Apply an MCC allow list

POST/api/v1/credit/programs/{program_id}/mcc-allowlist/apply

Writes codes as the program's allowed_mcc_codes, pushes the restriction to every live DayZero-managed card on the program's lines (as the Ramp categories the MCCs fall under), and records the source and, for an upload, the file's SHA-256 in the audit log. A card the issuer refuses is reported in cards and does not undo the list. codes: [] with unrestricted: true clears the list as a recorded decision. Operator action.

Operation ID: credit_mcc_allowlist_apply·View as markdown·OpenAPI slice

Authentication

Bearer token authentication. Pass your DayZero API token in the Authorization header and the target business UUID in x-business-id.

Parameters

Path

program_idstringrequired

Request body

Schema: MccAllowlistApplyRequest

codesarray · string

The allow list: four-digit MCCs. Duplicates are dropped and the list is stored sorted. Empty only with unrestricted: true.

sourcestringrequired

Where the list came from: the preview source it was chosen in, or manual for a list typed or edited by hand.

One of: upload, settlements, preset, manual

file_sha256string

Required with source: upload: the file_sha256 the preview returned. Not accepted with any other source.

unrestrictedboolean

Send true with empty codes to clear the allow list on purpose. Recorded as a decision, so the program reads as deliberately unrestricted rather than never set.

Responses

201Successful Response

Schema: SuccessEnvelope_MccAllowlistApplyResponse_

successboolean
messagestring
codestring
dataMccAllowlistApplyResponse

400Bad Request - Invalid input

Schema: ErrorResponse

errorstringrequired: Error category: validation_error, unauthorized, forbidden, not_found, conflict, rate_limited, server_error, or service_unavailable.
messagestringrequired: Human-readable explanation, safe to show to end users.
codestringrequired: Stable machine-readable code in CATEGORY_NNN form (e.g. NOT_FOUND_006, AUTH_010, GEN_002).
request_idstring: Correlation id for support requests. Echoes the x-request-id request header when one was supplied.
errorsobject: Field-level validation messages keyed by field name. Present on 400/422 validation failures only.

401Unauthorized - Missing or expired token, an MCP OAuth token used against the REST API, or no access to this business

Schema: ErrorResponse

errorstringrequired: Error category: validation_error, unauthorized, forbidden, not_found, conflict, rate_limited, server_error, or service_unavailable.
messagestringrequired: Human-readable explanation, safe to show to end users.
codestringrequired: Stable machine-readable code in CATEGORY_NNN form (e.g. NOT_FOUND_006, AUTH_010, GEN_002).
request_idstring: Correlation id for support requests. Echoes the x-request-id request header when one was supplied.
errorsobject: Field-level validation messages keyed by field name. Present on 400/422 validation failures only.

403Forbidden - Insufficient permissions

Schema: ErrorResponse

errorstringrequired: Error category: validation_error, unauthorized, forbidden, not_found, conflict, rate_limited, server_error, or service_unavailable.
messagestringrequired: Human-readable explanation, safe to show to end users.
codestringrequired: Stable machine-readable code in CATEGORY_NNN form (e.g. NOT_FOUND_006, AUTH_010, GEN_002).
request_idstring: Correlation id for support requests. Echoes the x-request-id request header when one was supplied.
errorsobject: Field-level validation messages keyed by field name. Present on 400/422 validation failures only.

404Not Found - Resource does not exist

Schema: ErrorResponse

errorstringrequired: Error category: validation_error, unauthorized, forbidden, not_found, conflict, rate_limited, server_error, or service_unavailable.
messagestringrequired: Human-readable explanation, safe to show to end users.
codestringrequired: Stable machine-readable code in CATEGORY_NNN form (e.g. NOT_FOUND_006, AUTH_010, GEN_002).
request_idstring: Correlation id for support requests. Echoes the x-request-id request header when one was supplied.
errorsobject: Field-level validation messages keyed by field name. Present on 400/422 validation failures only.

422Validation Error

Schema: ErrorResponse

errorstringrequired: Error category: validation_error, unauthorized, forbidden, not_found, conflict, rate_limited, server_error, or service_unavailable.
messagestringrequired: Human-readable explanation, safe to show to end users.
codestringrequired: Stable machine-readable code in CATEGORY_NNN form (e.g. NOT_FOUND_006, AUTH_010, GEN_002).
request_idstring: Correlation id for support requests. Echoes the x-request-id request header when one was supplied.
errorsobject: Field-level validation messages keyed by field name. Present on 400/422 validation failures only.

Code samples

POST/api/v1/credit/programs/{program_id}/mcc-allowlist/apply

bash

curl -X POST 'https://api.ondayzero.com/api/v1/credit/programs/{program_id}/mcc-allowlist/apply' \
  -H 'Authorization: Bearer dz_your_token' \
  -H 'x-business-id: YOUR_BUSINESS_ID' \
  -H 'Content-Type: application/json' \
  -d '{
  "source": "upload"
}'