--- title: Manage account restrictions slug: tutorials/ukmx-manage-account-restrictions docTags: createdAt: 2026-08-17T11:03:15.539Z --- ## What you will learn ✅ How restriction an account from defined transactions ✅ How to remove a restriction :::hint{type="info"} The tutorial assumes you have a knowledge of APIs and how they work. Refer to [API basics](docId\:pUTTCwQ5SKLzxYzIn5D1b) for more details. ::: The tutorial uses these API endpoints: | API | Description | | --------------------------------------------------------------------------------------------------------- | ---------------------------------------------- | | [POST /core/v1/dda/accounts/{accountNumber}/restrictions](docId\:EIckX6Djcuo3cryRIH8mp) | Restricts an account from defined transactions | | [DELETE /core/v1/dda/accounts/{accountNumber}/restrictions/{id}](docId\:qXDRgzjuPEfeUXz6oKFoB) | Removed restrictions applied to an account | ## Before you begin Make sure you have: - [API credentials](docId\:wmg-1Fqwq3bj-D3c3HFfs) - Account number of the account or subaccount to apply the restriction to - [Registered](docId\:BN5XtgkJogBe-CtwomCbS) the following webhook events: | Webhook | Description | | -------------------------- | --------------------------------------- | | `Core.Restriction.Placed` | Restriction was placed on the account | | `Core.Restriction.Removed` | Restriction was removed for the account | ## Restrict an account A restriction is a flexible way to prevent transactions with defined criteria from posting to an account, such as a daily transaction limit or disallowing certain payment rails . This is useful in scenarios such as freezing an account that has been compromised. You can restrict: - A single master account or subaccount - All subaccounts but not their master account - A master account and all its subaccounts The `appliesTo` attribute defines what account or accounts are being restricted. - **Single account** Set `appliesTo` to **Account. ** Only supply a value for `subAccountNumber` to restrict a subaccount. - **All subaccounts, but not master account** Set `appliesTo` to **SubAccounts** and *do not* supply a value for `subAccountNumber` - **Master account and all subaccounts** Set `appliesTo` to **All** and *do not* supply a value for `subAccountNumber`. In this tutorial we restrict a single subaccount, limiting outbound wire transactions to 501 USD or less. ### To restrict an account :::::WorkflowBlock ::::WorkflowBlockItem Call `POST /core/v1/dda/accounts/{accountNumber}/restrictions`. Even though we are restricting a subaccount, the `accountNumber` in the path must be the master account number: **2662824164**. Other required fields: - `appliesTo`: **Account** - `reason`: **test** The subaccount to be restricted is `subAccountNumber`: **394434993538**. The `rail` to limit is **Wires** and the `amountThreshold` is **50100** (501 USD). These fields are optional, but necessary to apply a specific restriction. :::CodeblockTabs Sample request ```curl curl --location 'https://sandbox.crbcos.com/core/v1/dda/accounts/2662824164/restrictions' \ --header 'Content-Type: application/json' \ --header 'Authorization: Bearer ' \ --header 'Cookie: ' \ --data '{ "subAccountNumber": "394434993538", "appliesTo": "Account", "rail": "Wires", "transactionType": "Debit", "amountThreshold": 50100, "reason": "test" }' ``` ::: :::: ::::WorkflowBlockItem A successful API calls returns a JSON response with the restriction details. The `id` field contains the restriction ID, needed to remove the restriction: **5daef208-0048-4e93-b5ae-b4b000741ebd**. :::CodeblockTabs Sample response ```json { "id": "5daef208-0048-4e93-b5ae-b4b000741ebd", "masterAccountNumber": "2662824164", "subAccountNumber": "394434993538", "restrictionType": "Internal", "appliesTo": "Account", "status": "Active", "rail": "Wires", "transactionType": "Debit", "amountThreshold": 50100, "currency": "usd", "reason": "test", "createdAt": "2026-08-24T03:02:46.8173672-04:00", "partnerId": "cd9c12f4-7691-424a-b38b-af5b0134c611", "lastModifiedAt": "2026-08-24T03:02:46.8173987-04:00" } ``` ::: :::: ::::WorkflowBlockItem The `Core.Restriction.Placed`webhook event fires when the restriction is applied. The restriction ID, **5daef208-0048-4e93-b5ae-b4b000741ebd**, appears in the event payload. :::CodeblockTabs Sample webhook event ```json { "id": "b5ae9558-a052-4e42-9056-b4b0007429db", "eventName": "Core.Restriction.Placed", "status": "Pending", "partnerId": "cd9c12f4-7691-424a-b38b-af5b0134c611", "createdAt": "2026-08-24T03:02:56.307-04:00", "resources": [ "core/v1/dda/accounts/2662824164/restrictions/5daef208-0048-4e93-b5ae-b4b000741ebd" ], "details": [ { "restrictionId": "5daef208-0048-4e93-b5ae-b4b000741ebd", "subAccountNumber": "394434993538", "masterAccountNumber": "2662824164", "accountType": "Deposit", "status": "Active", "amountThreshold": "50100", "currency": "usd", "rail": "Wires", "transactionCode": null, "transactionType": "Debit" } ] } ``` ::: :::: ::::: ### To cancel the restriction :::::WorkflowBlock ::::WorkflowBlockItem Call `DELETE /core/v1/dda/accounts/{accountNumber}/restrictions/{id}`. Even though we are removing the restriction on a subaccount, the `accountNumber` in the path must be the master account number: **2662824164**. The `id` is the restriction ID we saw earlier: **5daef208-0048-4e93-b5ae-b4b000741ebd** :::CodeblockTabs Sample request ```curl curl --location --request DELETE 'https://sandbox.crbcos.com/core/v1/dda/accounts/2662824164/restrictions/5daef208-0048-4e93-b5ae-b4b000741ebd' \ --header 'Authorization: Bearer ' \ --header 'Cookie: ' ``` ::: :::: ::::WorkflowBlockItem A successful API calls returns a JSON response with the restriction details. The `id` field contains the same restriction ID: **5daef208-0048-4e93-b5ae-b4b000741ebd**. :::CodeblockTabs Sample response ```json { "id": "5daef208-0048-4e93-b5ae-b4b000741ebd", "masterAccountNumber": "2662824164", "subAccountNumber": "394434993538", "restrictionType": "Internal", "appliesTo": "Account", "status": "Inactive", "rail": "Wires", "transactionType": "Debit", "amountThreshold": 50100, "currency": "usd", "reason": "test", "createdAt": "2026-08-24T03:02:46.817-04:00", "removedAt": "2026-08-24T03:05:08.4627259-04:00", "partnerId": "cd9c12f4-7691-424a-b38b-af5b0134c611", "lastModifiedAt": "2026-08-24T03:02:46.8173987-04:00" } ``` ::: :::: ::::WorkflowBlockItem The `Core.Restriction.Removed`webhook event fires when when the restriction is removed. The restriction ID, **5daef208-0048-4e93-b5ae-b4b000741ebd**, appears in the event payload. :::CodeblockTabs Sample webhook event ```json { "id": "c343ae45-df07-40b3-b2af-b4b00074d9d3", "eventName": "Core.Restriction.Removed", "status": "Pending", "partnerId": "cd9c12f4-7691-424a-b38b-af5b0134c611", "createdAt": "2026-08-24T03:05:26.47-04:00", "resources": [ "core/v1/dda/accounts/2662824164/restrictions/5daef208-0048-4e93-b5ae-b4b000741ebd" ], "details": [ { "restrictionId": "5daef208-0048-4e93-b5ae-b4b000741ebd", "subAccountNumber": "394434993538", "masterAccountNumber": "2662824164", "accountType": "Deposit", "status": "Inactive", "amountThreshold": "50100", "currency": "usd", "rail": "Wires", "transactionCode": null, "transactionType": "Debit" } ] } ``` ::: :::: :::::