--- title: "List program flex controls" method: GET path: "/v1/flex-controls" tags: ["Program flex controls"] --- # List program flex controls `GET /v1/flex-controls` ## Request - Base URL: `https://sandbox.pismolabs.io/rules` - URL: `https://sandbox.pismolabs.io/rules/v1/flex-controls` - Auth: HTTP bearer List all flex controls grouped by program, with pagination support. Results are ordered by program ID in ascending order. Use the optional `programId` query parameter to filter results to a single program. If `programId` is provided and no templates are found for that program, a `404` is returned. If no `programId` is specified and no templates exist at all, an empty paginated response is returned with status `200`. ## Query parameters - `programId` integer - `page` integer - `perPage` integer ## Headers - `x-tenant` string, required ## Response `200` OK. Returns paginated flex controls grouped by program. - ProgramFlexControlsResponse: Paginated response containing flex controls grouped by program - `pages` integer, required: Total number of pages - `current_page` integer, required: Current page number - `per_page` integer, required: Number of programs per page - `total_items` integer, required: Total number of programs - `programs` ProgramControlsItem[], required: List of programs with their flex controls - `program_id` integer, required: Program ID - `controls` ProgramControls, required: Collection of restriction and accumulator controls - `restriction_controls` FlexControlRestrictionControl[], required: List of restriction controls - `name` string, required: Control name - `type` string, required: Control type - `level` 'account' | 'card', required: Control level (account or card) - `processing_codes` string[]: Processing codes list for evaluating flex control conditions. If the value is empty, the flex control applies to any processing code. - `conditions` Condition[]: List of conditions - `id` string, uuid: Condition ID - `attribute` 'balance' | 'amount' | 'merchant_category_code' | 'week_day' | 'month_day' | 'time_now' | 'entry_mode' | 'merchant_id' | 'country_code' | 'number_of_installments' | 'is_physical_card_present' | 'is_device_registered' | 'is_tra_exemption_requested' | 'is_pin_validated_offline' | 'authentication_method' | 'is_token_present' | 'initiation_mode' | 'acquirer_country_code' | 'is_cavv_present' | 'avr' | 'operation_type', required: Attribute to evaluate in the condition. * `amount`: Numeric value that indicates the amount of the operation performed by the user * `balance`: Maximum balance amount allowed in an account. Due to fiscal restrictions in some countries, the user cannot have more than a certain amount in the account. When the balance value is defined, the control validates any process of entering money into that account, evaluates the account balance at the time of the transaction, and denies any inflow of money above the amount defined in the balance value. * `country_code`: Three-letter country code (ISO 3166-1) indicating the location where the transaction is initiated or processed. * `entry_mode`: A code used to establish the mode of purchase. Valid only for card network operations. For a control to be valid, it must be a code defined by the entire Field 22 (Visa) or DE 22 (Mastercard) or as specified by each card network. * Visa: Field 22 contains a 4-digit code indicating the method used to enter the account number and card expiration date (positions 1 and 2) and, if an electronic terminal is used, the capability of the terminal to capture online PINs (position 3) and the last digit (position 4) equal to 0 (unused) for transactions processed through VisaNet. This field is fixed-length with three subfields. * Mastercard: DE 22 contains a 3-digit code indicating the method used to enter the account number and card expiration date (positions 1 and 2) and, if an electronic terminal is used, the capability of the terminal to capture online PINs (position 3). * `is_device_registered`: Boolean that indicates whether the device used for the operation is registered according to the financial institution's security policies. * `is_password_present`: Boolean that indicates whether a valid password is present in the evaluation request. Valid only for card network operations. * `is_pin_validated_offline`: Boolean that indicates whether the pin was validated offline in the evaluation request. This is commonly used for offline PIN verification scenarios. Valid only for card network operations. * `is_physical_card_present`: Boolean that indicates whether a physical card is present in the evaluation request. Valid only for card network operations. Digital wallet transactions are treated as physical card transactions. To exclude digital wallet transactions, combine this condition with `is_token_present` as `true`. * `is_tra_exemption_requested`: Boolean that indicates whether a TRA (Transaction Risk Assessment) exemption is requested for the transaction. Valid only for card network operations. * `merchant_category_code`: Merchant Category Code (MCC) is a four-digit number used to describe a merchant's primary business activities. Valid only for card network operations. For a control to be valid, you must enter a code specified by the Mastercard/Visa card network. * `merchant_id`: Merchant ID. Valid only for card network operations. For a control to be valid, you must enter a code specified by the Mastercard/Visa card network. * `month_day`: Day of the month when the operation is performed. Commonly used to limit operations on holidays. The format is MMM-DD. For example, enter January 25 as "JAN-25". * `number_of_installments`: Number of installments in the operation * `time_now`: Restriction window used to establish the time when the operation is performed, defined in the Coordinated Universal Time (UTC 0) zone. For example, a 10:59 PM-06:59 AM window specifies restrictions that apply from 11 PM to 7 AM in the UTC 0 time. * `week_day`: Day of the week when the operation occurs. Use the full lowercase weekday name. Valid values: sunday, monday, tuesday, wednesday, thursday, friday, saturday. * `authentication_method`: Determine whether restrictions should be applied for specific authentication methods. For a control to be valid, it must be a code defined by the Field 60.8/Positions 9-10 for Visa operations or as specified by each card network. Valid only for card network operations. * `is_token_present`: Boolean that indicates whether a token card is present in the evaluation request. Valid only for card network operations. * `initiation_mode`: Payment initiation mode. Valid only for card network operations. - `moto`: Payments made through mail order or telephone. - `mit`: Merchant-initiated transactions. * `acquirer_country_code`: Three-letter country code (ISO 3166-1) representing the location of the acquiring bank or financial institution. Valid only for card network operations. * `is_cavv_present`: Boolean indicating that the CAVV field is present. CAVV stands for cardholder authentication verification value. Valid only for card network operations. * `avr`: String indicating that the transaction is a card network Account Verification Request (AVR) transaction. AVR transactions differ from standard authorizations in that they are typically zero-value and are used for card network verification flows. Currently, the only supported value for this attribute is `mtt`, which is the Mobility & Transport Transaction (MTT) type. * `operation_type`: Type of operation being performed. Allowed values are: - `debit` - debit transaction - `credit` - credit transaction - `none` - transaction that doesn't have a financial impact on the account balance, even though an authorization event occurs. These transactions still exist in the authorization flow, but they don't generate balance movement. AVR (Account Verification Request) is one example of this type of transaction with a zero‑amount authorization. - `operator` 'eq' | 'neq' | 'lt' | 'lte' | 'gt' | 'gte' | 'in' | 'nin' | 'bt' | 'in_group' | 'not_in_group', required: Condition type evaluation * eq - equal to value * neq - not equal to value * lt - lower than value * lte - lower than or equal to value * gt - greater than value * gte - greater than or equal to value * in - includes value * nin - does not include value * bt - between two values * in_group - in attribute group * not_in_group - not in attribute group - `value` string, required: Value to compare - `deny_code` string, required: Deny code when control fails - `active` boolean, required: Is the control active? - `accumulator_controls` FlexControlAccumulatorControl[], required: List of accumulator controls - `name` string, required: Control name - `type` string, required: Control type - `level` 'account' | 'card', required: Control level (account or card) - `processing_codes` string[]: Processing codes list for evaluating flex control conditions. If the value is empty, the flex control applies to any processing code. - `max_limit` integer: Defines the maximum limit for the control. Its meaning depends on the flex control `type`. * For `spending_limit` controls, `max_limit` represents the maximum spending amount allowed. * For `usage_limit` controls, `max_limit` represents the maximum number of transactions allowed. Once met or exceeded, any subsequent transactions are declined by evaluation control flow. For spending limits, note that this value is an integer. Since global currencies vary in the number of digits that are allowed after the decimal point, you must convert the actual maximum spending limit into an integer value to use in this field. To do this, use the following formula. value = floatNumber × 10^X, where X is the number of digits after the decimal separator for the currency as defined in ISO 4217. For example, if you want to set the value 499.99 for BRL currency transactions, where the number of decimal places is 2, you must set it to `49999` (499.99 × 10²). If you want to set the value 499 for JPY currency transactions, where the number of decimal places is 0, you must set it to `4999` (4999.0 × 10^0 = 4999.0 × 1 - in other words, the value doesn't change.) This field is **REQUIRED** for flex controls with the `type` of `spending_limit` and `usage_limit`, and it does not apply to flex controls with the `type` of `restriction` and `cumulative_limit`. - `max_amount` integer: Maximum accumulated amount allowed. Once met or exceeded, subsequent transactions are declined by the evaluation control flow. Valid only for flex controls with the `type` of `cumulative_limit`. Note that the value must be calculated as follows. value = floatNumber × 10^X, where X is the number of digits after the decimal separator for the currency defined in ISO 4217. For example, if you want to set the value 499.99 for USD currency transactions, where the number of decimal places is 2, you must set the value to `49999` (499.99 × 10²). If you want to set the value 499 for JPY currency transactions, where the number of decimal places is 0, you must set the value to `499` (499.0 × 10^0 = 499.0 × 1 - in other words, the value doesn't change). - `max_transactions` integer: Maximum number of transactions allowed. Once met or exceeded, subsequent transactions are declined by the evaluation control flow. Valid only for flex controls with the `type` of `cumulative_limit`. - `limit_duration` string: Flex control limit period duration (ISO 8601 format). For example, if a flex control sets a spending limit of $500, and `limit_duration` is set to one month (`P1M`), then the user cannot spend more than $500 from the account in any one month period. - `conditions` Condition[]: List of conditions - `id` string, uuid: Condition ID - `attribute` 'balance' | 'amount' | 'merchant_category_code' | 'week_day' | 'month_day' | 'time_now' | 'entry_mode' | 'merchant_id' | 'country_code' | 'number_of_installments' | 'is_physical_card_present' | 'is_device_registered' | 'is_tra_exemption_requested' | 'is_pin_validated_offline' | 'authentication_method' | 'is_token_present' | 'initiation_mode' | 'acquirer_country_code' | 'is_cavv_present' | 'avr' | 'operation_type', required: Attribute to evaluate in the condition. * `amount`: Numeric value that indicates the amount of the operation performed by the user * `balance`: Maximum balance amount allowed in an account. Due to fiscal restrictions in some countries, the user cannot have more than a certain amount in the account. When the balance value is defined, the control validates any process of entering money into that account, evaluates the account balance at the time of the transaction, and denies any inflow of money above the amount defined in the balance value. * `country_code`: Three-letter country code (ISO 3166-1) indicating the location where the transaction is initiated or processed. * `entry_mode`: A code used to establish the mode of purchase. Valid only for card network operations. For a control to be valid, it must be a code defined by the entire Field 22 (Visa) or DE 22 (Mastercard) or as specified by each card network. * Visa: Field 22 contains a 4-digit code indicating the method used to enter the account number and card expiration date (positions 1 and 2) and, if an electronic terminal is used, the capability of the terminal to capture online PINs (position 3) and the last digit (position 4) equal to 0 (unused) for transactions processed through VisaNet. This field is fixed-length with three subfields. * Mastercard: DE 22 contains a 3-digit code indicating the method used to enter the account number and card expiration date (positions 1 and 2) and, if an electronic terminal is used, the capability of the terminal to capture online PINs (position 3). * `is_device_registered`: Boolean that indicates whether the device used for the operation is registered according to the financial institution's security policies. * `is_password_present`: Boolean that indicates whether a valid password is present in the evaluation request. Valid only for card network operations. * `is_pin_validated_offline`: Boolean that indicates whether the pin was validated offline in the evaluation request. This is commonly used for offline PIN verification scenarios. Valid only for card network operations. * `is_physical_card_present`: Boolean that indicates whether a physical card is present in the evaluation request. Valid only for card network operations. Digital wallet transactions are treated as physical card transactions. To exclude digital wallet transactions, combine this condition with `is_token_present` as `true`. * `is_tra_exemption_requested`: Boolean that indicates whether a TRA (Transaction Risk Assessment) exemption is requested for the transaction. Valid only for card network operations. * `merchant_category_code`: Merchant Category Code (MCC) is a four-digit number used to describe a merchant's primary business activities. Valid only for card network operations. For a control to be valid, you must enter a code specified by the Mastercard/Visa card network. * `merchant_id`: Merchant ID. Valid only for card network operations. For a control to be valid, you must enter a code specified by the Mastercard/Visa card network. * `month_day`: Day of the month when the operation is performed. Commonly used to limit operations on holidays. The format is MMM-DD. For example, enter January 25 as "JAN-25". * `number_of_installments`: Number of installments in the operation * `time_now`: Restriction window used to establish the time when the operation is performed, defined in the Coordinated Universal Time (UTC 0) zone. For example, a 10:59 PM-06:59 AM window specifies restrictions that apply from 11 PM to 7 AM in the UTC 0 time. * `week_day`: Day of the week when the operation occurs. Use the full lowercase weekday name. Valid values: sunday, monday, tuesday, wednesday, thursday, friday, saturday. * `authentication_method`: Determine whether restrictions should be applied for specific authentication methods. For a control to be valid, it must be a code defined by the Field 60.8/Positions 9-10 for Visa operations or as specified by each card network. Valid only for card network operations. * `is_token_present`: Boolean that indicates whether a token card is present in the evaluation request. Valid only for card network operations. * `initiation_mode`: Payment initiation mode. Valid only for card network operations. - `moto`: Payments made through mail order or telephone. - `mit`: Merchant-initiated transactions. * `acquirer_country_code`: Three-letter country code (ISO 3166-1) representing the location of the acquiring bank or financial institution. Valid only for card network operations. * `is_cavv_present`: Boolean indicating that the CAVV field is present. CAVV stands for cardholder authentication verification value. Valid only for card network operations. * `avr`: String indicating that the transaction is a card network Account Verification Request (AVR) transaction. AVR transactions differ from standard authorizations in that they are typically zero-value and are used for card network verification flows. Currently, the only supported value for this attribute is `mtt`, which is the Mobility & Transport Transaction (MTT) type. * `operation_type`: Type of operation being performed. Allowed values are: - `debit` - debit transaction - `credit` - credit transaction - `none` - transaction that doesn't have a financial impact on the account balance, even though an authorization event occurs. These transactions still exist in the authorization flow, but they don't generate balance movement. AVR (Account Verification Request) is one example of this type of transaction with a zero‑amount authorization. - `operator` 'eq' | 'neq' | 'lt' | 'lte' | 'gt' | 'gte' | 'in' | 'nin' | 'bt' | 'in_group' | 'not_in_group', required: Condition type evaluation * eq - equal to value * neq - not equal to value * lt - lower than value * lte - lower than or equal to value * gt - greater than value * gte - greater than or equal to value * in - includes value * nin - does not include value * bt - between two values * in_group - in attribute group * not_in_group - not in attribute group - `value` string, required: Value to compare - `deny_code` string, required: Deny code when control fails - `active` boolean, required: Is the control active? ## Other responses - `400`: Bad request. Returned in the following cases: - The `x-tenant` header is missing. - The `programId` query parameter is not a positive integer. - Pagination parameters are zero or cannot be parsed as integers. - `404`: Not found. Returned when `programId` is specified but no flex controls are found for that program. - `500`: Internal server error. --- [API](https://skmtc.dev/pismo/apis/core-platform-flex-controls.md) - [All operations](https://skmtc.dev/pismo/apis/core-platform-flex-controls/llms.txt) - [OpenAPI document](https://skmtc.dev/pismo/apis/core-platform-flex-controls/revisions/f6ad29885c69?raw)