Permissions and restrictions
Turn individual capabilities on and off for a card — e-commerce, international use, mail order and other miscellaneous options.
Where this is used
Implemented on 4 programmes. A capability is one business idea, built once per card programme, so these are the programmes it applies to.
- 4 operationsCredit Digital Channels Integration APIOpen this capability’s operations in the reference.
- 5 operationsDebit Digital Channels Integration APIOpen this capability’s operations in the reference.
- 2 operationsPrepaid Digital Channels Integration APIOpen this capability’s operations in the reference.
- 1 operationsCommon MethodsOpen this capability’s operations in the reference.
Journeys that walk through it
Guides about it
- Debit card issuing, end to endCreate the card, get it to the cardholder, then run it — the three stages of a debit programme in the order you call them.
- Change Approval StructureMulti-level approval workflows for critical operations with role-based authorization and complete audit trail.
How this behaves
The API says permission; the table stores restriction
The value you send is inverted on the way in: a permission set to true removes the restriction row, and one set to false creates it. The two vocabularies describe the same fact from opposite ends, and only one of them is on the wire.
The response counts the rows that actually changed. Sending a permission that already holds that value returns a count of zero and produces no record id — which is the correct behaviour and the one most often read as a failure.
A restriction code must exist in the definition table, and that table — not the column the value is stored in — is what bounds its length. A four-character code fits the storage column on credit and can never be defined, so it is refused before it reaches one. Each row may also carry a start and an end date, which is how a temporary permission is expressed.
Operations
credit-digital-channels-integration
/credit/api/getCardPermissions
Retrieves current permission settings for a card.
POST/credit/api/saveCardPermissions
Updates card permissions.
POST/credit/api/changeCardMiscOption
Retrieves and updates miscellaneous card options.
POST/credit/api/getCardMiscOption
Retrieves and updates miscellaneous card options.
debit-digital-channels-integration
/debit/api/getCardPermissions
Retrieves all permission and restriction settings for a card, showing what transaction types and channels are permitted or blocked.
POST/debit/api/saveCardPermissions
Updates card permissions and restrictions, enabling or disabling specific transaction capabilities.
POST/debit/api/saveCardBnplPermission
Saves or updates Buy Now Pay Later (BNPL) permissions for a card. Accepts card reference number, channel, and BNPL permission details to enable or disable BNPL features on the card.
POST/debit/api/changeCardMiscOption
Manages miscellaneous card options that don't fit into standard categories (permissions, limits, etc.).
POST/debit/api/getCardMiscOption
Manages miscellaneous card options that don't fit into standard categories (permissions, limits, etc.).
prepaid-digital-channels-integration