# Authorization controls

Authorization controls allow you to specify rules around how and where the cards you issue may be used. You can specify them at the time of creating a new card or later when you update the card.

Choose authorization controls that best suit your needs. Note that some are mandatory.

> **\[INFORMATIONAL]**
>
> The [List all Cards](/api/issuing/cards/list) endpoint returns a subset of card fields and does **not** include `authorization_controls`. To read a card's authorization controls, fetch the card individually with [Retrieve a Card](/api/issuing/cards/retrieve).

| Scenario                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  | Recommended authorization control | API Endpoints > Field                                                                                                                                           |
| ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Specify whether the card is a  or  use card.  This control is mandatory, and once specified, the value cannot be modified later. Single-use cards can only be used for one successful debit transaction.                                                                                                                                                                                                                                                                                  | Transaction count                 | [Create a card](/api/issuing/cards/create) > `authorization_controls.allowed_transaction_count`                                                                 |
| Specify the currencies that can be used to process transactions on the card. If you do not specify this field, all currencies will be allowed.                                                                                                                                                                                                                                                                                                                                            | Currency                          | [Create a card](/api/issuing/cards/create)/[Update a card](/api/issuing/cards/update) > `authorization_controls.allowed_currencies`                             |
| Specify the allowed merchant categories codes for the card.  Merchant Category Code (MCC) is a unique identifier for the type of goods or services provided by merchants. If you do not specify this field, all merchant categories will be allowed. See [list of merchant category codes](https://www.visa.com.au/dam/VCOM/download/merchants/visa-merchant-data-standards-manual.pdf) in the ISO 18245 standard.                                                                        | Merchant category code            | [Create a card](/api/issuing/cards/create)/[Update a card](/api/issuing/cards/update) > `authorization_controls.allowed_merchant_categories`                    |
| Specify the activity range for the card. Authorizations before and after the time period will be rejected.                                                                                                                                                                                                                                                                                                                                                                                | Time period                       | [Create a card](/api/issuing/cards/create)/[Update a card](/api/issuing/cards/update) > `authorization_controls.active_from`/`authorization_controls.active_to` |
| Specify transaction limits for the card based on amount and intervals. This control is mandatory. You can configure multiple transaction limits based on a single currency. For more information, see [Transaction limits](https://www.airwallex.com/docs/issuing/card-controls/authorization-controls/transaction-limits.md)                                                                                                                                                             | Transaction limit                 | [Create a card](/api/issuing/cards/create)/[Update a card](/api/issuing/cards/update) > `authorization_controls.transaction_limits`                             |
| Get notified when a card's remaining spending limit falls below a threshold. Configure alert thresholds and subscribe to webhooks so you can proactively top up or adjust limits. For more information, see [Alert thresholds for transaction limits](https://www.airwallex.com/docs/issuing/card-controls/authorization-controls/alert-thresholds-for-transaction-limits.md).                                                                                                            | Alert threshold                   | [Create a card](/api/issuing/cards/create)/[Update a card](/api/issuing/cards/update) > `alert_settings`                                                        |
| Specify transaction and usage scopes to block on the card. If you do not specify this field, all transaction types will be allowed across all usage scopes. You can combine transaction types (like online, contactless, or ATM withdrawals) with usage scopes (domestic or international) to create granular controls. When multiple rules overlap, the most restrictive scope will apply. Some countries will have default blocked transaction usage scopes due to regulatory reasons.  | Transaction usage                 | [Create a card](/api/issuing/cards/create)/[Update a card](/api/issuing/cards/update) > `authorization_controls.blocked_transaction_usages`                     |
| Configure advanced authorization control where the authorization request from the merchant’s bank is sent to the customer's nominated endpoint and the customer can decline or accept the authorization based on their own fraud rules.  For more information, see [Remote authorization](https://www.airwallex.com/docs/issuing/card-controls/remote-authorization.md).                                                                                                                  | Remote authorization              | [Get issuing config](/api/issuing/config/retrieve)/[Update issuing config](/api/issuing/config/update) > `remote_auth` object                                   |