# Card control profiles Card control profiles help you manage [spending controls](https://www.checkout.com/docs/card-issuing/manage-controls.md) for a large group of cards from a single source. You create a control profile and set it as the target of specific controls. You then add cards to the profile, which automatically inherit the controls. --- ## How it works 1. Create a control profile. 2. Create a control targeting the profile. 3. Add a card to the profile. You can then: - View all your control profiles, or all profiles applied to a specific card. - View the details of a specific profile. - Update the profile name. - Delete a profile. - Remove cards from a profile. ### Profile specifications - A control profile can be targeted by up to 10 controls. - You can add an unlimited number of cards to a profile. - You can create up to a maximum of 100 control profiles. - You cannot add velocity controls to control profiles. ### Control hierarchy During a transaction, controls that target any profile the card is added to are evaluated alongside any [card-level controls](https://www.checkout.com/docs/card-issuing/manage-controls/card-controls.md). When a control profile or card has multiple controls, the strictest control always overrides the others. In the following example, the second control overrides the first control: - Allow the card to spend up to 500 EUR per month at food businesses - Limit the card's overall spending to 400 EUR per month ### Cumulative allow controls If multiple _Allow_ controls apply to a card, they are applied cumulatively. That is, they do not block each other in order to avoid declined transactions. This applies: - To merchant identifier (MID) and [merchant category code](https://www.checkout.com/docs/resources/codes/merchant-category-codes.md) (MCC) controls - When all the controls are created by the same owner – the owner can be you or Checkout.com - Whether the controls are applied at card level, or inherited from a [control profile](https://www.checkout.com/docs/card-issuing/manage-controls/card-control-profiles.md) or card product For example, you create a control targeting a control profile that allows spending at airline and hotel MCCs only. You later apply another control to a specific card linked to that profile that allows spending for taxi MCCs only. Both controls cumulatively apply to the card, so it can only spend at airline, hotel, and taxi MCCs. ### Control retroactivity Controls are not retroactive. Transactions approved before a control is applied are not affected by the control. > **Information** > > For guidance on how to view the details of a specific control, and update or delete controls, see [Manage controls](https://www.checkout.com/docs/card-issuing/manage-controls.md). --- ## Create a control profile Call the [Create a control profile](https://api-reference.checkout.com/tag/Control-profiles/#operation/createControlProfile) endpoint, and provide a profile `name`. > **Information** > > Your base URL's `{prefix}` value is unique to your account and environment. To learn how to retrieve your base URLs for the sandbox and production environments, see [API endpoints](https://www.checkout.com/docs/developer-resources/api/api-endpoints.md). **Production** `POST` `https://{prefix}.api.checkout.com/issuing/controls/control-profiles` **Sandbox** `POST` `https://{prefix}.api.sandbox.checkout.com/issuing/controls/control-profiles` ### Request example ```json { "name": "Low Risk MCC Profile" } ``` ### Response example The response returns the control profile `id`, which you need for the next step. For example, `cpr_j4mvlui5qotufgvaeqwhvlbfna`. ```json { "id": "cpr_j4mvlui5qotufgvaeqwhvlbfna", "name": "Low Risk MCC Profile", "created_date": "2024-03-12T18:13:45.7155085Z", "last_modified_date": "2024-03-12T18:13:45.7155085Z", "_links": { "self": { "href": "https://{prefix}.api.checkout.com/issuing/controls/control-profiles/cpr_j4mvlui5qotufgvaeqwhvlbfna", "actions": [ "GET" ], "types": [ "application/json" ] } } } ``` --- ## Create a control targeting a control profile To create a control that targets the control profile, call the [Create a control](https://api-reference.checkout.com/tag/Controls/#operation/createControl) endpoint: - `target_id` field – Provide the control profile `id` you want the control to target. - `description` field – Optionally, provide a description for the control. For an MCC control: - `control_type` field – Set to `mcc_limit`. - `mcc_limit` object: - `type` field – Set to `allow` or `block` the MCCs. - `mcc_list` field – List the relevant MCCs. For an MID control: - `control_type` field – Set to `mid_limit`. - `mid_limit` object: - `type` field – Set to `allow` or `block` the MIDs. - `mid_list` field – List the relevant MIDs. > **Information** > > You can only use one rule to specify which MCCs to allow. > If you need to update an MCC control's allowlist, [update the control](https://www.checkout.com/docs/card-issuing/manage-controls/card-controls.md#Update_a_control) itself. > **Information** > > Your base URL's `{prefix}` value is unique to your account and environment. To learn how to retrieve your base URLs for the sandbox and production environments, see [API endpoints](https://www.checkout.com/docs/developer-resources/api/api-endpoints.md). **Production** `POST` `https://{prefix}.api.checkout.com/issuing/controls` **Sandbox** `POST` `https://{prefix}.api.sandbox.checkout.com/issuing/controls` ### Request example ```json { "description": "Allow the card to be used only in restaurants and supermarkets", "control_type": "mcc_limit", "target_id": "cpr_j4mvlui5qotufgvaeqwhvlbfna", "mcc_limit": { "type": "allow", "mcc_list": [ "5932", "5411" ] } } ``` ### Response example The response returns the control `id`, which you need for the next step. For example, `ctr_gp7vkmxayztufjz6top5bjcdra`. ```json { "id": "ctr_gp7vkmxayztufjz6top5bjcdra", "description": "Allow the card to be used only in restaurants and supermarkets", "control_type": "mcc_limit", "target_id": "cpr_j4mvlui5qotufgvaeqwhvlbfna", "created_date": "2023-03-12T18:20:12Z", "last_modified_date": "2023-03-12T18:20:12Z", "_links": { "self": { "href": "https://{prefix}.api.checkout.com/issuing/controls/ctr_gp7vkmxayztufjz6top5bjcdra", "actions": [ "GET" ], "types": [ "application/json" ] } }, "mcc_limit": { "type": "allow", "mcc_list": [ "5932", "5411" ] } } ``` --- ## Add a card to a control profile To add a card to the control profile, call the [Add target to control profile](https://api-reference.checkout.com/tag/Control-profiles/#operation/addTargetToControlProfile) endpoint, and provide the following path parameters: - `{controlProfileId}` path parameter – Provide the control profile `id` returned in the [Create a control profile](#Create_a_control_profile) response – for example, `cpr_j4mvlui5qotufgvaeqwhvlbfna`. - `{targetId}` path parameter – Provide the card `id` you want to add to the control profile – for example, `crd_abcdef1ghijklmn23opq45r6st`. > **Information** > > Alternatively, when you [issue a card](https://www.checkout.com/docs/card-issuing/issue-a-card.md), you can add it to a control profile using the `control_profiles` field. > **Information** > > Your base URL's `{prefix}` value is unique to your account and environment. To learn how to retrieve your base URLs for the sandbox and production environments, see [API endpoints](https://www.checkout.com/docs/developer-resources/api/api-endpoints.md). **Production** `POST` `https://{prefix}.api.checkout.com/issuing/controls/control-profiles/{controlProfileId}/add/{targetId}` **Sandbox** `POST` `https://{prefix}.api.sandbox.checkout.com/issuing/controls/control-profiles/{controlProfileId}/add/{targetId}` ### Response example ```json { "_links": { "self": { "href": "https://{prefix}.api.checkout.com/issuing/controls/control-profiles/cpr_j4mvlui5qotufgvaeqwhvlbfna", "actions": [ "GET" ], "types": [ "application/json" ] } } } ``` > **Information** > > If you [renew a card](https://www.checkout.com/docs/card-issuing/manage-cards/renew-a-card.md), the new card is automatically added to any control profile the original card was added to. --- ## View control profiles You can view all control profiles created for your account using the Dashboard and the API. ### View control profiles in the Dashboard 1. Sign in to the [Dashboard](https://dashboard.checkout.com/). 2. Go to _Issuing_ > _Card program_. 3. Select the _Card control profiles_ tab.
Each profile lists: - Allowed/blocked MCCs - Allowed/blocked MIDs The control profile IDs are not listed. ### View control profiles using the API You can call the [Get all control profiles](https://api-reference.checkout.com/tag/Control-profiles/#operation/getControlProfilesByTarget) endpoint as follows: To retrieve the ID for a control profile to add or [remove controls](https://www.checkout.com/docs/card-issuing/manage-controls.md#Remove_a_control), or to view all control profiles created for your account, do not provide query parameters. To view all control profiles applied to a specific card, provide the card `id` as the `{target_id}` query parameter. > **Information** > > Your base URL's `{prefix}` value is unique to your account and environment. To learn how to retrieve your base URLs for the sandbox and production environments, see [API endpoints](https://www.checkout.com/docs/developer-resources/api/api-endpoints.md). **Production** `GET` `https://{prefix}.api.checkout.com/issuing/controls/control-profiles?target_id=crd_abcdef1ghijklmn23opq45r6st` **Sandbox** `GET` `https://{prefix}.api.sandbox.checkout.com/issuing/controls/control-profiles?target_id=crd_abcdef1ghijklmn23opq45r6st` #### Response example The response returns an array of objects, one for each control profile, containing: - The profile's `name` and `id` – for example, `cpr_j4mvlui5qotufgvaeqwhvlbfna` - Timestamps for when you created and last updated the profile ```json { "control_profiles": [ { "id": "cpr_j4mvlui5qotufgvaeqwhvlbfna", "name": "Low Risk MCC Profile", "created_date": "2024-03-12T18:13:45.7155085Z", "last_modified_date": "2024-03-13T15:44:56.7155085Z" }, { "id": "cpr_53mkhdc4jjlu5jcryx76bjbrgm", "name": "Medium Risk MCC Profile", "created_date": "2024-05-05T10:43:13.7155085Z", "last_modified_date": "2024-06-17T06:32:18.7155085Z" }, { "id": "cpr_p1ma3rclvgcu3pn5tsdgb3e3a4", "name": "High Risk MCC Profile", "created_date": "2024-02-29T12:55:55.7155085Z", "last_modified_date": "2024-03-01T10:12:12.7155085Z" } ] } ``` --- ## View control profile details To view the details of a specific control profile, call the [Get control profile details](https://api-reference.checkout.com/tag/Control-profiles/#operation/getControlProfile) endpoint, and provide the control profile `id` as the `{controlProfileId}` path parameter. For example, `cpr_j4mvlui5qotufgvaeqwhvlbfna`. > **Information** > > Your base URL's `{prefix}` value is unique to your account and environment. To learn how to retrieve your base URLs for the sandbox and production environments, see [API endpoints](https://www.checkout.com/docs/developer-resources/api/api-endpoints.md). **Production** `GET` `https://{prefix}.api.checkout.com/issuing/controls/control-profiles/{controlProfileId}` **Sandbox** `GET` `https://{prefix}.api.sandbox.checkout.com/issuing/controls/control-profiles/{controlProfileId}` ### Response example The response returns the profile's `name` and `id`, and timestamps for when you created and last updated the profile. ```json { "control_profiles": [ { "id": "cpr_j4mvlui5qotufgvaeqwhvlbfna", "name": "Low Risk MCC Profile", "created_date": "2024-03-12T18:13:45.7155085Z", "last_modified_date": "2024-03-13T15:44:56.7155085Z" }, { "id": "cpr_53mkhdc4jjlu5jcryx76bjbrgm", "name": "Medium Risk MCC Profile", "created_date": "2024-05-05T10:43:13.7155085Z", "last_modified_date": "2024-06-17T06:32:18.7155085Z" }, { "id": "cpr_p1ma3rclvgcu3pn5tsdgb3e3a4", "name": "High Risk MCC Profile", "created_date": "2024-02-29T12:55:55.7155085Z", "last_modified_date": "2024-03-01T10:12:12.7155085Z" } ] } ``` --- ## Update control profile name Call the [Update a control profile](https://api-reference.checkout.com/tag/Control-profiles/#operation/updateControlProfile) endpoint, and provide the control profile `id` as the `{controlProfileId}` path parameter. For example, `cpr_j4mvlui5qotufgvaeqwhvlbfna`. In the request payload, provide the new profile name in the `name` field. > **Information** > > Your base URL's `{prefix}` value is unique to your account and environment. To learn how to retrieve your base URLs for the sandbox and production environments, see [API endpoints](https://www.checkout.com/docs/developer-resources/api/api-endpoints.md). **Production** `PATCH` `https://{prefix}.api.checkout.com/issuing/controls/control-profiles/{controlProfileId}` **Sandbox** `PATCH` `https://{prefix}.api.sandbox.checkout.com/issuing/controls/control-profiles/{controlProfileId}` ### Request example ```json { "name": "Low Risk MCC Profile" } ``` ### Response example The response returns the profile's `id` and new `name`, and timestamps for when you created and last updated the profile. ```json { "id": "cpr_j4mvlui5qotufgvaeqwhvlbfna", "name": "Low Risk MCC Profile", "created_date": "2024-03-12T18:13:45.7155085Z", "last_modified_date": "2024-03-12T18:13:45.7155085Z", "_links": { "self": { "href": "https://{prefix}.api.checkout.com/issuing/controls/control-profiles/cpr_j4mvlui5qotufgvaeqwhvlbfna", "actions": [ "GET" ], "types": [ "application/json" ] } } } ``` --- ## Remove card from control profile You can remove a card from a control profile if you no longer want the profile's controls to apply to that card. Call the [Remove card from control profile](https://api-reference.checkout.com/tag/Control-profiles/#operation/removeTargetFromControlProfile) endpoint, and provide the following path parameters: - `{controlProfileId}` – Provide the control profile `id` you want to remove the card from – for example, `cpr_j4mvlui5qotufgvaeqwhvlbfna`. - `{targetId}` – Provide the card `id` you want to remove – for example, `crd_abcdef1ghijklmn23opq45r6st`. > **Information** > > To remove a [renewed card](https://www.checkout.com/docs/card-issuing/manage-cards/renew-a-card.md) from a control profile, you must remove the original card from the profile. > **Information** > > Your base URL's `{prefix}` value is unique to your account and environment. To learn how to retrieve your base URLs for the sandbox and production environments, see [API endpoints](https://www.checkout.com/docs/developer-resources/api/api-endpoints.md). **Production** `POST` `https://{prefix}.api.checkout.com/issuing/controls/control-profiles/{controlProfileId}/remove/{targetId}` **Sandbox** `POST` `https://{prefix}.api.sandbox.checkout.com/issuing/controls/control-profiles/{controlProfileId}/remove/{targetId}` ### Response example ```json { "_links": { "self": { "href": "https://{prefix}.api.checkout.com/issuing/controls/control-profiles/cpr_j4mvlui5qotufgvaeqwhvlbfna", "actions": [ "GET" ], "types": [ "application/json" ] } } } ``` --- ## Delete a control profile Call the [Delete a control profile](https://api-reference.checkout.com/tag/Control-profiles/#operation/deleteControlProfile) endpoint, and provide its `id` as the `{controlProfileId}` path parameter. For example, `cpr_j4mvlui5qotufgvaeqwhvlbfna`. > **Information** > > Your base URL's `{prefix}` value is unique to your account and environment. To learn how to retrieve your base URLs for the sandbox and production environments, see [API endpoints](https://www.checkout.com/docs/developer-resources/api/api-endpoints.md). **Production** `DELETE` `https://{prefix}.api.checkout.com/issuing/controls/control-profiles/{controlProfileId}` **Sandbox** `DELETE` `https://{prefix}.api.sandbox.checkout.com/issuing/controls/control-profiles/{controlProfileId}` ### Response example ```json { "_links": { "self": { "href": "https://{prefix}.api.checkout.com/issuing/controls/control-profiles/cpr_j4mvlui5qotufgvaeqwhvlbfna", "actions": [ "GET" ], "types": [ "application/json" ] } } } ```