Restrict account

Relevant webhooks

For this endpoint be sure you have registered for these webhooks:

Core.Restriction.Placed

API reference

Restricts an account from defined transactions.

A restriction is a flexible way to prevent transactions that contain certain criteria from posting to an account. This is useful in scenarios such as freezing an account that has been compromised.

To restrict all subaccounts of a master account, set appliesTo to SubAccounts and do not supply a value for subAccountNumber.

To restrict a master account together with all its subaccounts, set appliesTo to All and do not supply a value for subAccountNumber.

Payments that fail to post to a Cross River account and are returned will not be visible to you.

Endpoint: v1/dda/accounts/{accountNumber}/restrictions

POST

https://sandbox.crbcos.com/core/v1/dda/accounts/{accountNumber}/restrictions

Path Parameters

accountNumberstringrequired
Description
Number of the customer's master account to be restricted, even if you are restricting a subaccount

Body Parameters

subAccountNumberstring
Description
If restricting a specific subaccount, that account number
appliesTostringrequired
Description
Depending on the restriction you apply: - All (applies to both a master account and the subaccounts under it) - Account - SubAccounts
railstring
Description
Indicates if the restriction should apply to a specific rail. The most commonly used values are 'Ach', 'Wires', and 'Rtp'. - Ach - Wires - CreditCard - DebitCard - StoredValue - Checks - XPay - Rtp - Crypto - CardManagement - International - CardPayments - Internal
transactionTypestring
Description
Type of transaction to be restricted: - Debit - Credit
otherAccountTypestring
Description
Do not use.
amountThresholdinteger
Description
Specifies an amount threshold. The restriction applies to any transaction amount that is equal to or greater than the amount entered. This value is in integral cents, meaning the number includes cents, with no decimal point. For example, 100 USD appears as 10000.
currencystring
Description
Currency used in the transaction
transactionCodestring
Description
Indicates a specific transaction code, such as ‘Incoming ACH’
effectiveStartTimeHourinteger
Description
Indicates the approximate start hour of the restriction. Use a 24-hour clock.
effectiveStartTimeMinuteinteger
Description
Indicates the approximate start minute of the restriction
effectiveEndTimeHourinteger
Description
Indicates the approximate end hour of the restriction. Use a 24-hour clock.
effectiveEndTimeMinuteinteger
Description
Indicates the approximate end minute of the restriction
reasonstringrequired
Description
Justification for applying the restriction
notesstring
Description
Any other information about the restriction. Generally not used.

Response

idstring
Description
The GUID ID identifying this restriction
masterAccountNumberstring
Description
Number of the customer master account to be restricted, even if the restriction is only on a subaccount or subaccounts
subAccountNumberstring
Description
If restricting a specific subaccount, that account number
restrictionTypestring
Description
Who applied the restriction: - Partner - Internal
appliesTostring
Description
Depending on the restriction you apply: - All - Account - SubAccounts
statusstring
Description
Status of the restriction: - Inactive - Active
railstring
Description
Type of restriction applied: - Ach - Wires - CreditCard - DebitCard - StoredValue - Checks - XPay - Rtp - Crypto - CardManagement - International - CardPayments - Internal
transactionTypestring
Description
Type of transaction restricted: - Debit - Credit
otherAccountTypestring
Description
Not used
transactionCodestring
Description
Indicates a specific transaction code, such as ‘Incoming ACH’
amountThresholdinteger
Description
Specifies an amount threshold. The restriction applies to any transaction amount that is equal to or greater than the amount entered. This value is in integral cents, meaning the number includes cents, with no decimal point. For example, 100 USD appears as 10000.
effectiveStartTimeHourinteger
Description
Indicates the approximate start hour of the restriction. Use a 24-hour clock.
effectiveStartTimeMinuteinteger
Description
Indicates the approximate start minute of the restriction
effectiveEndTimeHourinteger
Description
Indicates the approximate end hour of the restriction. Use a 24-hour clock.
effectiveEndTimeMinuteinteger
Description
Indicates the approximate end minute of the restriction
currencystring
Description
Currency held in the account
reasonstring
Description
Justification for applying the restriction
notesstring
Description
Any other information about the restriction. Generally not used.
createdAtstring
Description
Restriction created. In this case, the date and time are in this format: yyyy-mm-ddThh:mm:ss[.mmm]
removedAtstring
Description
Restriction removed. In this case, the date and time are in this format: yyyy-mm-ddThh:mm:ss[.mmm]
partnerIdstring
Description
Your unique ID in the Cross River system. This ID is in GUID format.
lastModifiedAtstring
Description
Internal Cross River value. Date and time the database entry was last modified. In this case, the date and time are in this format: yyyy-mm-ddThh:mm:ss[.mmm]

curl

curl --location --globoff 'https://sandbox.crbcos.com/core/v1/dda/accounts/2394312736/restrictions' \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '{
  "transactionCode": "Incoming ACH",
  "transactionType": "Debit",
  "appliesTo": "Account",
  "reason": "Account Freeze"
}'

nodejs

var https = require('follow-redirects').https;
var fs = require('fs');

var options = {
  'method': 'POST',
  'hostname': 'sandbox.crbcos.com',
  'path': '/core/v1/dda/accounts/2394312736/restrictions',
  'headers': {
    'Authorization': 'Bearer <token>',
    'Content-Type': 'application/json'
  },
  'maxRedirects': 20
};

var req = https.request(options, function (res) {
  var chunks = [];

  res.on("data", function (chunk) {
    chunks.push(chunk);
  });

  res.on("end", function (chunk) {
    var body = Buffer.concat(chunks);
    console.log(body.toString());
  });

  res.on("error", function (error) {
    console.error(error);
  });
});

var postData =  "{\r\n  \"transactionCode\": \"Incoming ACH\",\r\n  \"transactionType\": \"Debit\",\r\n  \"appliesTo\": \"Account\",\r\n  \"reason\": \"Account Freeze\"\r\n}";

req.write(postData);

req.end();

python

import http.client

conn = http.client.HTTPSConnection("sandbox.crbcos.com")
payload = "{\r\n  \"transactionCode\": \"Incoming ACH\",\r\n  \"transactionType\": \"Debit\",\r\n  \"appliesTo\": \"Account\",\r\n  \"reason\": \"Account Freeze\"\r\n}"
headers = {
  'Authorization': 'Bearer <token>',
  'Content-Type': 'application/json'
}
conn.request("POST", "/core/v1/dda/accounts/2394312736/restrictions", payload, headers)
res = conn.getresponse()
data = res.read()
print(data.decode("utf-8"))

ruby

require "uri"
require "net/http"

url = URI("https://sandbox.crbcos.com/core/v1/dda/accounts/2394312736/restrictions")

https = Net::HTTP.new(url.host, url.port)
https.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Authorization"] = "Bearer <token>"
request["Content-Type"] = "application/json"
request.body = "{\r\n  \"transactionCode\": \"Incoming ACH\",\r\n  \"transactionType\": \"Debit\",\r\n  \"appliesTo\": \"Account\",\r\n  \"reason\": \"Account Freeze\"\r\n}"

response = https.request(request)
puts response.read_body

package main

import (
  "fmt"
  "strings"
  "net/http"
  "io"
)

func main() {

  url := "https://sandbox.crbcos.com/core/v1/dda/accounts/2394312736/restrictions"
  method := "POST"

  payload := strings.NewReader(`{
  "transactionCode": "Incoming ACH",
  "transactionType": "Debit",
  "appliesTo": "Account",
  "reason": "Account Freeze"
}`)

  client := &http.Client {
  }
  req, err := http.NewRequest(method, url, payload)

  if err != nil {
    fmt.Println(err)
    return
  }
  req.Header.Add("Authorization", "Bearer <token>")
  req.Header.Add("Content-Type", "application/json")

  res, err := client.Do(req)
  if err != nil {
    fmt.Println(err)
    return
  }
  defer res.Body.Close()

  body, err := io.ReadAll(res.Body)
  if err != nil {
    fmt.Println(err)
    return
  }
  fmt.Println(string(body))
}

200

{
    "id": "51d73b46-ef2a-4a52-b174-b32f00949088",
    "masterAccountNumber": "2394312736",
    "subAccountNumber": "2394312736",
    "restrictionType": "Internal",
    "appliesTo": "Account",
    "status": "Active",
    "transactionType": "Debit",
    "transactionCode": "Incoming ACH",
    "reason": "Account Freeze",
    "createdAt": "2025-08-04T05:00:54.4238173-04:00",
    "partnerId": "cd9c12f4-7691-424a-b38b-af5b0134c611",
    "lastModifiedAt": "2025-08-04T05:00:54.4238173-04:00"
}