Manage account restrictions

what you will learn ✅ how restriction an account from defined transactions ✅ h ow to remove a restriction the tutorial assumes you have a knowledge of apis and how they work refer to api basics docid\ puttcwq5sklzxyzin5d1b for more details the tutorial uses these api endpoints api description post /core/v1/dda/accounts/{accountnumber}/restrictions docid\ eickx6djcuo3cryrih8mp restricts an account from defined transactions delete /core/v1/dda/accounts/{accountnumber}/restrictions/{id} docid\ qxdrgzjupefeuxz6okfob removed restrictions applied to an account before you begin make sure you have api credentials docid\ wmg 1fqwq3bj d3c3hffs account number of the account or subaccount to apply the restriction to registered docid\ bn5xtgkjogbe ctwomcbs the following webhook events webhook description core restriction placed restriction was placed on the account core restriction removed restriction was removed for the account r estrict an account a restriction is a flexible way to prevent transactions with defined criteria from posting to an account, such as a daily transaction limit or disallowing certain payment rails this is useful in scenarios such as freezing an account that has been compromised you can restrict a single master account or subaccount all subaccounts but not their master account a master account and all its subaccounts the appliesto attribute defines what account or accounts are being restricted single account set appliesto to account only supply a value for subaccountnumber to restrict a subaccount all subaccounts, but not master account set appliesto to subaccounts and do not supply a value for subaccountnumber master account and all subaccounts set appliesto to all and do not supply a value for subaccountnumber in this tutorial we restrict a single subaccount, limiting outbound wire transactions to 501 usd or less to r estrict an account call post /core/v1/dda/accounts/{accountnumber}/restrictions even though we are restricting a subaccount, the accountnumber in the path must be the master account number 2662824164 other required fields appliesto account reason test the subaccount to be restricted is subaccountnumber 394434993538 the rail to limit is wires and the amountthreshold is 50100 (501 usd) these fields are optional, but necessary to apply a specific restriction sample request curl location 'https //sandbox crbcos com/core/v1/dda/accounts/2662824164/restrictions' \\ \ header 'content type application/json' \\ \ header 'authorization bearer \<token>' \\ \ header 'cookie \<cookie>' \\ \ data '{ "subaccountnumber" "394434993538", "appliesto" "account", "rail" "wires", "transactiontype" "debit", "amountthreshold" 50100, "reason" "test" }' a successful api calls returns a json response with the restriction details the id field contains the restriction id, needed to remove the restriction 5daef208 0048 4e93 b5ae b4b000741ebd sample response { "id" "5daef208 0048 4e93 b5ae b4b000741ebd", "masteraccountnumber" "2662824164", "subaccountnumber" "394434993538", "restrictiontype" "internal", "appliesto" "account", "status" "active", "rail" "wires", "transactiontype" "debit", "amountthreshold" 50100, "currency" "usd", "reason" "test", "createdat" "2026 08 24t03 02 46 8173672 04 00", "partnerid" "cd9c12f4 7691 424a b38b af5b0134c611", "lastmodifiedat" "2026 08 24t03 02 46 8173987 04 00" } the core restriction placed webhook event fires when t he restriction is applied the restriction id, 5daef208 0048 4e93 b5ae b4b000741ebd , appears in the event payload sample webhook event { "id" "b5ae9558 a052 4e42 9056 b4b0007429db", "eventname" "core restriction placed", "status" "pending", "partnerid" "cd9c12f4 7691 424a b38b af5b0134c611", "createdat" "2026 08 24t03 02 56 307 04 00", "resources" \[ "core/v1/dda/accounts/2662824164/restrictions/5daef208 0048 4e93 b5ae b4b000741ebd" ], "details" \[ { "restrictionid" "5daef208 0048 4e93 b5ae b4b000741ebd", "subaccountnumber" "394434993538", "masteraccountnumber" "2662824164", "accounttype" "deposit", "status" "active", "amountthreshold" "50100", "currency" "usd", "rail" "wires", "transactioncode" null, "transactiontype" "debit" } ] } to c ancel the restriction call delete /core/v1/dda/accounts/{accountnumber}/restrictions/{id} even though we are removing the restriction on a subaccount, the accountnumber in the path must be the master account number 2662824164 the id is the restriction id we saw earlier 5daef208 0048 4e93 b5ae b4b000741ebd sample request curl location request delete 'https //sandbox crbcos com/core/v1/dda/accounts/2662824164/restrictions/5daef208 0048 4e93 b5ae b4b000741ebd' \\ \ header 'authorization bearer \<token>' \\ \ header 'cookie \<cookie>' a successful api calls returns a json response with the restriction details the id field contains the same restriction id 5daef208 0048 4e93 b5ae b4b000741ebd sample response { "id" "5daef208 0048 4e93 b5ae b4b000741ebd", "masteraccountnumber" "2662824164", "subaccountnumber" "394434993538", "restrictiontype" "internal", "appliesto" "account", "status" "inactive", "rail" "wires", "transactiontype" "debit", "amountthreshold" 50100, "currency" "usd", "reason" "test", "createdat" "2026 08 24t03 02 46 817 04 00", "removedat" "2026 08 24t03 05 08 4627259 04 00", "partnerid" "cd9c12f4 7691 424a b38b af5b0134c611", "lastmodifiedat" "2026 08 24t03 02 46 8173987 04 00" } the core restriction removed webhook event fires when when t he restriction is removed the restriction id, 5daef208 0048 4e93 b5ae b4b000741ebd , appears in the event payload sample webhook event { "id" "c343ae45 df07 40b3 b2af b4b00074d9d3", "eventname" "core restriction removed", "status" "pending", "partnerid" "cd9c12f4 7691 424a b38b af5b0134c611", "createdat" "2026 08 24t03 05 26 47 04 00", "resources" \[ "core/v1/dda/accounts/2662824164/restrictions/5daef208 0048 4e93 b5ae b4b000741ebd" ], "details" \[ { "restrictionid" "5daef208 0048 4e93 b5ae b4b000741ebd", "subaccountnumber" "394434993538", "masteraccountnumber" "2662824164", "accounttype" "deposit", "status" "inactive", "amountthreshold" "50100", "currency" "usd", "rail" "wires", "transactioncode" null, "transactiontype" "debit" } ] }