Manage account restrictions
What you will learn
✅ How restriction an account from defined transactions
✅ How to remove a restriction
The tutorial assumes you have a knowledge of APIs and how they work. Refer to API basics for more details.
The tutorial uses these API endpoints:
API | Description |
|---|---|
Restricts an account from defined transactions | |
Removed restrictions applied to an account |
Before you begin
Make sure you have:
- Account number of the account or subaccount to apply the restriction to
- Registered the following webhook events:
Webhook | Description |
|---|---|
Core.Restriction.Placed | Restriction was placed on the account |
Core.Restriction.Removed | Restriction was removed for the account |
Restrict an account
A restriction is a flexible way to prevent transactions with defined criteria from posting to an account, such as a daily transaction limit or disallowing certain payment rails . This is useful in scenarios such as freezing an account that has been compromised.
You can restrict:
- A single master account or subaccount
- All subaccounts but not their master account
- A master account and all its subaccounts
The appliesTo attribute defines what account or accounts are being restricted.
- Single account Set appliesTo to Account. Only supply a value for subAccountNumber to restrict a subaccount.
- All subaccounts, but not master account Set appliesTo to SubAccounts and do not supply a value for subAccountNumber
- Master account and all subaccounts Set appliesTo to All and do not supply a value for subAccountNumber.
In this tutorial we restrict a single subaccount, limiting outbound wire transactions to 501 USD or less.
To restrict an account
Call POST /core/v1/dda/accounts/{accountNumber}/restrictions.
Even though we are restricting a subaccount, the accountNumber in the path must be the master account number: 2662824164.
Other required fields:
- appliesTo: Account
- reason: test
The subaccount to be restricted is subAccountNumber: 394434993538.
The rail to limit is Wires and the amountThreshold is 50100 (501 USD). These fields are optional, but necessary to apply a specific restriction.
curl --location 'https://sandbox.crbcos.com/core/v1/dda/accounts/2662824164/restrictions' \
--header 'Content-Type: application/json' \
--header 'Authorization: Bearer <token>' \
--header 'Cookie: <cookie>' \
--data '{
"subAccountNumber": "394434993538",
"appliesTo": "Account",
"rail": "Wires",
"transactionType": "Debit",
"amountThreshold": 50100,
"reason": "test"
}'A successful API calls returns a JSON response with the restriction details. The id field contains the restriction ID, needed to remove the restriction: 5daef208-0048-4e93-b5ae-b4b000741ebd.
{
"id": "5daef208-0048-4e93-b5ae-b4b000741ebd",
"masterAccountNumber": "2662824164",
"subAccountNumber": "394434993538",
"restrictionType": "Internal",
"appliesTo": "Account",
"status": "Active",
"rail": "Wires",
"transactionType": "Debit",
"amountThreshold": 50100,
"currency": "usd",
"reason": "test",
"createdAt": "2026-08-24T03:02:46.8173672-04:00",
"partnerId": "cd9c12f4-7691-424a-b38b-af5b0134c611",
"lastModifiedAt": "2026-08-24T03:02:46.8173987-04:00"
}The Core.Restriction.Placedwebhook event fires when the restriction is applied. The restriction ID, 5daef208-0048-4e93-b5ae-b4b000741ebd, appears in the event payload.
{
"id": "b5ae9558-a052-4e42-9056-b4b0007429db",
"eventName": "Core.Restriction.Placed",
"status": "Pending",
"partnerId": "cd9c12f4-7691-424a-b38b-af5b0134c611",
"createdAt": "2026-08-24T03:02:56.307-04:00",
"resources": [
"core/v1/dda/accounts/2662824164/restrictions/5daef208-0048-4e93-b5ae-b4b000741ebd"
],
"details": [
{
"restrictionId": "5daef208-0048-4e93-b5ae-b4b000741ebd",
"subAccountNumber": "394434993538",
"masterAccountNumber": "2662824164",
"accountType": "Deposit",
"status": "Active",
"amountThreshold": "50100",
"currency": "usd",
"rail": "Wires",
"transactionCode": null,
"transactionType": "Debit"
}
]
}To cancel the restriction
Call DELETE /core/v1/dda/accounts/{accountNumber}/restrictions/{id}.
Even though we are removing the restriction on a subaccount, the accountNumber in the path must be the master account number: 2662824164.
The id is the restriction ID we saw earlier: 5daef208-0048-4e93-b5ae-b4b000741ebd
curl --location --request DELETE 'https://sandbox.crbcos.com/core/v1/dda/accounts/2662824164/restrictions/5daef208-0048-4e93-b5ae-b4b000741ebd' \
--header 'Authorization: Bearer <token>' \
--header 'Cookie: <cookie>'A successful API calls returns a JSON response with the restriction details. The id field contains the same restriction ID: 5daef208-0048-4e93-b5ae-b4b000741ebd.
{
"id": "5daef208-0048-4e93-b5ae-b4b000741ebd",
"masterAccountNumber": "2662824164",
"subAccountNumber": "394434993538",
"restrictionType": "Internal",
"appliesTo": "Account",
"status": "Inactive",
"rail": "Wires",
"transactionType": "Debit",
"amountThreshold": 50100,
"currency": "usd",
"reason": "test",
"createdAt": "2026-08-24T03:02:46.817-04:00",
"removedAt": "2026-08-24T03:05:08.4627259-04:00",
"partnerId": "cd9c12f4-7691-424a-b38b-af5b0134c611",
"lastModifiedAt": "2026-08-24T03:02:46.8173987-04:00"
}The Core.Restriction.Removedwebhook event fires when when the restriction is removed. The restriction ID, 5daef208-0048-4e93-b5ae-b4b000741ebd, appears in the event payload.
{
"id": "c343ae45-df07-40b3-b2af-b4b00074d9d3",
"eventName": "Core.Restriction.Removed",
"status": "Pending",
"partnerId": "cd9c12f4-7691-424a-b38b-af5b0134c611",
"createdAt": "2026-08-24T03:05:26.47-04:00",
"resources": [
"core/v1/dda/accounts/2662824164/restrictions/5daef208-0048-4e93-b5ae-b4b000741ebd"
],
"details": [
{
"restrictionId": "5daef208-0048-4e93-b5ae-b4b000741ebd",
"subAccountNumber": "394434993538",
"masterAccountNumber": "2662824164",
"accountType": "Deposit",
"status": "Inactive",
"amountThreshold": "50100",
"currency": "usd",
"rail": "Wires",
"transactionCode": null,
"transactionType": "Debit"
}
]
}