---
title: "Create Protection Bulletin rule"
method: POST
path: "/v1/bulletin/setup"
tags: ["Rules"]
---

# Create Protection Bulletin rule

`POST /v1/bulletin/setup`

## Request

- Base URL: `https://sandbox.pismolabs.io/protection-bulletin`
- URL: `https://sandbox.pismolabs.io/protection-bulletin/v1/bulletin/setup`
- Auth: HTTP bearer

Register a new Protection Bulletin setup rule. This feature is available for Elo, Mastercard and Visa.

When you set a card rule, for example, when a card status is changed to `LOST`, it is automatically added to the Protection Bulletin.

This operation executes asynchronously. When complete, a [Bulletin rule event](https://developers.pismo.io/events/docs/bulletin-bulletin-rule-1) is generated.

**Notes:** 
  * This endpoint takes an account token - an access token encoded with a Pismo account ID. Tokens can expire quickly, which can result in a <b>401 Unauthorized</b> message.
  * Deactivating a rule after it has been created requires re-calling this endpoint  with `active` set to `false`.

## Headers

- `Authorization` string, required

## Request body

- union
  - BulletinSetupEloModel: Register a Elo Protection Bulletin setup.
    - `active` boolean, required: Is rule active? An inactive rule is not applied to transactions.
    - `program_id` number, required: Pismo program ID.
    - `allowed_status` object[]: If `allowed_status` is passed, the Pismo Protection Bulletin service starts monitoring [Card updated events](https://developers.pismo.io/events/docs/cards-update-1). The `status_pismo` status determines if the card is sent to the network via the Protection Bulletin.
      - `status_pismo` string: Pismo card status. For more information, see [Card lifecycle and statuses](https://developers.pismo.io/pismo-docs/docs/card-lifecycle-and-statuses).
      - `default_purge_days` number: After the specified number of days, a request to remove the card will be automatically sent to the network through the Protection Bulletin. The `default_purge_days` field is optional, and if not provided, no action will be taken to remove this card from the Protection Bulletin.
  - BulletinSetupMastercardModel: Register a Mastercard Protection Bulletin setup.
    - `active` boolean, required: Is rule active? An inactive rule is not applied to transactions.
    - `ica` string, required: Interbank Card Association (ICA) number - a six-digit account number that identifies a financial institution or third-party processor operating in the Mastercard network. **REQUIRED** for Mastercard. It must be padded with leading zeros.
    - `program_id` number, required: Pismo program ID.
    - `allowed_status` object[]: If `allowed_status` is provided, the Pismo Protection Bulletin service starts monitoring [Card updated events](https://developers.pismo.io/events/docs/cards-update-1). The `status_pismo` status determines if the card is sent to the network via the Protection Bulletin.
      - `status_pismo` string: Pismo card status. For more information, see [Card lifecycle and statuses](https://developers.pismo.io/pismo-docs/docs/card-lifecycle-and-statuses).
      - `status_network` 'C' | 'F' | 'G' | 'L' | 'O' | 'P' | 'S' | 'U' | 'V' | 'X': Network status equivalent to Pismo status. **REQUIRED** for Mastercard. <br /> `C` - Credit <br /> `F` - Fraud <br /> `G` - ATM Premium Listing <br /> `L` - Lost <br /> `O` - Other <br /> `P` - Capture card <br /> `S` - Stolen <br /> `U` - Unauthorized use <br /> `V` - Premium listing <br /> `X` - Counterfeit <br /> Mastercard documentation: Customer Interface Specification - DE 120 (Record Data) Layout for MCC102 - Field ID 2 (Entry Reason).
      - `default_purge_days` number: After the specified number of days, a request to remove the card will be automatically sent to the network through the Protection Bulletin. The `default_purge_days` field is optional, and if not provided, no action will be taken to remove this card from the Protection Bulletin.
  - BulletinSetupVisaModel: Register a Visa Protection Bulletin setup.
    - `active` boolean, required: Is rule active? An inactive rule is not applied to transactions.
    - `bid` string, required: Business ID (BID) number - a six to 11 digit account number that Visa uses to bill clients. **REQUIRED** for Visa. **Note:** It **must** be padded with leading zeros if less than 6 digits.
    - `program_id` number, required: Pismo program ID.
    - `region_code` string[], required: Region code contains one or more Account Screen Authorization File (ASAF) region codes that define the distribution of a Visa cardholder account number in Card Recovery Bulletin Service files. **REQUIRED** for Visa. <br /> `0` - No Bulletin / V.I.P. Only (cannot be combined with other region codes)<br /> `A` - All Asia-Pacific region countries<br /> `B` - All Central Europe, Middle East, and Africa (CEMEA) region countries.<br /> `C` - All Visa Canada<br /> `D` - National Card Recovery Bulletin<br /> `E` - All European countries<br /> `F` - All Latin America and Caribbean (LAC) region countries <br /> Region codes can be in any order, except no other region code can be specified in combination with region code 0. Visa documentation: VisaNet Authorization-Only Online Messages – Technical Specifications - Table 215: Field 127E.2 Account Screen Authorization File (ASAF) Region Codes
    - `allowed_status` object[], required: When passed, the Pismo Protection Bulletin service starts monitoring [Card updated events](https://developers.pismo.io/events/docs/cards-update-1). The `status_pismo` status determines if the card is sent to the network via the Protection Bulletin.
      - `status_pismo` string, required: Pismo card status. For more information, see [Card lifecycle and statuses](https://developers.pismo.io/pismo-docs/docs/card-lifecycle-and-statuses).
      - `status_network` '04' | '05' | '07' | '11' | '14' | '41' | '43' | '46' | '54', required: Network status equivalent to Pismo status. **REQUIRED** for Visa.<br /> `04` - Pickup card<br /> `05` - Do not honor<br /> `07` - Pickup card, special condition<br /> `11` - Approval for **VIP**<br /> `14` - Invalid account number (no such number)<br /> `41` - Lost card, pickup<br /> `43` - Stolen card, pickup<br /> `46` - Closed account<br /> `54` - Expired card<br /> Visa documentation: VisaNet Authorization-Only Online Messages – Technical Specifications - Table 214: Field 127E.1 Account Screen Authorization File (ASAF) Action Codes.
      - `default_purge_days` number, required: After the specified number of days, a request to remove the card is automatically sent to the Protection Bulletin.

## Response `202`

Accepted

## Other responses

- `400`: Bad Request
- `401`: Unauthorized
- `404`: Not Found
- `422`: Unprocessable Entity
- `500`: Internal Server Error
- `504`: Gateway Timeout

---

[API](https://skmtc.dev/pismo/apis/card-issuing-protection-bulletin.md) - [All operations](https://skmtc.dev/pismo/apis/card-issuing-protection-bulletin/llms.txt) - [OpenAPI document](https://skmtc.dev/pismo/apis/card-issuing-protection-bulletin/revisions/9f838f38c69a?raw)