> For clean Markdown of any page, append .md to the page URL. > For a complete documentation index, see https://docs.thepennyinc.com/spend-controls/llms.txt. > For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.thepennyinc.com/_mcp/server. # Spend Controls ## Docs - [Rule Applicability](https://docs.thepennyinc.com/spend-controls/rule-applicability.md): Choose which authorization types and cards a rule evaluates. - [Missing Transaction Details](https://docs.thepennyinc.com/spend-controls/missing-transaction-details.md): How spend controls behave when a transaction does not include a field a rule needs. - [Transaction Amount Rules](https://docs.thepennyinc.com/spend-controls/transaction-amount-rules.md): Set per-transaction minimums and maximums by currency. - [Velocity Rules](https://docs.thepennyinc.com/spend-controls/velocity-rules.md): Limit transaction count or amount over time. - [Merchant Rules](https://docs.thepennyinc.com/spend-controls/merchant-rules.md): Control merchant IDs, categories, and names. - [Geographic Rules](https://docs.thepennyinc.com/spend-controls/geographic-rules.md): Restrict merchant location by country, subdivision, or postal code. - [Currency Rules](https://docs.thepennyinc.com/spend-controls/currency-rules.md): Allow or block transaction currencies. - [Processing Rules](https://docs.thepennyinc.com/spend-controls/processing-rules.md): Restrict how card details are presented. - [Live Decisioning Rules](https://docs.thepennyinc.com/spend-controls/live-decisioning-rules.md): Ask your endpoint to approve or decline an authorization. - [Setting Spend Controls](https://docs.thepennyinc.com/spend-controls/setting-spend-controls.md): Cap what a card can spend, then share that cap across a whole team. ## API Docs - API Reference > Authentication [Create an M2M access token](https://docs.thepennyinc.com/spend-controls/api-reference/authentication/create-token.md) - API Reference > Business > Entities [Get your business entity](https://docs.thepennyinc.com/spend-controls/api-reference/business/entities/get-default.md) - API Reference > Business > Profile [Get your business profile](https://docs.thepennyinc.com/spend-controls/api-reference/business/profile/get.md) - API Reference > Business > Spend Control [Assign a business-wide spend control](https://docs.thepennyinc.com/spend-controls/api-reference/business/spend-control/assign.md) - API Reference > Business > Spend Control [Remove the business-wide spend control](https://docs.thepennyinc.com/spend-controls/api-reference/business/spend-control/remove.md) - API Reference > Configuration > Defaults [Get your defaults](https://docs.thepennyinc.com/spend-controls/api-reference/configuration/defaults/get.md) - API Reference > Configuration > Programs [Get your program](https://docs.thepennyinc.com/spend-controls/api-reference/configuration/programs/get-default.md) - API Reference > Access > Users [List users](https://docs.thepennyinc.com/spend-controls/api-reference/access/users/list.md) - API Reference > Access > Users [Create a user](https://docs.thepennyinc.com/spend-controls/api-reference/access/users/create.md) - API Reference > Access > Users [Get a user](https://docs.thepennyinc.com/spend-controls/api-reference/access/users/get.md) - API Reference > Access > Users [Delete a user](https://docs.thepennyinc.com/spend-controls/api-reference/access/users/delete.md) - API Reference > Access > Users [Update a user](https://docs.thepennyinc.com/spend-controls/api-reference/access/users/update.md) - API Reference > Access > Users [Activate a user](https://docs.thepennyinc.com/spend-controls/api-reference/access/users/activate.md) - API Reference > Access > Users [Deactivate a user](https://docs.thepennyinc.com/spend-controls/api-reference/access/users/deactivate.md) - API Reference > Access > Users > Roles [Attach a role to a user](https://docs.thepennyinc.com/spend-controls/api-reference/access/users/roles/attach.md) - API Reference > Access > Users > Roles [Detach a role from a user](https://docs.thepennyinc.com/spend-controls/api-reference/access/users/roles/detach.md) - API Reference > Access > Users > Permissions [Attach a direct permission to a user](https://docs.thepennyinc.com/spend-controls/api-reference/access/users/permissions/attach.md) - API Reference > Access > Users > Permissions [Detach a direct permission from a user](https://docs.thepennyinc.com/spend-controls/api-reference/access/users/permissions/detach.md) - API Reference > Access > Roles [List custom roles](https://docs.thepennyinc.com/spend-controls/api-reference/access/roles/list.md) - API Reference > Access > Roles [Create a custom role](https://docs.thepennyinc.com/spend-controls/api-reference/access/roles/create.md) - API Reference > Access > Roles [Get a custom role](https://docs.thepennyinc.com/spend-controls/api-reference/access/roles/get.md) - API Reference > Access > Roles [Delete a custom role](https://docs.thepennyinc.com/spend-controls/api-reference/access/roles/delete.md) - API Reference > Access > Roles [Update a custom role](https://docs.thepennyinc.com/spend-controls/api-reference/access/roles/update.md) - API Reference > Access > Roles [Activate a custom role](https://docs.thepennyinc.com/spend-controls/api-reference/access/roles/activate.md) - API Reference > Access > Roles [Deactivate a custom role](https://docs.thepennyinc.com/spend-controls/api-reference/access/roles/deactivate.md) - API Reference > Access > Roles > Presets [List preset roles](https://docs.thepennyinc.com/spend-controls/api-reference/access/roles/presets/list.md) - API Reference > Access > Roles > Presets [Get a preset role](https://docs.thepennyinc.com/spend-controls/api-reference/access/roles/presets/get.md) - API Reference > Access > Roles > Permissions [Attach a permission to a role](https://docs.thepennyinc.com/spend-controls/api-reference/access/roles/permissions/attach.md) - API Reference > Access > Roles > Permissions [Detach a permission from a role](https://docs.thepennyinc.com/spend-controls/api-reference/access/roles/permissions/detach.md) - API Reference > Access > Applications [List applications](https://docs.thepennyinc.com/spend-controls/api-reference/access/applications/list.md) - API Reference > Access > Applications [Create an application](https://docs.thepennyinc.com/spend-controls/api-reference/access/applications/create.md) - API Reference > Access > Applications [Get an application](https://docs.thepennyinc.com/spend-controls/api-reference/access/applications/get.md) - API Reference > Access > Applications [Delete an application](https://docs.thepennyinc.com/spend-controls/api-reference/access/applications/delete.md) - API Reference > Access > Applications [Update an application](https://docs.thepennyinc.com/spend-controls/api-reference/access/applications/update.md) - API Reference > Access > Applications [Activate an application](https://docs.thepennyinc.com/spend-controls/api-reference/access/applications/activate.md) - API Reference > Access > Applications [Deactivate an application](https://docs.thepennyinc.com/spend-controls/api-reference/access/applications/deactivate.md) - API Reference > Access > Applications [Rotate an application secret](https://docs.thepennyinc.com/spend-controls/api-reference/access/applications/rotate-secret.md) - API Reference > Access > Applications > Roles [Attach a role to an application](https://docs.thepennyinc.com/spend-controls/api-reference/access/applications/roles/attach.md) - API Reference > Access > Applications > Roles [Detach a role from an application](https://docs.thepennyinc.com/spend-controls/api-reference/access/applications/roles/detach.md) - API Reference > Access > Applications > Permissions [Attach a direct permission to an application](https://docs.thepennyinc.com/spend-controls/api-reference/access/applications/permissions/attach.md) - API Reference > Access > Applications > Permissions [Detach a direct permission from an application](https://docs.thepennyinc.com/spend-controls/api-reference/access/applications/permissions/detach.md) - API Reference > Accounts > Capital [List capital accounts](https://docs.thepennyinc.com/spend-controls/api-reference/accounts/capital/list.md) - API Reference > Accounts > Capital [Create a capital account](https://docs.thepennyinc.com/spend-controls/api-reference/accounts/capital/create.md) - API Reference > Accounts > Capital [Get a capital account](https://docs.thepennyinc.com/spend-controls/api-reference/accounts/capital/get.md) - API Reference > Accounts > Capital [Delete a capital account](https://docs.thepennyinc.com/spend-controls/api-reference/accounts/capital/delete.md) - API Reference > Accounts > Capital [Update a capital account](https://docs.thepennyinc.com/spend-controls/api-reference/accounts/capital/update.md) - API Reference > Accounts > Capital [Transfer between capital accounts](https://docs.thepennyinc.com/spend-controls/api-reference/accounts/capital/transfer.md) - API Reference > Accounts > Capital [Activate a capital account](https://docs.thepennyinc.com/spend-controls/api-reference/accounts/capital/activate.md) - API Reference > Accounts > Capital [Deactivate a capital account](https://docs.thepennyinc.com/spend-controls/api-reference/accounts/capital/deactivate.md) - API Reference > Accounts > Capital > Auto Top Up [Remove a capital account's auto top-up](https://docs.thepennyinc.com/spend-controls/api-reference/accounts/capital/auto-top-up/remove.md) - API Reference > Accounts > Capital > Auto Top Up [Update a capital account's auto top-up](https://docs.thepennyinc.com/spend-controls/api-reference/accounts/capital/auto-top-up/update.md) - API Reference > Accounts > Capital > Low Balance Alert [Remove a capital account's low balance alert](https://docs.thepennyinc.com/spend-controls/api-reference/accounts/capital/low-balance-alert/remove.md) - API Reference > Accounts > Capital > Low Balance Alert [Update a capital account's low balance alert](https://docs.thepennyinc.com/spend-controls/api-reference/accounts/capital/low-balance-alert/update.md) - API Reference > Accounts > Capital > Spend Control [Assign a spend control to a capital account](https://docs.thepennyinc.com/spend-controls/api-reference/accounts/capital/spend-control/assign.md) - API Reference > Accounts > Capital > Spend Control [Remove a capital account's spend control](https://docs.thepennyinc.com/spend-controls/api-reference/accounts/capital/spend-control/remove.md) - API Reference > Accounts > Capital > Ledger [List capital account ledger entries](https://docs.thepennyinc.com/spend-controls/api-reference/accounts/capital/ledger/list.md) - API Reference > Accounts > Capital > Transactions [List capital account transactions](https://docs.thepennyinc.com/spend-controls/api-reference/accounts/capital/transactions/list.md) - API Reference > Accounts > Control [List control accounts](https://docs.thepennyinc.com/spend-controls/api-reference/accounts/control/list.md) - API Reference > Accounts > Control [Create a control account](https://docs.thepennyinc.com/spend-controls/api-reference/accounts/control/create.md) - API Reference > Accounts > Control [Get a control account](https://docs.thepennyinc.com/spend-controls/api-reference/accounts/control/get.md) - API Reference > Accounts > Control [Delete a control account](https://docs.thepennyinc.com/spend-controls/api-reference/accounts/control/delete.md) - API Reference > Accounts > Control [Update a control account](https://docs.thepennyinc.com/spend-controls/api-reference/accounts/control/update.md) - API Reference > Accounts > Control [Activate a control account](https://docs.thepennyinc.com/spend-controls/api-reference/accounts/control/activate.md) - API Reference > Accounts > Control [Deactivate a control account](https://docs.thepennyinc.com/spend-controls/api-reference/accounts/control/deactivate.md) - API Reference > Accounts > Control > Spend Control [Assign a spend control to a control account](https://docs.thepennyinc.com/spend-controls/api-reference/accounts/control/spend-control/assign.md) - API Reference > Accounts > Control > Spend Control [Remove a control account's spend control](https://docs.thepennyinc.com/spend-controls/api-reference/accounts/control/spend-control/remove.md) - API Reference > Accounts > Control > Ledger [List control account ledger entries](https://docs.thepennyinc.com/spend-controls/api-reference/accounts/control/ledger/list.md) - API Reference > Accounts > Control > Transactions [List control account transactions](https://docs.thepennyinc.com/spend-controls/api-reference/accounts/control/transactions/list.md) - API Reference > Accounts > Linked [List linked accounts](https://docs.thepennyinc.com/spend-controls/api-reference/accounts/linked/list.md) - API Reference > Accounts > Linked [Create a linked account](https://docs.thepennyinc.com/spend-controls/api-reference/accounts/linked/create.md) - API Reference > Accounts > Linked [Get a linked account](https://docs.thepennyinc.com/spend-controls/api-reference/accounts/linked/get.md) - API Reference > Accounts > Linked [Delete a linked account](https://docs.thepennyinc.com/spend-controls/api-reference/accounts/linked/delete.md) - API Reference > Treasury > Ledger [Get a ledger entry](https://docs.thepennyinc.com/spend-controls/api-reference/treasury/ledger/get.md) - API Reference > Treasury > Ledger [List ledger entries](https://docs.thepennyinc.com/spend-controls/api-reference/treasury/ledger/list.md) - API Reference > Treasury > Transactions [Find transactions by client reference](https://docs.thepennyinc.com/spend-controls/api-reference/treasury/transactions/list-by-client-reference.md) - API Reference > Treasury > Transactions [Get a transaction](https://docs.thepennyinc.com/spend-controls/api-reference/treasury/transactions/get.md) - API Reference > Treasury > Transactions [Get transaction events](https://docs.thepennyinc.com/spend-controls/api-reference/treasury/transactions/get-events.md) - API Reference > Treasury > Transactions [Get transaction history](https://docs.thepennyinc.com/spend-controls/api-reference/treasury/transactions/get-history.md) - API Reference > Treasury > Transactions [List transactions](https://docs.thepennyinc.com/spend-controls/api-reference/treasury/transactions/list.md) - API Reference > Spend Controls [List spend controls](https://docs.thepennyinc.com/spend-controls/api-reference/spend-controls/list.md) - API Reference > Spend Controls [Create a spend control](https://docs.thepennyinc.com/spend-controls/api-reference/spend-controls/create.md) - API Reference > Spend Controls [List spend control rule types](https://docs.thepennyinc.com/spend-controls/api-reference/spend-controls/list-rule-types.md) - API Reference > Spend Controls [Get a spend control](https://docs.thepennyinc.com/spend-controls/api-reference/spend-controls/get.md) - API Reference > Spend Controls [Delete a spend control](https://docs.thepennyinc.com/spend-controls/api-reference/spend-controls/delete.md) - API Reference > Spend Controls [Update a spend control's rules](https://docs.thepennyinc.com/spend-controls/api-reference/spend-controls/update-rules.md) - API Reference > Spend Controls [Remove a rule from a spend control](https://docs.thepennyinc.com/spend-controls/api-reference/spend-controls/delete-rule.md) - API Reference > Spend Controls [Activate a spend control](https://docs.thepennyinc.com/spend-controls/api-reference/spend-controls/activate.md) - API Reference > Spend Controls [Deactivate a spend control](https://docs.thepennyinc.com/spend-controls/api-reference/spend-controls/deactivate.md) - API Reference > Spend Controls > Associations [Get the spend control governing an object](https://docs.thepennyinc.com/spend-controls/api-reference/spend-controls/associations/get-by-associated-object.md) - API Reference > Spend Controls > Associations [Remove an object's spend control association](https://docs.thepennyinc.com/spend-controls/api-reference/spend-controls/associations/remove.md) - API Reference > Spend Controls > Associations [List a spend control's associated objects](https://docs.thepennyinc.com/spend-controls/api-reference/spend-controls/associations/list.md) - API Reference > Billing > Fees [Get a fee](https://docs.thepennyinc.com/spend-controls/api-reference/billing/fees/get.md) - API Reference > Billing > Fees [Get fee events](https://docs.thepennyinc.com/spend-controls/api-reference/billing/fees/get-events.md) - API Reference > Billing > Fees [Get fee history](https://docs.thepennyinc.com/spend-controls/api-reference/billing/fees/get-history.md) - API Reference > Billing > Fees [List fees](https://docs.thepennyinc.com/spend-controls/api-reference/billing/fees/list.md) - API Reference > Platform > Notifications > Webhooks [List webhooks](https://docs.thepennyinc.com/spend-controls/api-reference/platform/notifications/webhooks/list.md) - API Reference > Platform > Notifications > Webhooks [Create a webhook](https://docs.thepennyinc.com/spend-controls/api-reference/platform/notifications/webhooks/create.md) - API Reference > Platform > Notifications > Webhooks [Get a webhook](https://docs.thepennyinc.com/spend-controls/api-reference/platform/notifications/webhooks/get.md) - API Reference > Platform > Notifications > Webhooks [Delete a webhook](https://docs.thepennyinc.com/spend-controls/api-reference/platform/notifications/webhooks/delete.md) - API Reference > Platform > Notifications > Webhooks [Update a webhook](https://docs.thepennyinc.com/spend-controls/api-reference/platform/notifications/webhooks/update.md) - API Reference > Platform > Notifications > Webhooks [Activate a webhook](https://docs.thepennyinc.com/spend-controls/api-reference/platform/notifications/webhooks/activate.md) - API Reference > Platform > Notifications > Webhooks [Deactivate a webhook](https://docs.thepennyinc.com/spend-controls/api-reference/platform/notifications/webhooks/deactivate.md) - API Reference > Platform > Notifications > Webhooks [Add a webhook signing secret](https://docs.thepennyinc.com/spend-controls/api-reference/platform/notifications/webhooks/create-signing-secret.md) - API Reference > Platform > Notifications > Webhooks [Rotate a webhook signing secret](https://docs.thepennyinc.com/spend-controls/api-reference/platform/notifications/webhooks/rotate-signing-secret.md) - API Reference > Platform > Notifications > Webhooks [Get webhook history](https://docs.thepennyinc.com/spend-controls/api-reference/platform/notifications/webhooks/get-history.md) - API Reference > Platform > Notifications > Webhooks [List deliveries to a webhook](https://docs.thepennyinc.com/spend-controls/api-reference/platform/notifications/webhooks/list-deliveries.md) - API Reference > Platform > Notifications > Webhooks > Events [List webhook events](https://docs.thepennyinc.com/spend-controls/api-reference/platform/notifications/webhooks/events/list.md) - API Reference > Platform > Notifications > Webhooks > Events [Get a webhook event](https://docs.thepennyinc.com/spend-controls/api-reference/platform/notifications/webhooks/events/get.md) - API Reference > Platform > Notifications > Webhooks > Events [Get webhook event history](https://docs.thepennyinc.com/spend-controls/api-reference/platform/notifications/webhooks/events/get-history.md) - API Reference > Platform > Notifications > Webhooks > Events [List deliveries of a webhook event](https://docs.thepennyinc.com/spend-controls/api-reference/platform/notifications/webhooks/events/list-deliveries.md) - API Reference > Platform > Notifications > Webhooks > Exchanges [List webhook decision exchanges](https://docs.thepennyinc.com/spend-controls/api-reference/platform/notifications/webhooks/exchanges/list.md) - API Reference > Platform > Notifications > Webhooks > Exchanges [Get a webhook decision exchange](https://docs.thepennyinc.com/spend-controls/api-reference/platform/notifications/webhooks/exchanges/get.md) - API Reference > Platform > Notifications > Webhooks > Trigger Events [Replace webhook trigger events](https://docs.thepennyinc.com/spend-controls/api-reference/platform/notifications/webhooks/trigger-events/replace.md) - API Reference > Platform > Notifications > Webhooks > Trigger Events [Remove webhook trigger events](https://docs.thepennyinc.com/spend-controls/api-reference/platform/notifications/webhooks/trigger-events/remove.md) - API Reference > Platform > Notifications > Webhooks > Trigger Events [Add webhook trigger events](https://docs.thepennyinc.com/spend-controls/api-reference/platform/notifications/webhooks/trigger-events/add.md) - API Reference > Platform > Notifications > Webhooks > Filter Identifiers [Replace webhook filter identifiers](https://docs.thepennyinc.com/spend-controls/api-reference/platform/notifications/webhooks/filter-identifiers/replace.md) - API Reference > Platform > Notifications > Webhooks > Filter Identifiers [Remove webhook filter identifiers](https://docs.thepennyinc.com/spend-controls/api-reference/platform/notifications/webhooks/filter-identifiers/remove.md) - API Reference > Platform > Notifications > Webhooks > Filter Identifiers [Add webhook filter identifiers](https://docs.thepennyinc.com/spend-controls/api-reference/platform/notifications/webhooks/filter-identifiers/add.md) - API Reference > Platform > Notifications > Webhooks > Verification [Initialize webhook verification](https://docs.thepennyinc.com/spend-controls/api-reference/platform/notifications/webhooks/verification/initialize.md) - API Reference > Platform > Notifications > Webhooks > Verification [Verify a webhook](https://docs.thepennyinc.com/spend-controls/api-reference/platform/notifications/webhooks/verification/verify.md) - API Reference > Platform > Tasks [Get a task](https://docs.thepennyinc.com/spend-controls/api-reference/platform/tasks/get.md) - API Reference > Platform > Tasks [List tasks](https://docs.thepennyinc.com/spend-controls/api-reference/platform/tasks/list.md) - API Reference > Webhook Payloads > Business [business.created](https://docs.thepennyinc.com/spend-controls/api-reference/webhook-payloads/business/business-created-webhook.md) - API Reference > Webhook Payloads > Business [business.updated](https://docs.thepennyinc.com/spend-controls/api-reference/webhook-payloads/business/business-updated-webhook.md) - API Reference > Webhook Payloads > Business Entity [business_entity.created](https://docs.thepennyinc.com/spend-controls/api-reference/webhook-payloads/business-entity/business-entity-created-webhook.md) - API Reference > Webhook Payloads > Business Entity [business_entity.updated](https://docs.thepennyinc.com/spend-controls/api-reference/webhook-payloads/business-entity/business-entity-updated-webhook.md) - API Reference > Webhook Payloads > Business Entity [business_entity.kyb.approved](https://docs.thepennyinc.com/spend-controls/api-reference/webhook-payloads/business-entity/business-entity-kyb-approved-webhook.md) - API Reference > Webhook Payloads > Business Entity [business_entity.kyb.declined](https://docs.thepennyinc.com/spend-controls/api-reference/webhook-payloads/business-entity/business-entity-kyb-declined-webhook.md) - API Reference > Webhook Payloads > User [user.created](https://docs.thepennyinc.com/spend-controls/api-reference/webhook-payloads/user/user-created-webhook.md) - API Reference > Webhook Payloads > User [user.updated](https://docs.thepennyinc.com/spend-controls/api-reference/webhook-payloads/user/user-updated-webhook.md) - API Reference > Webhook Payloads > Account [account.created](https://docs.thepennyinc.com/spend-controls/api-reference/webhook-payloads/account/account-created-webhook.md) - API Reference > Webhook Payloads > Account [account.updated](https://docs.thepennyinc.com/spend-controls/api-reference/webhook-payloads/account/account-updated-webhook.md) - API Reference > Webhook Payloads > Account [account.deletion.initialized](https://docs.thepennyinc.com/spend-controls/api-reference/webhook-payloads/account/account-deletion-initialized-webhook.md) - API Reference > Webhook Payloads > Account [account.deletion.completed](https://docs.thepennyinc.com/spend-controls/api-reference/webhook-payloads/account/account-deletion-completed-webhook.md) - API Reference > Webhook Payloads > Account [account.low_balance_alert](https://docs.thepennyinc.com/spend-controls/api-reference/webhook-payloads/account/account-low-balance-alert-webhook.md) - API Reference > Webhook Payloads > Linked Account [linked_account.created](https://docs.thepennyinc.com/spend-controls/api-reference/webhook-payloads/linked-account/linked-account-created-webhook.md) - API Reference > Webhook Payloads > Linked Account [linked_account.updated](https://docs.thepennyinc.com/spend-controls/api-reference/webhook-payloads/linked-account/linked-account-updated-webhook.md) - API Reference > Webhook Payloads > Cardholder [cardholder.created](https://docs.thepennyinc.com/spend-controls/api-reference/webhook-payloads/cardholder/cardholder-created-webhook.md) - API Reference > Webhook Payloads > Cardholder [cardholder.updated](https://docs.thepennyinc.com/spend-controls/api-reference/webhook-payloads/cardholder/cardholder-updated-webhook.md) - API Reference > Webhook Payloads > Cardholder [cardholder.deletion.initialized](https://docs.thepennyinc.com/spend-controls/api-reference/webhook-payloads/cardholder/cardholder-deletion-initialized-webhook.md) - API Reference > Webhook Payloads > Cardholder [cardholder.deletion.completed](https://docs.thepennyinc.com/spend-controls/api-reference/webhook-payloads/cardholder/cardholder-deletion-completed-webhook.md) - API Reference > Webhook Payloads > Card [card.issued](https://docs.thepennyinc.com/spend-controls/api-reference/webhook-payloads/card/card-issued-webhook.md) - API Reference > Webhook Payloads > Card [card.updated](https://docs.thepennyinc.com/spend-controls/api-reference/webhook-payloads/card/card-updated-webhook.md) - API Reference > Webhook Payloads > Card [card.terminated](https://docs.thepennyinc.com/spend-controls/api-reference/webhook-payloads/card/card-terminated-webhook.md) - API Reference > Webhook Payloads > Card Product [card_product.created](https://docs.thepennyinc.com/spend-controls/api-reference/webhook-payloads/card-product/card-product-created-webhook.md) - API Reference > Webhook Payloads > Card Product [card_product.updated](https://docs.thepennyinc.com/spend-controls/api-reference/webhook-payloads/card-product/card-product-updated-webhook.md) - API Reference > Webhook Payloads > Spend Control [spend_control.created](https://docs.thepennyinc.com/spend-controls/api-reference/webhook-payloads/spend-control/spend-control-created-webhook.md) - API Reference > Webhook Payloads > Spend Control [spend_control.updated](https://docs.thepennyinc.com/spend-controls/api-reference/webhook-payloads/spend-control/spend-control-updated-webhook.md) - API Reference > Webhook Payloads > Spend Control [spend_control.deleted](https://docs.thepennyinc.com/spend-controls/api-reference/webhook-payloads/spend-control/spend-control-deleted-webhook.md) - API Reference > Webhook Payloads > Transaction [transaction.created](https://docs.thepennyinc.com/spend-controls/api-reference/webhook-payloads/transaction/transaction-created-webhook.md) - API Reference > Webhook Payloads > Transaction [transaction.updated](https://docs.thepennyinc.com/spend-controls/api-reference/webhook-payloads/transaction/transaction-updated-webhook.md) - API Reference > Webhook Payloads > Ledger Entry [ledger_entry.created](https://docs.thepennyinc.com/spend-controls/api-reference/webhook-payloads/ledger-entry/ledger-entry-created-webhook.md) - API Reference > Webhook Payloads > Fee [fee.created](https://docs.thepennyinc.com/spend-controls/api-reference/webhook-payloads/fee/fee-created-webhook.md) - API Reference > Webhook Payloads > Fee [fee.updated](https://docs.thepennyinc.com/spend-controls/api-reference/webhook-payloads/fee/fee-updated-webhook.md) - API Reference > Webhook Payloads > Task [task.created](https://docs.thepennyinc.com/spend-controls/api-reference/webhook-payloads/task/task-created-webhook.md) - API Reference > Webhook Payloads > Task [task.updated](https://docs.thepennyinc.com/spend-controls/api-reference/webhook-payloads/task/task-updated-webhook.md) ## OpenAPI Specification The raw OpenAPI 3.1 specification for this API is available at: - [OpenAPI JSON](https://docs.thepennyinc.com/openapi.json) - [OpenAPI YAML](https://docs.thepennyinc.com/openapi.yaml) > **Note:** This page contains both a page directory (above) and the landing page content (below). The page directory is generated for agent use and does not appear on the landing page. > For clean Markdown of any page, append .md to the page URL. > For a complete documentation index, see https://docs.thepennyinc.com/spend-controls/llms.txt. > For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.thepennyinc.com/_mcp/server. # Spend Controls A Spend Control is a named bundle of rules you can assign to a card, cardholder, account, or your whole business. One spend control can be shared across many objects: assign the same `spend_control_id` to ten cards, and updating the control updates the limit for all ten at once. Spend controls are created and managed on Penny Banking (`https://sandbox.api.thepennyinc.com`). Card and cardholder assignment endpoints are on Penny Issuing (`https://issuing.sandbox.api.thepennyinc.com`). ## Rule types Every spend control is made of one or more rules. In a request, each rule is a `rule_type` plus a typed `configuration` object whose shape depends on that type: | Rule type | Controls | | -------------------- | -------------------------------------------------------------------------------------------------------------------- | | `transaction_amount` | Minimum and/or maximum amount per transaction | | `velocity` | Count or amount limits per calendar hour, day, week, month, quarter, or year (UTC), or over the lifetime of the rule | | `merchant` | Allowed or blocked merchant IDs, merchant category codes, and merchant names | | `geographic` | Allowed or blocked merchant countries, subdivisions (states or provinces), and postal codes | | `currency` | Allowed or blocked transaction currencies | | `processing` | Allowed or blocked PAN entry modes | | `live_decisioning` | A real-time approve or decline decision from your own endpoint | Use the rule guides for configuration shapes and evaluation behavior: [Transaction Amount](/spend-controls/transaction-amount-rules), [Velocity](/spend-controls/velocity-rules), [Merchant](/spend-controls/merchant-rules), [Geographic](/spend-controls/geographic-rules), [Currency](/spend-controls/currency-rules), [Processing](/spend-controls/processing-rules), and [Live Decisioning](/spend-controls/live-decisioning-rules). See [Missing Transaction Details](/spend-controls/missing-transaction-details) for how checks behave when a required value is unavailable. Fetch the current schema and an example for every rule type before building a request: ```http GET /spend_controls/rule_types ``` ## Allowlists and denylists The `merchant`, `geographic`, `currency`, and `processing` rules use `allowlist` and `denylist` arrays. Configure one list per block: * **Allowlist only:** only the listed values pass. * **Denylist only:** every value passes except the listed ones. A value can't appear in both lists; the request is rejected. If you set both lists on the same block, the denylist governs: a value passes when it is on the allowlist or absent from the denylist, so the allowlist doesn't narrow anything further. Merchant category codes (`merchant_category_codes_rules`) are the exception: when that block has an allowlist, only the allowlist is checked and the denylist is ignored. ## Creating a spend control Each rule must explicitly list its `applicable_transaction_authorizations` and `applicable_card_issuance_modes`. See [Rule Applicability](/spend-controls/rule-applicability) for the supported values. Each `rule_type` can appear at most once in a spend control. **`POST /spend_controls/`** ```json title="POST /spend_controls/" { "rule_configs": [ { "rule_type": "transaction_amount", "applicable_transaction_authorizations": ["debit"], "applicable_card_issuance_modes": ["managed"], "configuration": { "USD": { "minimum": "10.00", "maximum": "500.00" } } }, { "rule_type": "velocity", "applicable_transaction_authorizations": ["debit"], "applicable_card_issuance_modes": ["managed"], "configuration": { "velocity_controls": { "USD": { "week": { "usage_limit": 20, "amount_limit": "2000.00" } } } } } ] } ``` ### The spend control response Responses return the control's rules in a `rules` array. Each rule has its own `rule_id`, `version`, and `version_time`, and its configuration fields appear directly on the rule object rather than inside a `configuration` wrapper. Field names differ by rule type. A `transaction_amount` rule returns its limits as `currency_amount_limits`, and a `velocity` rule returns each window's current `usage` and `balance`: **`201 Created`** ```json title="201 Created" { "spend_control_id": "spend_control_019379d9-a170-796b-867a-a17096b67a21", "version": 1, "version_time": "2026-10-01T14:05:12Z", "active": true, "status": "active", "rules": [ { "rule_id": "spend_control_rule_019370e9-c1a6-78ad-8fee-c1a68adfee20", "version": 1, "version_time": "2026-10-01T14:05:12Z", "applicable_card_issuance_modes": ["managed"], "applicable_transaction_authorizations": ["debit"], "rule_type": "transaction_amount", "currency_amount_limits": { "USD": { "minimum": "10.00", "maximum": "500.00" } } }, { "rule_id": "spend_control_rule_019370ea-2b41-7c1e-9d3a-2b417c1e9d3a", "version": 1, "version_time": "2026-10-01T14:05:12Z", "applicable_card_issuance_modes": ["managed"], "applicable_transaction_authorizations": ["debit"], "rule_type": "velocity", "velocity_controls": { "USD": { "week": { "usage": { "count": 0, "count_limit": 20, "limit_window": "week", "last_reset_time": "2026-09-28T00:00:00Z" }, "balance": { "currency": "USD", "available_balance": "2000.00", "amount_limit": "2000.00", "limit_window": "week", "last_reset_time": "2026-09-28T00:00:00Z" } } } } } ], "business_id": "business_01937b95-484e-75af-8c68-484e5afc68d3" } ``` `status` is one of `active`, `deactivated`, `deleting`, or `deleted`. Read-back field names for the other rule types: | Rule type | Response fields | | ------------------ | --------------------------------------------------------------------------- | | `merchant` | `merchant_id_rules`, `merchant_category_codes_rules`, `merchant_name_rules` | | `geographic` | `country_rules`, `subdivision_rules`, `zip_code_rules` | | `currency` | `currency_rules` | | `processing` | `pan_entry_mode_rules` | | `live_decisioning` | `notification_endpoint_id`, `fallback_result` | ## Managing a spend control All of these endpoints are on Penny Banking: | Action | Endpoint | | -------------------- | ------------------------------------------------------------- | | Create | `POST /spend_controls/` | | List | `GET /spend_controls/` | | Retrieve | `GET /spend_controls/{spend_control_id}` | | Add or replace rules | `PATCH /spend_controls/{spend_control_id}` | | Remove one rule | `DELETE /spend_controls/{spend_control_id}/rules/{rule_type}` | | Pause enforcement | `PATCH /spend_controls/{spend_control_id}/deactivate` | | Resume enforcement | `PATCH /spend_controls/{spend_control_id}/activate` | | Delete | `DELETE /spend_controls/{spend_control_id}` | `PATCH /spend_controls/{spend_control_id}` replaces each rule you send with the same `rule_type` and leaves the other rules unchanged. Deactivating a control pauses enforcement of its rules; resume enforcement with `activate`. Deleting a control removes it from every object it is assigned to. The delete response returns the control with `status: "deleting"` while removal is in progress; it then moves to `deleted` and is kept for historical reference. ## Assigning it A spend control applies once it is assigned to the object you want it to govern. Each object has at most one spend control; assigning another replaces it. | Attach to | Endpoint | API | | --------------- | -------------------------------------------------- | ------------- | | Card | `PUT /cards/{card_id}/spend_control` | Penny Issuing | | Cardholder | `PUT /cardholders/{cardholder_id}/spend_control` | Penny Issuing | | Capital Account | `PUT /accounts/capital/{account_id}/spend_control` | Penny Banking | | Control Account | `PUT /accounts/control/{account_id}/spend_control` | Penny Banking | | Business | `PUT /businesses/spend_control` | Penny Banking | Each of these accepts a body of `{ "spend_control_id": "spend_control_019379d9-a170-796b-867a-a17096b67a21" }`. Remove an assignment with the matching `DELETE` on the same path. ### Associations The associations endpoints on Penny Banking let you look up assignments from either side: | Action | Endpoint | | ----------------------------------------- | ------------------------------------------------------------ | | List the objects a control is assigned to | `GET /spend_controls/{spend_control_id}/associations` | | Get the control assigned to an object | `GET /spend_controls/associations/{associated_object_id}` | | Remove the control assigned to an object | `DELETE /spend_controls/associations/{associated_object_id}` | The list endpoint is paginated with `page_size` and `next_page_token`. Each item has `spend_control_id`, `associated_object_id`, and `associated_object_type` (`business`, `business_entity`, `program`, `account`, `cardholder`, or `card`). `GET /spend_controls/associations/{associated_object_id}` returns the full spend control. The `DELETE` returns `204 No Content`. ## Business-wide rules To apply a rule to every card, cardholder, and account in your business, such as blocking a merchant category everywhere or restricting all spend to a set of countries, attach a spend control to the business itself: **`cURL`** ```bash title="cURL" curl -X PUT https://sandbox.api.thepennyinc.com/businesses/spend_control \ -H "Authorization: Bearer $ACCESS_TOKEN" \ -H "Content-Type: application/json" \ -d '{"spend_control_id": "spend_control_019379d9-a170-796b-867a-a17096b67a21"}' ``` **`Python`** ```python title="Python" import requests requests.put( "https://sandbox.api.thepennyinc.com/businesses/spend_control", headers={"Authorization": f"Bearer {access_token}"}, json={"spend_control_id": "spend_control_019379d9-a170-796b-867a-a17096b67a21"}, ) ``` **`JavaScript`** ```javascript title="JavaScript" await fetch("https://sandbox.api.thepennyinc.com/businesses/spend_control", { method: "PUT", headers: { Authorization: `Bearer ${accessToken}`, "Content-Type": "application/json", }, body: JSON.stringify({ spend_control_id: "spend_control_019379d9-a170-796b-867a-a17096b67a21" }), }); ``` A business-wide control is checked on every authorization, alongside any control attached to the card, cardholder, or account involved. Remove it with `DELETE /businesses/spend_control`. ## Where a limit applies Spend controls can attach at several levels, and more than one can apply to a single transaction, for example a card's own limit, its cardholder's limit, and a business-wide rule. Penny checks every attached control, from the most specific level to the broadest: ``` Card → Cardholder → Control Account (if present) → Capital Account → Program → Business Entity → Business ``` When a card uses a Control Account, its attached control is checked at the narrower Control Account level, and the funding Capital Account's control is checked at the broader level. Both apply when both are attached. Without a Control Account, the Capital Account level still applies. The transaction is authorized only if it passes every rule in every applicable control. No level overrides another, so when two attached controls apply the same `rule_type` to the same transaction, such as a `transaction_amount` limit on both the card and its cardholder, each is enforced and the most restrictive one determines the outcome. A \$500 per-transaction limit on a card and a \$200 limit on its cardholder together decline anything over \$200. `live_decisioning` is the exception: it runs once per authorization, at the most specific level where a `live_decisioning` rule is attached. A `live_decisioning` rule at a broader level is skipped when a more specific level already has one. See [Live Decisioning](/platform/webhooks-live-decisioning). See [Setting Spend Controls](/spend-controls/setting-spend-controls) for a worked example of building and assigning one.