Set Merchant ID Controls

This guide explains how to set and manage merchant ID account-level controls (ALCs) using these endpoints:

• Get Merchant Controls
• Set Account-Level Merchant Control
• Delete Account-Level Merchant Control

Consult these guides for instructions on how to design merchant ID controls:

• Designing Authorization Controls
• Merchant ID Control Design

Result of following this procedure

This procedure includes instructions for achieving these results:

• Retrieval of product-level controls
• Retrieval of ALCs
• Creation of an ALC
• Modification of an ALC
• Disabling of an ALC
• Deletion of an ALC

Merchant ID controls

A merchant ID (MID) is a string that uniquely identifies a point of sale. MIDs have a maximum of 15 characters. They are usually all numeric but some contain letters. Go to Merchant ID Control Design for more information.

Account-level MID controls exist independently of the product-level MID controls. If no product-level MID controls exist, you can still set MID controls, and they can overlap MCC controls and other MID controls.

Because a DENY MID ALC can contradict MCC controls, it is not necessary to retrieve the MCC controls before setting a DENY MID ALC. However, the MCC blocklist will override any MID controls you set.

You can see existing MID controls in the GCC and CST, and you can retrieve them by calling the Get Merchant Controls endpoint with one of these parameters:

• accountNo: Populate to get the account-level MID controls.
• prodId: Populate to get the product-level MID controls.

Open the Recipes below for example responses.

Setting account-level merchant ID controls

👍

Tip

Verify that the controls you intend to create do not violate any of the Merchant ID control conventions. If they do violate a convention, the endpoint will return an error.

To set an account-level merchant ID control, call Set Account-Level Merchant Control with these parameters:

To set another merchant ID control, repeat the procedure to add to the list of MID controls. The additional MID controls can be either ALLOW or DENY.

Updating account-level MID controls

When updating an MID control, you cannot pass a date-time in the past, even if it is the existing date-time. You should leave startDate and endDate blank unless you are changing them to the current date or to a date in the future. See Setting time limits in _Setting ALCs for more information.

Change ALLOW to DENY

If you already have an account-level MID control for 55555555555555 ALLOW, for example, and you want to deny that merchant ID from now on, you have two options:

• If the MCC controls already deny that merchant's MCC, you can expire (disable) or delete the MID control, and the merchant will be blocked by the MCC controls.
• If the MCC controls allow that merchant's MCC, update the existing control to allowDeny: d.

To update an existing, unexpired account-level MID control, call Set Account-Level Merchant Control with these parameters:

• accountNo: PRN of the account. Do not use PAN or CAD.
• startDate: Leave blank to keep the current value or pass a new value. Must be earlier than endDate.
• endDate: Leave blank to keep the current value or specify a new date that is later than startDate.
• merchantId: Pass the same merchant ID that the existing control has. If you pass a new value, a new MID control will be created. As needed, call Get Merchant Controls to get the ID.
• allowDeny: Leave blank to keep the current value or pass a for ALLOW or d for DENY.

Disable an account-level MID control

To disable an MID control without deleting it, you expire it. Follow the steps to update the control and set endDate to the current date-time.

Reactivate an account-level MID control

To reactivate an expired MID control, call Set Account-Level Merchant Control with these parameters:

• accountNo: PRN of the account. Do not use PAN or CAD.
• startDate: Pass a time up to six months in the future. Must be earlier than endDate.
• endDate: Specify a date that is later than startDate.
• merchantId: Pass the same merchant ID that the existing control has. As needed, call Get Merchant Controls to get the ID.
• allowDeny: Leave blank or pass a new value to change it.

Deleting an account-level MID control

To delete an MID control from the database, call Delete Account-Level Merchant Control with these parameters:

• accountNo: PRN of the account. Do not use PAN or CAD.
• merchantId: The merchant ID