---
title: "Replace a payment rule"
method: POST
path: "/payment_rules/{id}/replace"
tags: ["Payment Rules"]
---

# Replace a payment rule

`POST /payment_rules/{id}/replace`

Deletes this rule and creates its successor in one step. The successor carries a new ID and the metadata of the rule it replaced,.

## Headers

- `Idempotency-Key` string

## Request body

- object
  - `action` 'allow' | 'block' | 'review' | 'enforce_3ds', required — What this account's rule requests when every condition matches. One applicable account-rule action wins, in this order: `allow`, `block`, `review`, `enforce_3ds`. An `allow` overrides this account's other rules, never Whop's own fraud controls. A `review` requests authorization without capture for an eligible on-session card payment through Whop Payments. Automatic capture is scheduled for 48 hours after authorization; capture or void the payment before then to decide sooner. Capture may complete later or fail. Review is skipped for unsupported methods, off-session payments, and payments already configured for manual capture. An `enforce_3ds` is skipped when the account rule cannot apply a challenge. Other 3DS requirements still apply.
  - `conditions` object, required — The conditions a payment is matched against. Up to 10 conditions, and 8 KiB once serialized.
    - `all` object[], required
      - `field` 'risk_score' | 'amount_in_usd' | 'card_country' | 'customer_email' | 'ip_address', required — The payment attribute this condition reads.
      - `operator` 'eq' | 'neq' | 'gt' | 'gte' | 'lt' | 'lte' | 'in' | 'not_in' | 'contains' | 'starts_with' | 'ends_with' | 'in_cidr', required — How the payment attribute is compared to the value.
      - `value` union, required — The value to compare against. A number for `risk_score`, a string for the other fields, and an array of strings for the `in` and `not_in` operators.
        - integer
        - string
        - string[]

## Response `201`

The rule that replaced this one

- PaymentRule
  - `account_id` string, required — Account ID, prefixed `biz_`.
  - `action` 'allow' | 'block' | 'review' | 'enforce_3ds', required — What this account's rule requests when every condition matches. One applicable account-rule action wins, in this order: `allow`, `block`, `review`, `enforce_3ds`. An `allow` overrides this account's other rules, never Whop's own fraud controls. A `review` requests authorization without capture for an eligible on-session card payment through Whop Payments. Automatic capture is scheduled for 48 hours after authorization; capture or void the payment before then to decide sooner. Capture may complete later or fail. Review is skipped for unsupported methods, off-session payments, and payments already configured for manual capture. An `enforce_3ds` is skipped when the account rule cannot apply a challenge. Other 3DS requirements still apply.
  - `conditions` PaymentRuleConditions, required
    - `all` PaymentRuleCondition[], required
      - `field` 'risk_score' | 'amount_in_usd' | 'card_country' | 'customer_email' | 'ip_address', required — The payment attribute this condition reads.
      - `operator` 'eq' | 'neq' | 'gt' | 'gte' | 'lt' | 'lte' | 'in' | 'not_in' | 'contains' | 'starts_with' | 'ends_with' | 'in_cidr', required — How the payment attribute is compared to the value.
      - `value` union, required — The value to compare against. A number for `risk_score`, a string for the other fields, and an array of strings for the `in` and `not_in` operators.
        - integer
        - string
        - string[]
  - `created_at` string, required — When the rule was created, as an ISO 8601 timestamp.
  - `deleted_at` string, nullable, required — When the rule was deleted, as an ISO 8601 timestamp. `null` unless `status` is `deleted`.
  - `id` string, required — Payment rule ID, prefixed `prule_`.
  - `metadata` object, required — Custom string-to-string values for your integration. Maximum 50 keys, 40 characters per key, 500 characters per value.
  - `name` string, required — A name for this rule. Up to 255 characters.
  - `status` 'active' | 'inactive' | 'deleted', required — Whether the rule is applied to payments. A `deleted` rule is kept so the payments it already decided still name it.
  - `updated_at` string, required — When the rule was last changed, as an ISO 8601 timestamp.

## Other responses

- `409` — Conflict

## Changes

> 65 revisions in range; 1 not diffed.

- **2026-09-17** `ef86d14ef691` — 4 warning, 4 info
  - added the new `amount_in_usd` enum value to the `conditions/all/items/field` response property for the response status `201`
  - added the new `in_cidr` enum value to the `conditions/all/items/operator` response property for the response status `201`
  - added the new `ip_address` enum value to the `conditions/all/items/field` response property for the response status `201`
  - added the new `review` enum value to the `action` response property for the response status `201`
  - …4 more
- **2026-09-16** `ff3a76573563` — 1 info
  - endpoint added

[Change history](https://skmtc.dev/whop/apis/whop-api/changes/payment_rules/:id/replace/post.md)

---

[API](https://skmtc.dev/whop/apis/whop-api.md) · [All operations](https://skmtc.dev/whop/apis/whop-api/llms.txt) · [OpenAPI document](https://skmtc.dev/whop/apis/whop-api/revisions/51933d70d7f5?raw)