Set MCC Controls

This guide explains how to set and manage MCC account-level controls (ALCs) using these endpoints:

• Get MCC Controls
• Set Account-Level MCC Controls
• Delete Account-Level MCC Control

Consult these guides for instructions on how to design MCC controls:

• Designing Authorization Controls
• MCC Control Design

Result of following this procedure

This procedure includes instructions for achieving these results:

• Retrieval of product-level controls
• Retrieval of ALCs
• Creation of an ALC
• Modification of an ALC
• Disabling of an ALC
• Deletion of an ALC

Product-Level MCC Controls

At the time you set up your card products, Galileo helps you set up your product-level MCC controls. It is not necessary to set product-level MCC controls before setting account-level MCC controls. However, if you do have product-level MCC controls set up, you must take them into account when setting MCC controls at the account level. Consult MCC Control Design to see how product-level MCC controls affect account-level MCC controls. Remember that account-level MCC controls are applied in addition to product-level MCC controls, not instead of.

You can see the MCC blocklist and product-level controls in the GCC under MCC Blocks and in the CST. You can also retrieve existing MCC controls by calling the Get MCC Controls endpoint with these parameters:

Open the Recipes below to see sample MCC controls.

Setting MCC ALCs

👍

Tip

Verify that the controls you intend to create do not violate any of the MCC control conventions. If they do violate a convention, the endpoint will return an error.

To set one or more account-level controls, call the Set Account-Level MCC Controls endpoint with these parameters:

📘

Note

If you pass one or more MCC ranges that overlap with existing MCCs, the error message that the endpoint returns indicates only the first overlap. When you send another request, the endpoint returns the second violation only, and so on.

When creating MCC ALCs, you must also take into consideration velocity ALCs that have MCC ranges. If you attempt to create an MCC ALC that overlaps an existing velocity ALC, the endpoint returns status_code: 609-07.

Updating account-level MCC controls

In the Galileo tables that contain account-level MCCs, each control occupies a separate row, and the row is identified by the first value in the MCC range. (In database terms, it's the primary key when paired with the account number.) In the example above, the identifier for the first control is 2000, the identifier for the second control is 3000, and so on.

• When updating controls, specify the entire range in mccControls along with the new values. If the existing range is 2000–3000 and you input 2000 only, the system will change the end value of the range to 2000.
• For startDate and endDate you cannot pass a date-time in the past, even if it is the existing date-time. You should leave startDate and endDate blank unless you are changing them to the current date or to a date in the future.

Change an MCC control

To update the values in an existing, unexpired control, call the Set Account-Level MCC Controls endpoint with these parameters:

• accountNo: PRN of the account
• startDate: Leave blank to maintain the same value or pass a new date.
• endDate: Leave blank to maintain the same value or pass a new date.
• mccControls: Specify the entire range of the control to update: ['2000-2500'] or ['5555'].
• allowDeny: Leave blank. This value cannot be changed.
• onlineOnly: Leave blank to maintain the same value or pass Y or N to change it.

For example, to change the online-only property of the first and third controls in the table above to Y, call Set Account-Level MCC Controls with these values:

• mccControls: ['2000', '3580-4000']
• onlineOnly: Y

Change the timespan

To change the start and end dates on the fourth control to include all of January 2025, call Set Account-Level MCC Controls with these values:

• mccControls: ['5555']
• startDate: 2025-01-01 00:00:00
• endDate: 2025-01-31 23:59:59

Change the MCC range

To change the third control to include the 3580–4025 range, call Set Account-Level MCC Controls with these values:

• mccControls: ['3580-4025']

To change the second range to 2800–3500—which affects the beginning MCC value—you have two options:

• Create a second control for 2800–2999.
• Delete the original ALC, and then set a new control for 2800–3500.

Disable an account-level MCC control

To disable an account-level MCC control without deleting it, set endDate to the current date-time.

Reactivate a disabled MCC control

To reactivate a disabled MCC control, call the Set Account-Level MCC Controls endpoint with these parameters:

• accountNo: PRN of the account
• startDate: Pass the current time or a future date no more than six months in the future.
• endDate: Pass a time that is later than startDate.
• mccControls: Specify the entire range of the control to update: ['2000-2500'] or ['5555'].
• allowDeny: Leave blank.
• onlineOnly: Leave blank or pass a new value.

Deleting an MCC control

To delete an MCC control from the database, call Delete Account-Level MCC Control with these parameters:

• accountNo: PRN of the account. Do not use PAN or CAD.
• beginMccControl: First MCC in the range
• endMccControl: Last MCC in the range

Inputting multiple values

For the mccControls parameter in Set Account-Level MCC Control, you can input multiple MCCs or MCC ranges.

You have two options to input multiple values: repeat the parameter or use a JSON list. Each option requires a different Content-Type header.

Repeated parameter

For this method, specify Content-Type: application/x-www-form-urlencoded in the header. In the body of the request, pass one parameter/value pair for each value. For example:

POST /intserv/4.0/[endpoint] HTTP/1.1
Host: [URL]
response-content-type: json
Content-Type: application/x-www-form-urlencoded
Content-Length: 174

apiLogin=[redacted]&apiTransKey=[redacted]&providerId=19&transactionId=45d7ecbd-3e53-4a69-8971-af3bbaf17956&groupId=1001&param1=777777777777&param1=888888888888

JSON list

For this method, specify Content-Type: application/json in the header. In the body of the request, specify the values as a JSON list. For example:

POST /intserv/4.0/[endpoint] HTTP/1.1
Host: [URL]
response-content-type: json
Content-Type: application/json
Content-Length: 179

{
    "apiLogin": [redacted],
    "apiTransKey": [redacted],
    "providerId": "19",
    "transactionId": "d3914a0b-ce55-4d95-9926-2c8f3a3a9f10",
    "param1": ["1", "2", "5"]
}

When you pass multiple MCC ranges in a single endpoint call, the system creates a separate control for every range or single MCC. For example, if you pass these values, the system creates four controls:

• accountNo: PRN
• allowDeny: a
• onlineOnly: N
• mccControls: ['2000', '3000-3500', '3580-4000', '5555']

All four of these controls have the same properties for start and end dates as well, because you called Set Account-Level MCC Control only once.