> For clean Markdown of any page, append .md to the page URL. > For a complete documentation index, see https://docs.thepennyinc.com/llms.txt. > For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.thepennyinc.com/_mcp/server. # spend_control.updated POST Sent when a `spend_control.updated` event occurs. Reference: https://docs.thepennyinc.com/api-reference/penny-banking/webhook-payloads/spend-control/spend-control-updated-webhook ## Request ### Payload - `event_id` (string, required) — Penny's unique identifier for this notification event. - `business_id` (string, required) — The business the event belongs to. When the event originated from a different business, this contains the originating business. - `type` ("spend_control.updated", required) — The notification event type. This identifies the specific occurrence represented by the event and determines how its data should be interpreted. - `category` ("object", required) — The category of the event payload. This groups related notification event types and describes the general kind of data contained in ``data``. - `schema_version` ("1.0", required) — The version of the JSON notification event schema used to encode this webhook payload. - `event_time` (datetime, required) — The date and time Penny generated the notification event. - `occurrence_time` (datetime, required) — The date and time the underlying occurrence represented by this notification event took place. - `data` (WebhooksSpendControlUpdatedWebhookPayloadContentApplicationJsonSchemaData, required) — A notification about a domain object being created, updated, or deleted. ## Types ### WebhooksSpendControlUpdatedWebhookPayloadContentApplicationJsonSchemaData A notification about a domain object being created, updated, or deleted. - `operation` (enum, required) — The change that produced this event: 'created', 'updated', or 'deleted'. - Allowed values: `created`, `updated`, `deleted` - `subject` (ObjectReferenceResponse, required) — The object this event concerns. - `category` ("object", optional, default: object) — Identifies this payload as an object change. - `object` (SpendControlWebhookPayload, optional) — The event payload delivered to a subscriber's webhook when a spend control is created or changed. - `previous_attributes` (map from string to any, optional, nullable) — The object's attributes before this change, if included. ### ObjectReferenceResponse A pointer to the object this event concerns. - `object_type` (string, required) — The kind of object this event concerns. - `object_id` (string, required) — The unique identifier of the object this event concerns. - `version` (integer, optional, nullable) — The object's version at the time of this event, if known. - `stage` (integer, optional, nullable) — The object's lifecycle stage at the time of this event, if applicable. ### SpendControlWebhookPayload The event payload delivered to a subscriber's webhook when a spend control is created or changed. - `spend_control_id` (string, required) — Penny's unique identifier for this spend control. - `version` (integer, required) — A number that increases each time this spend control's configuration changes. Use it to confirm you are looking at the latest configuration. - `version_time` (datetime, required) — The date and time this spend control's configuration was last changed. - `active` (boolean, required) — Whether this spend control's rules are currently being enforced against transactions. - `status` (enum, required) — The current lifecycle state of the spend control. 'active' means the rules are being enforced. 'deactivated' means enforcement has been paused and can be resumed. 'deleting' means removal has been requested and is in progress. 'deleted' means the spend control has been removed and is kept only for historical reference. - Allowed values: `active`, `deactivated`, `deleting`, `deleted` - `rules` (list of SpendControlWebhookPayloadRulesItems, required) — The full external configuration of every rule in this spend control. - `business_id` (string, required) — The business that owns this spend control. ### SpendControlWebhookPayloadRulesItems - CurrencyControlRuleResponse: CurrencyControlRuleResponse - GeographicControlRuleResponse: GeographicControlRuleResponse - ProcessingControlRuleResponse: ProcessingControlRuleResponse - MerchantControlRuleResponse: MerchantControlRuleResponse - TransactionAmountRuleResponse: TransactionAmountRuleResponse - VelocityRuleResponse: VelocityRuleResponse - LiveDecisioningRuleResponse: LiveDecisioningRuleResponse ### CurrencyControlRuleResponse The currencies explicitly permitted or blocked by this rule. - `rule_id` (string, required) — Penny's unique identifier for this rule. - `version` (integer, required) — A number that increases each time this rule's configuration changes. Use it to confirm you are looking at the latest configuration. - `version_time` (datetime, required) — The date and time this rule's configuration was last changed. - `applicable_card_issuance_modes` (list of enum, required) — The card issuance modes this rule applies to. - Allowed values: `managed` - `applicable_transaction_authorizations` (list of enum, required) — The kinds of transaction requests this rule applies to, for example debits or credits. - Allowed values: `debit`, `credit`, `adjustment` - `currency_rules` (AllowDenyListResponse, required) — Allowed or blocked ISO 4217 transaction currency codes. - `rule_type` ("currency", optional, default: currency) ### GeographicControlRuleResponse The locations explicitly permitted or blocked by this rule. - `rule_id` (string, required) — Penny's unique identifier for this rule. - `version` (integer, required) — A number that increases each time this rule's configuration changes. Use it to confirm you are looking at the latest configuration. - `version_time` (datetime, required) — The date and time this rule's configuration was last changed. - `applicable_card_issuance_modes` (list of enum, required) — The card issuance modes this rule applies to. - Allowed values: `managed` - `applicable_transaction_authorizations` (list of enum, required) — The kinds of transaction requests this rule applies to, for example debits or credits. - Allowed values: `debit`, `credit`, `adjustment` - `rule_type` ("geographic", optional, default: geographic) - `country_rules` (AllowDenyListResponse, optional, nullable) — Allowed or blocked ISO 3166-1 alpha-2 country codes. - `subdivision_rules` (AllowDenyListResponse, optional, nullable) — Allowed or blocked ISO 3166-2 state or province codes. - `zip_code_rules` (AllowDenyListResponse, optional, nullable) — Allowed or blocked postal codes. ### ProcessingControlRuleResponse The card entry methods explicitly permitted or blocked by this rule. - `rule_id` (string, required) — Penny's unique identifier for this rule. - `version` (integer, required) — A number that increases each time this rule's configuration changes. Use it to confirm you are looking at the latest configuration. - `version_time` (datetime, required) — The date and time this rule's configuration was last changed. - `applicable_card_issuance_modes` (list of enum, required) — The card issuance modes this rule applies to. - Allowed values: `managed` - `applicable_transaction_authorizations` (list of enum, required) — The kinds of transaction requests this rule applies to, for example debits or credits. - Allowed values: `debit`, `credit`, `adjustment` - `rule_type` ("processing", optional, default: processing) - `pan_entry_mode_rules` (AllowDenyListResponse, optional, nullable) — Allowed or blocked card entry methods, such as chip or contactless. ### MerchantControlRuleResponse The merchants explicitly permitted or blocked by this rule. - `rule_id` (string, required) — Penny's unique identifier for this rule. - `version` (integer, required) — A number that increases each time this rule's configuration changes. Use it to confirm you are looking at the latest configuration. - `version_time` (datetime, required) — The date and time this rule's configuration was last changed. - `applicable_card_issuance_modes` (list of enum, required) — The card issuance modes this rule applies to. - Allowed values: `managed` - `applicable_transaction_authorizations` (list of enum, required) — The kinds of transaction requests this rule applies to, for example debits or credits. - Allowed values: `debit`, `credit`, `adjustment` - `rule_type` ("merchant", optional, default: merchant) - `merchant_id_rules` (AllowDenyListResponse, optional, nullable) — Allowed or blocked merchant identifiers. - `merchant_category_codes_rules` (AllowDenyListResponse, optional, nullable) — Allowed or blocked merchant category codes or code ranges. - `merchant_name_rules` (list of StringMatchCriteriaResponse, optional, nullable) — Criteria used to permit or block transactions by merchant name. ### TransactionAmountRuleResponse The minimum and maximum transaction amounts configured per currency. - `rule_id` (string, required) — Penny's unique identifier for this rule. - `version` (integer, required) — A number that increases each time this rule's configuration changes. Use it to confirm you are looking at the latest configuration. - `version_time` (datetime, required) — The date and time this rule's configuration was last changed. - `applicable_card_issuance_modes` (list of enum, required) — The card issuance modes this rule applies to. - Allowed values: `managed` - `applicable_transaction_authorizations` (list of enum, required) — The kinds of transaction requests this rule applies to, for example debits or credits. - Allowed values: `debit`, `credit`, `adjustment` - `currency_amount_limits` (map from string to TransactionAmountLimitResponse, required) — Transaction amount limits keyed by ISO 4217 currency code. - `rule_type` ("transaction_amount", optional, default: transaction_amount) ### VelocityRuleResponse The transaction count and amount limits configured per currency and period. - `rule_id` (string, required) — Penny's unique identifier for this rule. - `version` (integer, required) — A number that increases each time this rule's configuration changes. Use it to confirm you are looking at the latest configuration. - `version_time` (datetime, required) — The date and time this rule's configuration was last changed. - `applicable_card_issuance_modes` (list of enum, required) — The card issuance modes this rule applies to. - Allowed values: `managed` - `applicable_transaction_authorizations` (list of enum, required) — The kinds of transaction requests this rule applies to, for example debits or credits. - Allowed values: `debit`, `credit`, `adjustment` - `velocity_controls` (map from string to map from string to VelocityControlClientAPIResponse, required) — Usage and amount limits keyed first by ISO 4217 currency code and then by limit period. - `rule_type` ("velocity", optional, default: velocity) ### LiveDecisioningRuleResponse The endpoint and fallback behaviour used for real-time decisioning. - `rule_id` (string, required) — Penny's unique identifier for this rule. - `version` (integer, required) — A number that increases each time this rule's configuration changes. Use it to confirm you are looking at the latest configuration. - `version_time` (datetime, required) — The date and time this rule's configuration was last changed. - `applicable_card_issuance_modes` (list of enum, required) — The card issuance modes this rule applies to. - Allowed values: `managed` - `applicable_transaction_authorizations` (list of enum, required) — The kinds of transaction requests this rule applies to, for example debits or credits. - Allowed values: `debit`, `credit`, `adjustment` - `notification_endpoint_id` (string, required) — The notification endpoint that receives authorization decisions. - `fallback_result` (boolean, required) — Whether a transaction is approved if live decisioning fails. - `rule_type` ("live_decisioning", optional, default: live_decisioning) ### AllowDenyListResponse A list of specific values that are explicitly permitted or explicitly blocked. At most one of these lists is typically configured. When an allowlist is present, only the listed values are permitted. When only a denylist is present, every value is permitted except the ones listed. - `allowlist` (list of string, optional, nullable) — The only values that are permitted. Absent when this restriction uses a denylist instead. - `denylist` (list of string, optional, nullable) — The values that are explicitly blocked. Absent when this restriction uses an allowlist instead. ### StringMatchCriteriaResponse A rule for matching a piece of text, such as a merchant name, against one or more reference values. - `match_type` (enum, required) — How the reference values are compared against the text being checked: 'equals' (exact match), 'starts_with', 'ends_with', 'contains', or 'regex' (matches a pattern). - Allowed values: `equals`, `starts_with`, `ends_with`, `contains`, `regex` - `condition_values` (list of string, required) — The reference values the text is compared against. - `match_result` (boolean, required) — The outcome to apply when the text matches one of the condition values. If the text does not match any of them, the opposite outcome applies. - `timeout` (double, optional, nullable) — The maximum time, in seconds, allowed to evaluate a 'regex' match before it is abandoned. Only applies when match_type is 'regex'. ### TransactionAmountLimitResponse The minimum and/or maximum amount permitted for a single transaction. - `minimum` (string, optional, nullable) — The smallest amount permitted, as a decimal string. No minimum applies if absent. - `maximum` (string, optional, nullable) — The largest amount permitted, as a decimal string. No maximum applies if absent. ### VelocityControlClientAPIResponse A velocity-based spend limit applied to an account or card: combining an optional usage (count) limit and an optional amount limit. Either, both, or neither may be configured; when both are configured, covered activity must satisfy both to be allowed. - `usage` (VelocityCounterClientAPIResponse, optional, nullable) — The usage (count) limit enforced by this control, if one is configured. Absent when this control does not restrict how many times covered activity may occur. - `balance` (VelocityBalanceClientAPIResponse, optional, nullable) — The amount limit enforced by this control, if one is configured. Absent when this control does not restrict the amount of covered activity. ### VelocityCounterClientAPIResponse The current usage of a velocity counter, as shown to clients: how much of the limit has been used and when it will next reset. - `count` (integer, required) — The current value tracked by this counter. Increases or decreases as covered activity occurs and is maintained automatically by Penny. - `count_limit` (integer, required) — The maximum value this counter is allowed to reach before further covered activity is declined. - `limit_window` (enum, required) — The recurring time period over which the count is measured, such as daily or monthly, before it resets to zero. - Allowed values: `hour`, `day`, `week`, `month`, `quarter`, `year`, `lifetime` - `last_reset_time` (datetime, required) — The date and time the count was last reset to zero at the start of a new limit window. ### VelocityBalanceClientAPIResponse The current usage of a velocity balance, as shown to clients: how much is still available against the limit and when it will next reset. - `currency` (enum, required) — ISO-4217 currency code in which this balance is maintained. - Allowed values: `USD` - `available_balance` (string, required) — The amount currently available for transactions, as a decimal string. - `amount_limit` (string, required) — The maximum amount that can be spent or transacted within the current limit window, as a decimal string. - `limit_window` (enum, required) — The recurring time period over which the amount limit applies, such as daily or monthly, before it resets. - Allowed values: `hour`, `day`, `week`, `month`, `quarter`, `year`, `lifetime` - `last_reset_time` (datetime, required) — The date and time the available balance was last reset to the full limit at the start of a new limit window.