`, `ACCOUNT_RECENTLY_CHANGED`, `ACCOUNT_TOO_NEW`, `ACCOUNT_TOO_NEW_SINCE_LAUNCH`, `DEVICE_RECENTLY_LOST`, `HAS_SUSPENDED_TOKENS`, `HIGH_RISK`, `INACTIVE_ACCOUNT`, `LOW_ACCOUNT_SCORE`, `LOW_DEVICE_SCORE`, `OUTSIDE_HOME_TERRITORY`, `SUSPICIOUS_ACTIVITY`, `TOO_MANY_DIFFERENT_CARDHOLDERS`, `TOO_MANY_RECENT_ATTEMPTS`, `TOO_MANY_RECENT_TOKENS`, `UNABLE_TO_ASSESS` - Visa only: `ACCOUNT_DATA_RECENTLY_CHANGED`, `ACCOUNT_PAN_PAIRING_TOO_NEW`, `LOW_TRANSACTION_VOLUME`, `USER_ACCOUNT_DEVICE_TOO_NEW`, `WALLET_ACCOUNT_TOO_NEW` - Amex only: `DEVICE_USING_VPN_PROXY`, `EXCESSIVE_BILLING_NAME_ATTEMPTS_MODERATE`, `EXCESSIVE_BILLING_NAME_ATTEMPTS_SEVERE`, `EXCESSIVE_CARD_PROVISION_ATTEMPTS_MODERATE`, `EXCESSIVE_CARD_PROVISION_ATTEMPTS_SEVERE`, `EXCESSIVE_WALLET_RESETS`, `EXCESSIVE_ZIP_ATTEMPTS_MODERATE`, `EXCESSIVE_ZIP_ATTEMPTS_SEVERE`, `USER_ID_CARD_PAIRING_TOO_NEW`, `USER_ID_DEVICE_ID_PAIRING_TOO_NEW`, `USER_ID_OS_ID_PAIRING_TOO_NEW`, `USER_ID_TOO_NEW` * `TOKEN_REQUESTOR_ID`: Unique identifier for the entity requesting the token. * `WALLET_TOKEN_STATUS`: The current status of the wallet token. * `CARD_STATE`: The state of the card being tokenized. Valid values are `CLOSED`, `OPEN`, `PAUSED`, `PENDING_ACTIVATION`, `PENDING_FULFILLMENT`. - `operation` 'IS_ONE_OF' | 'IS_NOT_ONE_OF' | 'MATCHES' | 'DOES_NOT_MATCH' | 'IS_EQUAL_TO' | 'IS_NOT_EQUAL_TO' | 'IS_GREATER_THAN' | 'IS_GREATER_THAN_OR_EQUAL_TO' | 'IS_LESS_THAN' | 'IS_LESS_THAN_OR_EQUAL_TO' | 'IS_AFTER' | 'IS_BEFORE' | 'CONTAINS_ANY' | 'CONTAINS_ALL' | 'CONTAINS_NONE', required — The operation to apply to the attribute - `value` union, required - string — A regex string, to be used with `MATCHES` or `DOES_NOT_MATCH` - integer — A number, to be used with `IS_GREATER_THAN`, `IS_GREATER_THAN_OR_EQUAL_TO`, `IS_LESS_THAN`, `IS_LESS_THAN_OR_EQUAL_TO`, `IS_EQUAL_TO`, or `IS_NOT_EQUAL_TO` - string[] — An array of strings, to be used with `IS_ONE_OF` or `IS_NOT_ONE_OF` - string, date-time — A timestamp, to be used with `IS_AFTER` or `IS_BEFORE` - TypescriptCodeParameters — Parameters for defining a TypeScript code rule - `features` RuleFeature[], required — Features available to the TypeScript code at evaluation time - union - object — A feature made available to the rule. The `name` field is the variable name used in the rule function signature. The `type` field determines which data the feature provides to the rule at evaluation time. - `AUTHORIZATION`: The authorization request being evaluated. Only available for AUTHORIZATION event stream rules. - `AUTHENTICATION`: The 3DS authentication request being evaluated. Only available for THREE_DS_AUTHENTICATION event stream rules. - `TOKENIZATION`: The tokenization request being evaluated. Only available for TOKENIZATION event stream rules. - `ACH_RECEIPT`: The ACH receipt being evaluated. Only available for ACH_CREDIT_RECEIPT and ACH_DEBIT_RECEIPT event stream rules. - `CARD`: The card associated with the event. Available for AUTHORIZATION and THREE_DS_AUTHENTICATION event stream rules. - `ACCOUNT_HOLDER`: The account holder associated with the card. Available for AUTHORIZATION and THREE_DS_AUTHENTICATION event stream rules. - `IP_METADATA`: IP address metadata for the request. Available for THREE_DS_AUTHENTICATION event stream rules. - `SPEND_VELOCITY`: Spend velocity data for the card or account. Requires `scope`, `period`, and optionally `filters` to configure the velocity calculation. Available for AUTHORIZATION event stream rules. - … - object — A feature made available to the rule. The `name` field is the variable name used in the rule function signature. The `type` field determines which data the feature provides to the rule at evaluation time. - `AUTHORIZATION`: The authorization request being evaluated. Only available for AUTHORIZATION event stream rules. - `AUTHENTICATION`: The 3DS authentication request being evaluated. Only available for THREE_DS_AUTHENTICATION event stream rules. - `TOKENIZATION`: The tokenization request being evaluated. Only available for TOKENIZATION event stream rules. - `ACH_RECEIPT`: The ACH receipt being evaluated. Only available for ACH_CREDIT_RECEIPT and ACH_DEBIT_RECEIPT event stream rules. - `CARD`: The card associated with the event. Available for AUTHORIZATION and THREE_DS_AUTHENTICATION event stream rules. - `ACCOUNT_HOLDER`: The account holder associated with the card. Available for AUTHORIZATION and THREE_DS_AUTHENTICATION event stream rules. - `IP_METADATA`: IP address metadata for the request. Available for THREE_DS_AUTHENTICATION event stream rules. - `SPEND_VELOCITY`: Spend velocity data for the card or account. Requires `scope`, `period`, and optionally `filters` to configure the velocity calculation. Available for AUTHORIZATION event stream rules. - … - object — A feature made available to the rule. The `name` field is the variable name used in the rule function signature. The `type` field determines which data the feature provides to the rule at evaluation time. - `AUTHORIZATION`: The authorization request being evaluated. Only available for AUTHORIZATION event stream rules. - `AUTHENTICATION`: The 3DS authentication request being evaluated. Only available for THREE_DS_AUTHENTICATION event stream rules. - `TOKENIZATION`: The tokenization request being evaluated. Only available for TOKENIZATION event stream rules. - `ACH_RECEIPT`: The ACH receipt being evaluated. Only available for ACH_CREDIT_RECEIPT and ACH_DEBIT_RECEIPT event stream rules. - `CARD`: The card associated with the event. Available for AUTHORIZATION and THREE_DS_AUTHENTICATION event stream rules. - `ACCOUNT_HOLDER`: The account holder associated with the card. Available for AUTHORIZATION and THREE_DS_AUTHENTICATION event stream rules. - `IP_METADATA`: IP address metadata for the request. Available for THREE_DS_AUTHENTICATION event stream rules. - `SPEND_VELOCITY`: Spend velocity data for the card or account. Requires `scope`, `period`, and optionally `filters` to configure the velocity calculation. Available for AUTHORIZATION event stream rules. - … - object — A feature made available to the rule. The `name` field is the variable name used in the rule function signature. The `type` field determines which data the feature provides to the rule at evaluation time. - `AUTHORIZATION`: The authorization request being evaluated. Only available for AUTHORIZATION event stream rules. - `AUTHENTICATION`: The 3DS authentication request being evaluated. Only available for THREE_DS_AUTHENTICATION event stream rules. - `TOKENIZATION`: The tokenization request being evaluated. Only available for TOKENIZATION event stream rules. - `ACH_RECEIPT`: The ACH receipt being evaluated. Only available for ACH_CREDIT_RECEIPT and ACH_DEBIT_RECEIPT event stream rules. - `CARD`: The card associated with the event. Available for AUTHORIZATION and THREE_DS_AUTHENTICATION event stream rules. - `ACCOUNT_HOLDER`: The account holder associated with the card. Available for AUTHORIZATION and THREE_DS_AUTHENTICATION event stream rules. - `IP_METADATA`: IP address metadata for the request. Available for THREE_DS_AUTHENTICATION event stream rules. - `SPEND_VELOCITY`: Spend velocity data for the card or account. Requires `scope`, `period`, and optionally `filters` to configure the velocity calculation. Available for AUTHORIZATION event stream rules. - … - object — A feature made available to the rule. The `name` field is the variable name used in the rule function signature. The `type` field determines which data the feature provides to the rule at evaluation time. - `AUTHORIZATION`: The authorization request being evaluated. Only available for AUTHORIZATION event stream rules. - `AUTHENTICATION`: The 3DS authentication request being evaluated. Only available for THREE_DS_AUTHENTICATION event stream rules. - `TOKENIZATION`: The tokenization request being evaluated. Only available for TOKENIZATION event stream rules. - `ACH_RECEIPT`: The ACH receipt being evaluated. Only available for ACH_CREDIT_RECEIPT and ACH_DEBIT_RECEIPT event stream rules. - `CARD`: The card associated with the event. Available for AUTHORIZATION and THREE_DS_AUTHENTICATION event stream rules. - `ACCOUNT_HOLDER`: The account holder associated with the card. Available for AUTHORIZATION and THREE_DS_AUTHENTICATION event stream rules. - `IP_METADATA`: IP address metadata for the request. Available for THREE_DS_AUTHENTICATION event stream rules. - `SPEND_VELOCITY`: Spend velocity data for the card or account. Requires `scope`, `period`, and optionally `filters` to configure the velocity calculation. Available for AUTHORIZATION event stream rules. - … - object — A feature made available to the rule. The `name` field is the variable name used in the rule function signature. The `type` field determines which data the feature provides to the rule at evaluation time. - `AUTHORIZATION`: The authorization request being evaluated. Only available for AUTHORIZATION event stream rules. - `AUTHENTICATION`: The 3DS authentication request being evaluated. Only available for THREE_DS_AUTHENTICATION event stream rules. - `TOKENIZATION`: The tokenization request being evaluated. Only available for TOKENIZATION event stream rules. - `ACH_RECEIPT`: The ACH receipt being evaluated. Only available for ACH_CREDIT_RECEIPT and ACH_DEBIT_RECEIPT event stream rules. - `CARD`: The card associated with the event. Available for AUTHORIZATION and THREE_DS_AUTHENTICATION event stream rules. - `ACCOUNT_HOLDER`: The account holder associated with the card. Available for AUTHORIZATION and THREE_DS_AUTHENTICATION event stream rules. - `IP_METADATA`: IP address metadata for the request. Available for THREE_DS_AUTHENTICATION event stream rules. - `SPEND_VELOCITY`: Spend velocity data for the card or account. Requires `scope`, `period`, and optionally `filters` to configure the velocity calculation. Available for AUTHORIZATION event stream rules. - … - object — A feature made available to the rule. The `name` field is the variable name used in the rule function signature. The `type` field determines which data the feature provides to the rule at evaluation time. - `AUTHORIZATION`: The authorization request being evaluated. Only available for AUTHORIZATION event stream rules. - `AUTHENTICATION`: The 3DS authentication request being evaluated. Only available for THREE_DS_AUTHENTICATION event stream rules. - `TOKENIZATION`: The tokenization request being evaluated. Only available for TOKENIZATION event stream rules. - `ACH_RECEIPT`: The ACH receipt being evaluated. Only available for ACH_CREDIT_RECEIPT and ACH_DEBIT_RECEIPT event stream rules. - `CARD`: The card associated with the event. Available for AUTHORIZATION and THREE_DS_AUTHENTICATION event stream rules. - `ACCOUNT_HOLDER`: The account holder associated with the card. Available for AUTHORIZATION and THREE_DS_AUTHENTICATION event stream rules. - `IP_METADATA`: IP address metadata for the request. Available for THREE_DS_AUTHENTICATION event stream rules. - `SPEND_VELOCITY`: Spend velocity data for the card or account. Requires `scope`, `period`, and optionally `filters` to configure the velocity calculation. Available for AUTHORIZATION event stream rules. - … - object — A feature made available to the rule. The `name` field is the variable name used in the rule function signature. The `type` field determines which data the feature provides to the rule at evaluation time. - `AUTHORIZATION`: The authorization request being evaluated. Only available for AUTHORIZATION event stream rules. - `AUTHENTICATION`: The 3DS authentication request being evaluated. Only available for THREE_DS_AUTHENTICATION event stream rules. - `TOKENIZATION`: The tokenization request being evaluated. Only available for TOKENIZATION event stream rules. - `ACH_RECEIPT`: The ACH receipt being evaluated. Only available for ACH_CREDIT_RECEIPT and ACH_DEBIT_RECEIPT event stream rules. - `CARD`: The card associated with the event. Available for AUTHORIZATION and THREE_DS_AUTHENTICATION event stream rules. - `ACCOUNT_HOLDER`: The account holder associated with the card. Available for AUTHORIZATION and THREE_DS_AUTHENTICATION event stream rules. - `IP_METADATA`: IP address metadata for the request. Available for THREE_DS_AUTHENTICATION event stream rules. - `SPEND_VELOCITY`: Spend velocity data for the card or account. Requires `scope`, `period`, and optionally `filters` to configure the velocity calculation. Available for AUTHORIZATION event stream rules. - … - `code` string, required — The TypeScript source code of the rule. Must define a `rule()` function that accepts the declared features as positional arguments (in the same order as the `features` array) and returns an array of actions. - `version` integer, required — The version of the rule, this is incremented whenever the rule's parameters change. - `draft_version` DraftVersion, nullable, required - `parameters` union, required — Parameters for the Auth Rule - ConditionalBlockParameters — Deprecated: Use CONDITIONAL_ACTION instead. - `conditions` object[], required - `attribute` 'MCC' | 'COUNTRY' | 'CURRENCY' | 'MERCHANT_ID' | 'DESCRIPTOR' | 'LIABILITY_SHIFT' | 'PAN_ENTRY_MODE' | 'TRANSACTION_AMOUNT' | 'RISK_SCORE' | 'CARD_TRANSACTION_COUNT_15M' | 'CARD_TRANSACTION_COUNT_1H' | 'CARD_TRANSACTION_COUNT_24H' | 'CARD_STATE' | 'PIN_ENTERED' | 'PIN_STATUS' | 'WALLET_TYPE' | 'ADDRESS_MATCH', required — The attribute to target. The following attributes may be targeted: * `MCC`: A four-digit number listed in ISO 18245. An MCC is used to classify a business by the types of goods or services it provides. * `COUNTRY`: Country of entity of card acceptor. Possible values are: (1) all ISO 3166-1 alpha-3 country codes, (2) QZZ for Kosovo, and (3) ANT for Netherlands Antilles. * `CURRENCY`: 3-character alphabetic ISO 4217 code for the merchant currency of the transaction. * `MERCHANT_ID`: Unique alphanumeric identifier for the payment card acceptor (merchant). * `DESCRIPTOR`: Short description of card acceptor. * `LIABILITY_SHIFT`: Indicates whether chargeback liability shift to the issuer applies to the transaction. Valid values are `NONE`, `3DS_AUTHENTICATED`, or `TOKEN_AUTHENTICATED`. * `PAN_ENTRY_MODE`: The method by which the cardholder's primary account number (PAN) was entered. Valid values are `AUTO_ENTRY`, `BAR_CODE`, `CONTACTLESS`, `ECOMMERCE`, `ERROR_KEYED`, `ERROR_MAGNETIC_STRIPE`, `ICC`, `KEY_ENTERED`, `MAGNETIC_STRIPE`, `MANUAL`, `OCR`, `SECURE_CARDLESS`, `UNSPECIFIED`, `UNKNOWN`, `CREDENTIAL_ON_FILE`, or `ECOMMERCE`. * `TRANSACTION_AMOUNT`: The base transaction amount (in cents) plus the acquirer fee field in the settlement/cardholder billing currency. This is the amount the issuer should authorize against unless the issuer is paying the acquirer fee on behalf of the cardholder. * `RISK_SCORE`: Network-provided score assessing risk level associated with a given authorization. Scores are on a range of 0-999, with 0 representing the lowest risk and 999 representing the highest risk. For Visa transactions, where the raw score has a range of 0-99, Lithic will normalize the score by multiplying the raw score by 10x. * `CARD_TRANSACTION_COUNT_15M`: The number of transactions on the card in the trailing 15 minutes before the authorization. * `CARD_TRANSACTION_COUNT_1H`: The number of transactions on the card in the trailing hour up and until the authorization. * `CARD_TRANSACTION_COUNT_24H`: The number of transactions on the card in the trailing 24 hours up and until the authorization. * `CARD_STATE`: The current state of the card associated with the transaction. Valid values are `CLOSED`, `OPEN`, `PAUSED`, `PENDING_ACTIVATION`, `PENDING_FULFILLMENT`. * `PIN_ENTERED`: Indicates whether a PIN was entered during the transaction. Valid values are `TRUE`, `FALSE`. * `PIN_STATUS`: The current state of card's PIN. Valid values are `NOT_SET`, `OK`, `BLOCKED`. * `WALLET_TYPE`: For transactions using a digital wallet token, indicates the source of the token. Valid values are `APPLE_PAY`, `GOOGLE_PAY`, `SAMSUNG_PAY`, `MASTERPASS`, `MERCHANT`, `OTHER`, `NONE`. * `ADDRESS_MATCH`: Lithic's evaluation result comparing transaction's address data with the cardholder KYC data if it exists. Valid values are `MATCH`, `MATCH_ADDRESS_ONLY`, `MATCH_ZIP_ONLY`,`MISMATCH`,`NOT_PRESENT`. - `operation` 'IS_ONE_OF' | 'IS_NOT_ONE_OF' | 'MATCHES' | 'DOES_NOT_MATCH' | 'IS_EQUAL_TO' | 'IS_NOT_EQUAL_TO' | 'IS_GREATER_THAN' | 'IS_GREATER_THAN_OR_EQUAL_TO' | 'IS_LESS_THAN' | 'IS_LESS_THAN_OR_EQUAL_TO' | 'IS_AFTER' | 'IS_BEFORE' | 'CONTAINS_ANY' | 'CONTAINS_ALL' | 'CONTAINS_NONE', required — The operation to apply to the attribute - `value` union, required - string — A regex string, to be used with `MATCHES` or `DOES_NOT_MATCH` - integer — A number, to be used with `IS_GREATER_THAN`, `IS_GREATER_THAN_OR_EQUAL_TO`, `IS_LESS_THAN`, `IS_LESS_THAN_OR_EQUAL_TO`, `IS_EQUAL_TO`, or `IS_NOT_EQUAL_TO` - string[] — An array of strings, to be used with `IS_ONE_OF` or `IS_NOT_ONE_OF` - string, date-time — A timestamp, to be used with `IS_AFTER` or `IS_BEFORE` - VelocityLimitParameters - `scope` 'CARD' | 'ACCOUNT', required — The scope the velocity is calculated for - `period` union, required - object - `duration` integer, required — The size of the trailing window to calculate Spend Velocity over in seconds. The minimum value is 10 seconds, and the maximum value is 2678400 seconds (31 days). - `type` 'CUSTOM', required - object — Velocity over the current day since 00:00 / 12 AM in Eastern Time - `type` 'DAY', required - object — Velocity over the current week since 00:00 / 12 AM in Eastern Time on specified `day_of_week` - `type` 'WEEK', required - `day_of_week` integer — The day of the week to start the week from. Following ISO-8601, 1 is Monday and 7 is Sunday. Defaults to Monday if not specified. - object — Velocity over the current month since 00:00 / 12 AM in Eastern Time on specified `day_of_month`. - `type` 'MONTH', required - `day_of_month` integer — The day of the month to start from. Accepts values from 1 to 31, and will reset at the end of the month if the day exceeds the number of days in the month. Defaults to the 1st of the month if not specified. - object — Velocity over the current year since 00:00 / 12 AM in Eastern Time on specified `month` and `day_of_month`. This validates the month and day of the year to start from is a real date. In the event that February 29th is selected, in non-leap years, the window will start from February 28th. - `type` 'YEAR', required - `day_of_month` integer — The day of the month to start from. Defaults to the 1st of the month if not specified. - `month` integer — The month to start from. 1 is January and 12 is December. Defaults to January if not specified. - `filters` VelocityLimitFilters - `include_mccs` string[], nullable — Merchant Category Codes to include in the velocity calculation. Transactions not matching this MCC will not be included in the calculated velocity. - `exclude_mccs` string[], nullable — Merchant Category Codes to exclude from the velocity calculation. Transactions matching this MCC will be excluded from the calculated velocity. - `include_countries` string[], nullable — ISO-3166-1 alpha-3 Country Codes to include in the velocity calculation. Transactions not matching any of the provided will not be included in the calculated velocity. - `exclude_countries` string[], nullable — ISO-3166-1 alpha-3 Country Codes to exclude from the velocity calculation. Transactions matching any of the provided will be excluded from the calculated velocity. - `include_pan_entry_modes` string[], nullable — PAN entry modes to include in the velocity calculation. Transactions not matching any of the provided will not be included in the calculated velocity. - `limit_amount` integer, nullable — The maximum amount of spend velocity allowed in the period in minor units (the smallest unit of a currency, e.g. cents for USD). Transactions exceeding this limit will be declined. - `limit_count` integer, nullable — The number of spend velocity impacting transactions may not exceed this limit in the period. Transactions exceeding this limit will be declined. A spend velocity impacting transaction is a transaction that has been authorized, and optionally settled, or a force post (a transaction that settled without prior authorization). - MerchantLockParameters - `merchants` union[], required — A list of merchant locks defining specific merchants or groups of merchants (based on descriptors or IDs) that the lock applies to. - union — Represents a specific merchant lock based on their ID or descriptor. Each merchant object allows transaction rules to work at a granular level and requires at least one of merchant_id or descriptor. - object - … - object - … - Conditional3dsActionParameters - `action` 'DECLINE' | 'CHALLENGE', required - `conditions` object[], required - `attribute` 'MCC' | 'COUNTRY' | 'CURRENCY' | 'MERCHANT_ID' | 'DESCRIPTOR' | 'TRANSACTION_AMOUNT' | 'RISK_SCORE' | 'MESSAGE_CATEGORY' | 'ADDRESS_MATCH', required — The attribute to target. The following attributes may be targeted: * `MCC`: A four-digit number listed in ISO 18245. An MCC is used to classify a business by the types of goods or services it provides. * `COUNTRY`: Country of entity of card acceptor. Possible values are: (1) all ISO 3166-1 alpha-3 country codes, (2) QZZ for Kosovo, and (3) ANT for Netherlands Antilles. * `CURRENCY`: 3-character alphabetic ISO 4217 code for the merchant currency of the transaction. * `MERCHANT_ID`: Unique alphanumeric identifier for the payment card acceptor (merchant). * `DESCRIPTOR`: Short description of card acceptor. * `TRANSACTION_AMOUNT`: The base transaction amount (in cents) plus the acquirer fee field in the settlement/cardholder billing currency. This is the amount the issuer should authorize against unless the issuer is paying the acquirer fee on behalf of the cardholder. * `RISK_SCORE`: Mastercard only: Assessment by the network of the authentication risk level, with a higher value indicating a higher amount of risk. * `MESSAGE_CATEGORY`: The category of the authentication being processed. * `ADDRESS_MATCH`: Lithic's evaluation result comparing transaction's address data with the cardholder KYC data if it exists. Valid values are `MATCH`, `MATCH_ADDRESS_ONLY`, `MATCH_ZIP_ONLY`,`MISMATCH`,`NOT_PRESENT`. - `operation` 'IS_ONE_OF' | 'IS_NOT_ONE_OF' | 'MATCHES' | 'DOES_NOT_MATCH' | 'IS_EQUAL_TO' | 'IS_NOT_EQUAL_TO' | 'IS_GREATER_THAN' | 'IS_GREATER_THAN_OR_EQUAL_TO' | 'IS_LESS_THAN' | 'IS_LESS_THAN_OR_EQUAL_TO' | 'IS_AFTER' | 'IS_BEFORE' | 'CONTAINS_ANY' | 'CONTAINS_ALL' | 'CONTAINS_NONE', required — The operation to apply to the attribute - `value` union, required - string — A regex string, to be used with `MATCHES` or `DOES_NOT_MATCH` - integer — A number, to be used with `IS_GREATER_THAN`, `IS_GREATER_THAN_OR_EQUAL_TO`, `IS_LESS_THAN`, `IS_LESS_THAN_OR_EQUAL_TO`, `IS_EQUAL_TO`, or `IS_NOT_EQUAL_TO` - string[] — An array of strings, to be used with `IS_ONE_OF` or `IS_NOT_ONE_OF` - string, date-time — A timestamp, to be used with `IS_AFTER` or `IS_BEFORE` - ConditionalAuthorizationActionParameters - `action` 'DECLINE' | 'CHALLENGE', required - `conditions` object[], required - `attribute` 'MCC' | 'COUNTRY' | 'CURRENCY' | 'MERCHANT_ID' | 'DESCRIPTOR' | 'LIABILITY_SHIFT' | 'PAN_ENTRY_MODE' | 'TRANSACTION_AMOUNT' | 'CASH_AMOUNT' | 'RISK_SCORE' | 'CARD_TRANSACTION_COUNT_15M' | 'CARD_TRANSACTION_COUNT_1H' | 'CARD_TRANSACTION_COUNT_24H' | 'CARD_DECLINE_COUNT_15M' | 'CARD_DECLINE_COUNT_1H' | 'CARD_DECLINE_COUNT_24H' | 'CARD_STATE' | 'PIN_ENTERED' | 'PIN_STATUS' | 'WALLET_TYPE' | 'TRANSACTION_INITIATOR' | 'ADDRESS_MATCH' | 'SERVICE_LOCATION_STATE' | 'SERVICE_LOCATION_POSTAL_CODE' | 'CARD_AGE' | 'ACCOUNT_AGE', required — The attribute to target. The following attributes may be targeted: * `MCC`: A four-digit number listed in ISO 18245. An MCC is used to classify a business by the types of goods or services it provides. * `COUNTRY`: Country of entity of card acceptor. Possible values are: (1) all ISO 3166-1 alpha-3 country codes, (2) QZZ for Kosovo, and (3) ANT for Netherlands Antilles. * `CURRENCY`: 3-character alphabetic ISO 4217 code for the merchant currency of the transaction. * `MERCHANT_ID`: Unique alphanumeric identifier for the payment card acceptor (merchant). * `DESCRIPTOR`: Short description of card acceptor. * `LIABILITY_SHIFT`: Indicates whether chargeback liability shift to the issuer applies to the transaction. Valid values are `NONE`, `3DS_AUTHENTICATED`, or `TOKEN_AUTHENTICATED`. * `PAN_ENTRY_MODE`: The method by which the cardholder's primary account number (PAN) was entered. Valid values are `AUTO_ENTRY`, `BAR_CODE`, `CONTACTLESS`, `ECOMMERCE`, `ERROR_KEYED`, `ERROR_MAGNETIC_STRIPE`, `ICC`, `KEY_ENTERED`, `MAGNETIC_STRIPE`, `MANUAL`, `OCR`, `SECURE_CARDLESS`, `UNSPECIFIED`, `UNKNOWN`, `CREDENTIAL_ON_FILE`, or `ECOMMERCE`. * `TRANSACTION_AMOUNT`: The base transaction amount (in cents) plus the acquirer fee field in the settlement/cardholder billing currency. This is the amount the issuer should authorize against unless the issuer is paying the acquirer fee on behalf of the cardholder. * `CASH_AMOUNT`: The cash amount of the transaction in minor units (cents). This represents the amount of cash being withdrawn or advanced. * `RISK_SCORE`: Network-provided score assessing risk level associated with a given authorization. Scores are on a range of 0-999, with 0 representing the lowest risk and 999 representing the highest risk. For Visa transactions, where the raw score has a range of 0-99, Lithic will normalize the score by multiplying the raw score by 10x. * `CARD_TRANSACTION_COUNT_15M`: The number of transactions on the card in the trailing 15 minutes before the authorization. * `CARD_TRANSACTION_COUNT_1H`: The number of transactions on the card in the trailing hour up and until the authorization. * `CARD_TRANSACTION_COUNT_24H`: The number of transactions on the card in the trailing 24 hours up and until the authorization. * `CARD_DECLINE_COUNT_15M`: The number of declined transactions on the card in the trailing 15 minutes before the authorization. * `CARD_DECLINE_COUNT_1H`: The number of declined transactions on the card in the trailing hour up and until the authorization. * `CARD_DECLINE_COUNT_24H`: The number of declined transactions on the card in the trailing 24 hours up and until the authorization. * `CARD_STATE`: The current state of the card associated with the transaction. Valid values are `CLOSED`, `OPEN`, `PAUSED`, `PENDING_ACTIVATION`, `PENDING_FULFILLMENT`. * `PIN_ENTERED`: Indicates whether a PIN was entered during the transaction. Valid values are `TRUE`, `FALSE`. * `PIN_STATUS`: The current state of card's PIN. Valid values are `NOT_SET`, `OK`, `BLOCKED`. * `WALLET_TYPE`: For transactions using a digital wallet token, indicates the source of the token. Valid values are `APPLE_PAY`, `GOOGLE_PAY`, `SAMSUNG_PAY`, `MASTERPASS`, `MERCHANT`, `OTHER`, `NONE`. * `TRANSACTION_INITIATOR`: The entity that initiated the transaction indicates the source of the token. Valid values are `CARDHOLDER`, `MERCHANT`, `UNKNOWN`. * `ADDRESS_MATCH`: Lithic's evaluation result comparing transaction's address data with the cardholder KYC data if it exists. Valid values are `MATCH`, `MATCH_ADDRESS_ONLY`, `MATCH_ZIP_ONLY`,`MISMATCH`,`NOT_PRESENT`. * `SERVICE_LOCATION_STATE`: The state/province code (ISO 3166-2) where the cardholder received the service, e.g. "NY". When a service location is present in the network data, the service location state is used. Otherwise, falls back to the card acceptor state. * `SERVICE_LOCATION_POSTAL_CODE`: The postal code where the cardholder received the service, e.g. "10001". When a service location is present in the network data, the service location postal code is used. Otherwise, falls back to the card acceptor postal code. * `CARD_AGE`: The age of the card in seconds at the time of the authorization. * `ACCOUNT_AGE`: The age of the account holder's account in seconds at the time of the authorization. - `operation` 'IS_ONE_OF' | 'IS_NOT_ONE_OF' | 'MATCHES' | 'DOES_NOT_MATCH' | 'IS_EQUAL_TO' | 'IS_NOT_EQUAL_TO' | 'IS_GREATER_THAN' | 'IS_GREATER_THAN_OR_EQUAL_TO' | 'IS_LESS_THAN' | 'IS_LESS_THAN_OR_EQUAL_TO' | 'IS_AFTER' | 'IS_BEFORE' | 'CONTAINS_ANY' | 'CONTAINS_ALL' | 'CONTAINS_NONE', required — The operation to apply to the attribute - `value` union, required - string — A regex string, to be used with `MATCHES` or `DOES_NOT_MATCH` - integer — A number, to be used with `IS_GREATER_THAN`, `IS_GREATER_THAN_OR_EQUAL_TO`, `IS_LESS_THAN`, `IS_LESS_THAN_OR_EQUAL_TO`, `IS_EQUAL_TO`, or `IS_NOT_EQUAL_TO` - string[] — An array of strings, to be used with `IS_ONE_OF` or `IS_NOT_ONE_OF` - string, date-time — A timestamp, to be used with `IS_AFTER` or `IS_BEFORE` - ConditionalAchActionParameters - `action` union, required - object - `type` 'APPROVE', required — Approve the ACH transaction - object - `type` 'RETURN', required — Return the ACH transaction - `code` 'R01' | 'R02' | 'R03' | 'R04' | 'R05' | 'R06' | 'R07' | 'R08' | 'R09' | 'R10' | 'R11' | 'R12' | 'R13' | 'R14' | 'R15' | 'R16' | 'R17' | 'R18' | 'R19' | 'R20' | 'R21' | 'R22' | 'R23' | 'R24' | 'R25' | 'R26' | 'R27' | 'R28' | 'R29' | 'R30' | 'R31' | 'R32' | 'R33' | 'R34' | 'R35' | 'R36' | 'R37' | 'R38' | 'R39' | 'R40' | 'R41' | 'R42' | 'R43' | 'R44' | 'R45' | 'R46' | 'R47' | 'R50' | 'R51' | 'R52' | 'R53' | 'R61' | 'R62' | 'R67' | 'R68' | 'R69' | 'R70' | 'R71' | 'R72' | 'R73' | 'R74' | 'R75' | 'R76' | 'R77' | 'R80' | 'R81' | 'R82' | 'R83' | 'R84' | 'R85', required — NACHA return code to use when returning the transaction. Note that the list of available return codes is subject to an allowlist configured at the program level - `conditions` object[], required - `attribute` 'COMPANY_NAME' | 'COMPANY_ID' | 'TIMESTAMP' | 'TRANSACTION_AMOUNT' | 'SEC_CODE' | 'MEMO', required — The attribute to target. The following attributes may be targeted: * `COMPANY_NAME`: The name of the company initiating the ACH transaction. * `COMPANY_ID`: The company ID (also known as Standard Entry Class (SEC) Company ID) of the entity initiating the ACH transaction. * `TIMESTAMP`: The timestamp of the ACH transaction in ISO 8601 format. * `TRANSACTION_AMOUNT`: The amount of the ACH transaction in minor units (cents). * `SEC_CODE`: Standard Entry Class code indicating the type of ACH transaction. Valid values include PPD (Prearranged Payment and Deposit Entry), CCD (Corporate Credit or Debit Entry), WEB (Internet-Initiated/Mobile Entry), TEL (Telephone-Initiated Entry), and others. * `MEMO`: Optional memo or description field included with the ACH transaction. - `operation` 'IS_ONE_OF' | 'IS_NOT_ONE_OF' | 'MATCHES' | 'DOES_NOT_MATCH' | 'IS_EQUAL_TO' | 'IS_NOT_EQUAL_TO' | 'IS_GREATER_THAN' | 'IS_GREATER_THAN_OR_EQUAL_TO' | 'IS_LESS_THAN' | 'IS_LESS_THAN_OR_EQUAL_TO' | 'IS_AFTER' | 'IS_BEFORE' | 'CONTAINS_ANY' | 'CONTAINS_ALL' | 'CONTAINS_NONE', required — The operation to apply to the attribute - `value` union, required - string — A regex string, to be used with `MATCHES` or `DOES_NOT_MATCH` - integer — A number, to be used with `IS_GREATER_THAN`, `IS_GREATER_THAN_OR_EQUAL_TO`, `IS_LESS_THAN`, `IS_LESS_THAN_OR_EQUAL_TO`, `IS_EQUAL_TO`, or `IS_NOT_EQUAL_TO` - string[] — An array of strings, to be used with `IS_ONE_OF` or `IS_NOT_ONE_OF` - string, date-time — A timestamp, to be used with `IS_AFTER` or `IS_BEFORE` - ConditionalTokenizationActionParameters - `action` union, required - object - `type` 'DECLINE', required — Decline the tokenization request - `reason` 'ACCOUNT_SCORE_1' | 'DEVICE_SCORE_1' | 'ALL_WALLET_DECLINE_REASONS_PRESENT' | 'WALLET_RECOMMENDED_DECISION_RED' | 'CVC_MISMATCH' | 'CARD_EXPIRY_MONTH_MISMATCH' | 'CARD_EXPIRY_YEAR_MISMATCH' | 'CARD_INVALID_STATE' | 'CUSTOMER_RED_PATH' | 'INVALID_CUSTOMER_RESPONSE' | 'NETWORK_FAILURE' | 'GENERIC_DECLINE' | 'DIGITAL_CARD_ART_REQUIRED' — Reason code for declining the tokenization request - object - `type` 'REQUIRE_TFA', required — Require two-factor authentication for the tokenization request - `reason` 'WALLET_RECOMMENDED_TFA' | 'SUSPICIOUS_ACTIVITY' | 'DEVICE_RECENTLY_LOST' | 'TOO_MANY_RECENT_ATTEMPTS' | 'TOO_MANY_RECENT_TOKENS' | 'TOO_MANY_DIFFERENT_CARDHOLDERS' | 'OUTSIDE_HOME_TERRITORY' | 'HAS_SUSPENDED_TOKENS' | 'HIGH_RISK' | 'ACCOUNT_SCORE_LOW' | 'DEVICE_SCORE_LOW' | 'CARD_STATE_TFA' | 'HARDCODED_TFA' | 'CUSTOMER_RULE_TFA' | 'DEVICE_HOST_CARD_EMULATION' — Reason code for requiring two-factor authentication - `conditions` object[], required - `attribute` 'TIMESTAMP' | 'TOKENIZATION_CHANNEL' | 'TOKENIZATION_SOURCE' | 'TOKEN_REQUESTOR_NAME' | 'WALLET_ACCOUNT_SCORE' | 'WALLET_DEVICE_SCORE' | 'WALLET_RECOMMENDED_DECISION' | 'WALLET_RECOMMENDATION_REASONS' | 'TOKEN_REQUESTOR_ID' | 'WALLET_TOKEN_STATUS' | 'CARD_STATE', required — The attribute to target. The following attributes may be targeted: * `TIMESTAMP`: The timestamp of the tokenization request in ISO 8601 format. * `TOKENIZATION_CHANNEL`: The channel through which the tokenization request was initiated. Valid values are `DIGITAL_WALLET`, `MERCHANT`. * `TOKENIZATION_SOURCE`: The source of the tokenization request. Valid values are `ACCOUNT_ON_FILE`, `MANUAL_PROVISION`, `PUSH_PROVISION`, `CHIP_DIP`, `CONTACTLESS_TAP`, `TOKEN`, `UNKNOWN`. * `TOKEN_REQUESTOR_NAME`: The name of the entity requesting the token. Valid values are `ALT_ID`, `AMAZON_ONE`, `AMERICAN_EXPRESS_TOKEN_SERVICE`, `ANDROID_PAY`, `APPLE_PAY`, `FACEBOOK`, `FITBIT_PAY`, `GARMIN_PAY`, `GOOGLE_PAY`, `GOOGLE_VCN`, `ISSUER_HCE`, `MICROSOFT_PAY`, `NETFLIX`, `SAMSUNG_PAY`, `UNKNOWN`, `VISA_CHECKOUT`. * `WALLET_ACCOUNT_SCORE`: Risk score for the account in the digital wallet. Numeric value where lower numbers indicate higher risk (e.g., 1 = high risk, 2 = medium risk). * `WALLET_DEVICE_SCORE`: Risk score for the device in the digital wallet. Numeric value where lower numbers indicate higher risk (e.g., 1 = high risk, 2 = medium risk). * `WALLET_RECOMMENDED_DECISION`: The decision recommended by the digital wallet provider. Valid values include APPROVE, DECLINE, REQUIRE_ADDITIONAL_AUTHENTICATION. * `WALLET_RECOMMENDATION_REASONS`: List of reasons provided by the digital wallet provider for the recommended decision. Valid values are: - Common: `ACCOUNT_CARD_TOO_NEW`, `ACCOUNT_RECENTLY_CHANGED`, `ACCOUNT_TOO_NEW`, `ACCOUNT_TOO_NEW_SINCE_LAUNCH`, `DEVICE_RECENTLY_LOST`, `HAS_SUSPENDED_TOKENS`, `HIGH_RISK`, `INACTIVE_ACCOUNT`, `LOW_ACCOUNT_SCORE`, `LOW_DEVICE_SCORE`, `OUTSIDE_HOME_TERRITORY`, `SUSPICIOUS_ACTIVITY`, `TOO_MANY_DIFFERENT_CARDHOLDERS`, `TOO_MANY_RECENT_ATTEMPTS`, `TOO_MANY_RECENT_TOKENS`, `UNABLE_TO_ASSESS` - Visa only: `ACCOUNT_DATA_RECENTLY_CHANGED`, `ACCOUNT_PAN_PAIRING_TOO_NEW`, `LOW_TRANSACTION_VOLUME`, `USER_ACCOUNT_DEVICE_TOO_NEW`, `WALLET_ACCOUNT_TOO_NEW` - Amex only: `DEVICE_USING_VPN_PROXY`, `EXCESSIVE_BILLING_NAME_ATTEMPTS_MODERATE`, `EXCESSIVE_BILLING_NAME_ATTEMPTS_SEVERE`, `EXCESSIVE_CARD_PROVISION_ATTEMPTS_MODERATE`, `EXCESSIVE_CARD_PROVISION_ATTEMPTS_SEVERE`, `EXCESSIVE_WALLET_RESETS`, `EXCESSIVE_ZIP_ATTEMPTS_MODERATE`, `EXCESSIVE_ZIP_ATTEMPTS_SEVERE`, `USER_ID_CARD_PAIRING_TOO_NEW`, `USER_ID_DEVICE_ID_PAIRING_TOO_NEW`, `USER_ID_OS_ID_PAIRING_TOO_NEW`, `USER_ID_TOO_NEW` * `TOKEN_REQUESTOR_ID`: Unique identifier for the entity requesting the token. * `WALLET_TOKEN_STATUS`: The current status of the wallet token. * `CARD_STATE`: The state of the card being tokenized. Valid values are `CLOSED`, `OPEN`, `PAUSED`, `PENDING_ACTIVATION`, `PENDING_FULFILLMENT`. - `operation` 'IS_ONE_OF' | 'IS_NOT_ONE_OF' | 'MATCHES' | 'DOES_NOT_MATCH' | 'IS_EQUAL_TO' | 'IS_NOT_EQUAL_TO' | 'IS_GREATER_THAN' | 'IS_GREATER_THAN_OR_EQUAL_TO' | 'IS_LESS_THAN' | 'IS_LESS_THAN_OR_EQUAL_TO' | 'IS_AFTER' | 'IS_BEFORE' | 'CONTAINS_ANY' | 'CONTAINS_ALL' | 'CONTAINS_NONE', required — The operation to apply to the attribute - `value` union, required - string — A regex string, to be used with `MATCHES` or `DOES_NOT_MATCH` - integer — A number, to be used with `IS_GREATER_THAN`, `IS_GREATER_THAN_OR_EQUAL_TO`, `IS_LESS_THAN`, `IS_LESS_THAN_OR_EQUAL_TO`, `IS_EQUAL_TO`, or `IS_NOT_EQUAL_TO` - string[] — An array of strings, to be used with `IS_ONE_OF` or `IS_NOT_ONE_OF` - string, date-time — A timestamp, to be used with `IS_AFTER` or `IS_BEFORE` - TypescriptCodeParameters — Parameters for defining a TypeScript code rule - `features` RuleFeature[], required — Features available to the TypeScript code at evaluation time - union - object — A feature made available to the rule. The `name` field is the variable name used in the rule function signature. The `type` field determines which data the feature provides to the rule at evaluation time. - `AUTHORIZATION`: The authorization request being evaluated. Only available for AUTHORIZATION event stream rules. - `AUTHENTICATION`: The 3DS authentication request being evaluated. Only available for THREE_DS_AUTHENTICATION event stream rules. - `TOKENIZATION`: The tokenization request being evaluated. Only available for TOKENIZATION event stream rules. - `ACH_RECEIPT`: The ACH receipt being evaluated. Only available for ACH_CREDIT_RECEIPT and ACH_DEBIT_RECEIPT event stream rules. - `CARD`: The card associated with the event. Available for AUTHORIZATION and THREE_DS_AUTHENTICATION event stream rules. - `ACCOUNT_HOLDER`: The account holder associated with the card. Available for AUTHORIZATION and THREE_DS_AUTHENTICATION event stream rules. - `IP_METADATA`: IP address metadata for the request. Available for THREE_DS_AUTHENTICATION event stream rules. - `SPEND_VELOCITY`: Spend velocity data for the card or account. Requires `scope`, `period`, and optionally `filters` to configure the velocity calculation. Available for AUTHORIZATION event stream rules. - … - object — A feature made available to the rule. The `name` field is the variable name used in the rule function signature. The `type` field determines which data the feature provides to the rule at evaluation time. - `AUTHORIZATION`: The authorization request being evaluated. Only available for AUTHORIZATION event stream rules. - `AUTHENTICATION`: The 3DS authentication request being evaluated. Only available for THREE_DS_AUTHENTICATION event stream rules. - `TOKENIZATION`: The tokenization request being evaluated. Only available for TOKENIZATION event stream rules. - `ACH_RECEIPT`: The ACH receipt being evaluated. Only available for ACH_CREDIT_RECEIPT and ACH_DEBIT_RECEIPT event stream rules. - `CARD`: The card associated with the event. Available for AUTHORIZATION and THREE_DS_AUTHENTICATION event stream rules. - `ACCOUNT_HOLDER`: The account holder associated with the card. Available for AUTHORIZATION and THREE_DS_AUTHENTICATION event stream rules. - `IP_METADATA`: IP address metadata for the request. Available for THREE_DS_AUTHENTICATION event stream rules. - `SPEND_VELOCITY`: Spend velocity data for the card or account. Requires `scope`, `period`, and optionally `filters` to configure the velocity calculation. Available for AUTHORIZATION event stream rules. - … - object — A feature made available to the rule. The `name` field is the variable name used in the rule function signature. The `type` field determines which data the feature provides to the rule at evaluation time. - `AUTHORIZATION`: The authorization request being evaluated. Only available for AUTHORIZATION event stream rules. - `AUTHENTICATION`: The 3DS authentication request being evaluated. Only available for THREE_DS_AUTHENTICATION event stream rules. - `TOKENIZATION`: The tokenization request being evaluated. Only available for TOKENIZATION event stream rules. - `ACH_RECEIPT`: The ACH receipt being evaluated. Only available for ACH_CREDIT_RECEIPT and ACH_DEBIT_RECEIPT event stream rules. - `CARD`: The card associated with the event. Available for AUTHORIZATION and THREE_DS_AUTHENTICATION event stream rules. - `ACCOUNT_HOLDER`: The account holder associated with the card. Available for AUTHORIZATION and THREE_DS_AUTHENTICATION event stream rules. - `IP_METADATA`: IP address metadata for the request. Available for THREE_DS_AUTHENTICATION event stream rules. - `SPEND_VELOCITY`: Spend velocity data for the card or account. Requires `scope`, `period`, and optionally `filters` to configure the velocity calculation. Available for AUTHORIZATION event stream rules. - … - object — A feature made available to the rule. The `name` field is the variable name used in the rule function signature. The `type` field determines which data the feature provides to the rule at evaluation time. - `AUTHORIZATION`: The authorization request being evaluated. Only available for AUTHORIZATION event stream rules. - `AUTHENTICATION`: The 3DS authentication request being evaluated. Only available for THREE_DS_AUTHENTICATION event stream rules. - `TOKENIZATION`: The tokenization request being evaluated. Only available for TOKENIZATION event stream rules. - `ACH_RECEIPT`: The ACH receipt being evaluated. Only available for ACH_CREDIT_RECEIPT and ACH_DEBIT_RECEIPT event stream rules. - `CARD`: The card associated with the event. Available for AUTHORIZATION and THREE_DS_AUTHENTICATION event stream rules. - `ACCOUNT_HOLDER`: The account holder associated with the card. Available for AUTHORIZATION and THREE_DS_AUTHENTICATION event stream rules. - `IP_METADATA`: IP address metadata for the request. Available for THREE_DS_AUTHENTICATION event stream rules. - `SPEND_VELOCITY`: Spend velocity data for the card or account. Requires `scope`, `period`, and optionally `filters` to configure the velocity calculation. Available for AUTHORIZATION event stream rules. - … - object — A feature made available to the rule. The `name` field is the variable name used in the rule function signature. The `type` field determines which data the feature provides to the rule at evaluation time. - `AUTHORIZATION`: The authorization request being evaluated. Only available for AUTHORIZATION event stream rules. - `AUTHENTICATION`: The 3DS authentication request being evaluated. Only available for THREE_DS_AUTHENTICATION event stream rules. - `TOKENIZATION`: The tokenization request being evaluated. Only available for TOKENIZATION event stream rules. - `ACH_RECEIPT`: The ACH receipt being evaluated. Only available for ACH_CREDIT_RECEIPT and ACH_DEBIT_RECEIPT event stream rules. - `CARD`: The card associated with the event. Available for AUTHORIZATION and THREE_DS_AUTHENTICATION event stream rules. - `ACCOUNT_HOLDER`: The account holder associated with the card. Available for AUTHORIZATION and THREE_DS_AUTHENTICATION event stream rules. - `IP_METADATA`: IP address metadata for the request. Available for THREE_DS_AUTHENTICATION event stream rules. - `SPEND_VELOCITY`: Spend velocity data for the card or account. Requires `scope`, `period`, and optionally `filters` to configure the velocity calculation. Available for AUTHORIZATION event stream rules. - … - object — A feature made available to the rule. The `name` field is the variable name used in the rule function signature. The `type` field determines which data the feature provides to the rule at evaluation time. - `AUTHORIZATION`: The authorization request being evaluated. Only available for AUTHORIZATION event stream rules. - `AUTHENTICATION`: The 3DS authentication request being evaluated. Only available for THREE_DS_AUTHENTICATION event stream rules. - `TOKENIZATION`: The tokenization request being evaluated. Only available for TOKENIZATION event stream rules. - `ACH_RECEIPT`: The ACH receipt being evaluated. Only available for ACH_CREDIT_RECEIPT and ACH_DEBIT_RECEIPT event stream rules. - `CARD`: The card associated with the event. Available for AUTHORIZATION and THREE_DS_AUTHENTICATION event stream rules. - `ACCOUNT_HOLDER`: The account holder associated with the card. Available for AUTHORIZATION and THREE_DS_AUTHENTICATION event stream rules. - `IP_METADATA`: IP address metadata for the request. Available for THREE_DS_AUTHENTICATION event stream rules. - `SPEND_VELOCITY`: Spend velocity data for the card or account. Requires `scope`, `period`, and optionally `filters` to configure the velocity calculation. Available for AUTHORIZATION event stream rules. - … - object — A feature made available to the rule. The `name` field is the variable name used in the rule function signature. The `type` field determines which data the feature provides to the rule at evaluation time. - `AUTHORIZATION`: The authorization request being evaluated. Only available for AUTHORIZATION event stream rules. - `AUTHENTICATION`: The 3DS authentication request being evaluated. Only available for THREE_DS_AUTHENTICATION event stream rules. - `TOKENIZATION`: The tokenization request being evaluated. Only available for TOKENIZATION event stream rules. - `ACH_RECEIPT`: The ACH receipt being evaluated. Only available for ACH_CREDIT_RECEIPT and ACH_DEBIT_RECEIPT event stream rules. - `CARD`: The card associated with the event. Available for AUTHORIZATION and THREE_DS_AUTHENTICATION event stream rules. - `ACCOUNT_HOLDER`: The account holder associated with the card. Available for AUTHORIZATION and THREE_DS_AUTHENTICATION event stream rules. - `IP_METADATA`: IP address metadata for the request. Available for THREE_DS_AUTHENTICATION event stream rules. - `SPEND_VELOCITY`: Spend velocity data for the card or account. Requires `scope`, `period`, and optionally `filters` to configure the velocity calculation. Available for AUTHORIZATION event stream rules. - … - object — A feature made available to the rule. The `name` field is the variable name used in the rule function signature. The `type` field determines which data the feature provides to the rule at evaluation time. - `AUTHORIZATION`: The authorization request being evaluated. Only available for AUTHORIZATION event stream rules. - `AUTHENTICATION`: The 3DS authentication request being evaluated. Only available for THREE_DS_AUTHENTICATION event stream rules. - `TOKENIZATION`: The tokenization request being evaluated. Only available for TOKENIZATION event stream rules. - `ACH_RECEIPT`: The ACH receipt being evaluated. Only available for ACH_CREDIT_RECEIPT and ACH_DEBIT_RECEIPT event stream rules. - `CARD`: The card associated with the event. Available for AUTHORIZATION and THREE_DS_AUTHENTICATION event stream rules. - `ACCOUNT_HOLDER`: The account holder associated with the card. Available for AUTHORIZATION and THREE_DS_AUTHENTICATION event stream rules. - `IP_METADATA`: IP address metadata for the request. Available for THREE_DS_AUTHENTICATION event stream rules. - `SPEND_VELOCITY`: Spend velocity data for the card or account. Requires `scope`, `period`, and optionally `filters` to configure the velocity calculation. Available for AUTHORIZATION event stream rules. - … - `code` string, required — The TypeScript source code of the rule. Must define a `rule()` function that accepts the declared features as positional arguments (in the same order as the `features` array) and returns an array of actions. - `version` integer, required — The version of the rule, this is incremented whenever the rule's parameters change. - `state` 'PENDING' | 'SHADOWING' | 'ERROR', required — The state of the draft version. Most rules are created synchronously and the state is immediately `SHADOWING`. Rules backed by TypeScript code are compiled asynchronously — the state starts as `PENDING` and transitions to `SHADOWING` on success or `ERROR` on failure. - `PENDING`: Compilation of the rule is in progress (TypeScript rules only). - `SHADOWING`: The draft version is ready and evaluating in shadow mode alongside the current active version. It can be promoted to the active version. - `ERROR`: Compilation of the rule failed. Check the `error` field for details. - `error` string, nullable, required — An error message if the draft version failed compilation. Populated when `state` is `ERROR`, `null` otherwise. - `name` string, nullable, required — Auth Rule Name - `event_stream` 'AUTHORIZATION' | 'THREE_DS_AUTHENTICATION' | 'TOKENIZATION' | 'ACH_CREDIT_RECEIPT' | 'ACH_DEBIT_RECEIPT', required — The event stream during which the rule will be evaluated. - `lithic_managed` boolean, required — Indicates whether this auth rule is managed by Lithic. If true, the rule cannot be modified or deleted by the user ## Other responses - `400` — Bad Request - `404` — Not Found ## Changes - **2026-03-31** `27d13d3d5226` — 6 warning - added the new `CARD_DECLINE_COUNT_15M` enum value to the `current_version/anyOf[subschema #2]/parameters/anyOf[subschema #5: Conditional Action (Authorization) Parameters]/conditions/items/attribute` response property for the response status `200` - added the new `CARD_DECLINE_COUNT_15M` enum value to the `draft_version/anyOf[subschema #2]/parameters/anyOf[subschema #5: Conditional Action (Authorization) Parameters]/conditions/items/attribute` response property for the response status `200` - added the new `CARD_DECLINE_COUNT_1H` enum value to the `current_version/anyOf[subschema #2]/parameters/anyOf[subschema #5: Conditional Action (Authorization) Parameters]/conditions/items/attribute` response property for the response status `200` - added the new `CARD_DECLINE_COUNT_1H` enum value to the `draft_version/anyOf[subschema #2]/parameters/anyOf[subschema #5: Conditional Action (Authorization) Parameters]/conditions/items/attribute` response property for the response status `200` - …2 more [Change history](https://skmtc.dev/lithic-com/apis/lithic-developer-api/changes/v2/auth_rules/:auth_rule_token/promote/post.md) --- [API](https://skmtc.dev/lithic-com/apis/lithic-developer-api.md) · [All operations](https://skmtc.dev/lithic-com/apis/lithic-developer-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/lithic-com/lithic-developer-api/revisions/bf54d7063b11/schema)