# Token Spend Control Management
source: https://developer.mastercard.com/mdes-customer-service/documentation/use-cases/tokenspendcontrol-use-case/index.md

Token Spend Controls allows token requestors to define spending rules at a token level providing greater flexibility and more granular control over
token usage beyond traditional card or account level controls. These rules may include spending limits based controls and usage restrictions that determine when a token transaction is permitted.

**Limit based controls**: Restrictions based on transaction amount and cumulative spend.

* **Daily Spend Limit** -- Set the maximum amount that can be spent using a token within a single day.
* **Weekly Spend Limit** -- Restrict the total spending amount permitted during a calendar week.
* **Monthly Spend Limit** -- Define the maximum spending amount allowed within a calendar month.
* \*\*Transaction Spend Limit (per transaction) \*\* -- Specify the maximum amount allowed for an individual transaction.
* **Single Use** -- Configure a token for one-time use with an expiration date. After the first successful non-zero transaction, the token can no longer be used for additional transactions.
* **Absolute Spend Limit** -- Set a cumulative spending cap that the token cannot exceed over its lifetime.

**List Based Controls**: Restrictions based on merchant, transaction, and geographic attributes.

* **Merchant Category Code (MCC)** -- Allow or restrict transactions based on Merchant Category Codes.
* **Merchant ID (MID)** -- Allow or block transactions for specific merchants.
* **Transaction Category Code (TCC)** -- Control transactions based on transaction category classifications.
* **Transaction Type** -- Restrict or permit specific transaction types.
* **Geography** -- Define geographic locations where the token can or cannot be used.

Token Spend Controls involve performing various actions on tokens including:

* [Searching Token Spend Control Rules](https://developer.mastercard.com/mdes-customer-service/documentation/use-cases/tokenspendcontrol-use-case/index.md#retrieving-token-spend-control-rules)
* [Creating Token Spend Control Rules](https://developer.mastercard.com/mdes-customer-service/documentation/use-cases/tokenspendcontrol-use-case/index.md#creating-token-spend-control-rules)
* [Updating Token Spend Control Rules](https://developer.mastercard.com/mdes-customer-service/documentation/use-cases/tokenspendcontrol-use-case/index.md#updating-token-spend-control-rules)
* [Deleting Token Spend Control Rules](https://developer.mastercard.com/mdes-customer-service/documentation/use-cases/tokenspendcontrol-use-case/index.md#deleting-token-spend-control-rules)

## Searching Token Spend Control Rules {#searching-token-spend-control-rules}

A cardholder needs to search token spend limit rules for a token either during or after token provisioning.
An issuer first search for the specific token and then uses the Search Token Spend Control Rules API to search and retrieve the desired spending controls.
Diagram searchtokenspendcontrol

### Steps: {#steps}

1. The cardholder selects a token and initiates search spend control request through the issuer app.
2. The issuer initiates the search spend controls action for the selected card token.
3. The issuer searches for the token mapped to the PAN.
4. A list of tokens mapped to the PAN is returned with a unique identifier assigned to each token.
5. The issuer identifies the required token using the Token Unique Reference (TUR).
6. The issuer sends a search token spend control API request to MDES for the identified token.
7. MDES validates the request and verifies whether the token is eligible for spend controls.
   1. If the request is valid, MDES checks whether the search spend control rule is already assigned to the token.
   2. If the request is invalid, MDES returns a validation error response.
8. Upon successful searching of the spend control mapping, MDES returns a success response.
9. If the spend control mapping cannot be updated, MDES returns an error response.
10. The issuer receives the response and returns the search spend control status to the issuer system.
11. The issuer app displays the appropriate message to the cardholder.

### Endpoint {#endpoint}


API Reference: `GET /{id}/search`


API Reference: `GET /{id}/token/spendcontrols/search`

<br />

## Creating Token Spend Control Rules {#creating-token-spend-control-rules}

A cardholder needs to create token spend limit rules either during or after token provisioning.
An issuer first search for the specific token and then uses the Create Token Spend Control Rules API to configure the desired spending controls.
Diagram createtokenspendcontrol

### Steps: {#steps-1}

1. The cardholder initiates create spend control request through the issuer app.
2. The issuer initiates the create spend controls action for the selected card token.
3. The issuer searches for the token mapped to the PAN.
4. A list of tokens mapped to the PAN is returned with a unique identifier assigned to each token.
5. The issuer identifies the required token using the Token Unique Reference (TUR).
6. The issuer sends a create token spend control API request to MDES for the identified token.
7. MDES validates the request and verifies whether the token is eligible for spend controls.
   1. If the request is valid, MDES checks whether the create spend control rule is already assigned to the token.
   2. If the request is invalid, MDES returns a validation error response.
   3. If the spend control rule is already assigned, MDES returns a duplicate rule error response, and the process ends.
   4. If the spend control rule is not already assigned, MDES creates the spend control mapping for the token.
8. Upon successful creation of the spend control mapping, MDES returns a success response.
9. If the spend control mapping cannot be created, MDES returns an error response.
10. The issuer receives the response and returns the create spend control status to the issuer system.
11. The issuer app displays the appropriate message to the cardholder.

### Endpoint {#endpoint-1}


API Reference: `GET /{id}/search`


API Reference: `GET /{id}/token/spendcontrols/create`

<br />

## Updating Token Spend Control Rules {#updating-token-spend-control-rules}

A cardholder needs to update token spend limits. To update token spend control rules, issuer first search for the specific token that requires spend limit updation and then use the Update Token Spend Control Rules API to update the desired spending controls rules.
Diagram updatetokenspendcontrol

### Steps: {#steps-2}

1. The cardholder selects a token and initiates update spend control request through the issuer app.
2. The issuer initiates the update spend controls action for the selected card token.
3. The issuer searches for the token mapped to the PAN.
4. A list of tokens mapped to the PAN is returned with a unique identifier assigned to each token.
5. The issuer identifies the required token using the Token Unique Reference (TUR).
6. The issuer sends an update token spend control API request to MDES for the identified token.
7. MDES validates the request and verifies whether the token is eligible for spend controls.
   1. If the request is valid, MDES checks whether the update spend control rule is already assigned to the token.
   2. If the request is invalid, MDES returns a validation error response.
8. Upon successful updation of the spend control mapping, MDES returns a success response.
9. If the spend control mapping cannot be updated, MDES returns an error response.
10. The issuer receives the response and returns the update spend control status to the issuer system.
11. The issuer app displays the appropriate message to the cardholder.

### Endpoint {#endpoint-2}


API Reference: `GET /{id}/search`


API Reference: `GET /{id}/token/spendcontrols/update`

<br />

## Deleting Token Spend Control Rules {#deleting-token-spend-control-rules}

A cardholder needs to delete token spend limits. To delete token spend control rules, the issuer first searches for the specific token that requires spend limit deletion and then use the Delete Token Spend Control Rules API to delete the desired spending controls rules.
Diagram deletetokenspendcontrol

### Steps: {#steps-3}

1. The cardholder selects a token and initiates delete spend control request through the issuer app.
2. The issuer initiates the delete spend controls action for the selected card token.
3. The issuer searches for the token mapped to the PAN.
4. A list of tokens mapped to the PAN are returned with a unique identifier assigned to each token.
5. The issuer sends a delete token spend control API request to MDES for the identified token.
6. MDES validates the request and verifies whether the token is eligible for spend controls.
   1. If the request is valid, MDES checks whether the delete spend control rule is already assigned to the token.
   2. If the request is invalid, MDES returns a validation error response.
7. Upon successful deletion of the spend control mapping, MDES returns a success response.
8. If the spend control mapping cannot be deleted, MDES returns an error response.
9. The issuer receives the response and returns the delete spend control status to the issuer system.
10. The issuer app displays the appropriate message to the cardholder.

### Endpoint {#endpoint-3}


API Reference: `GET /{id}/search`


API Reference: `GET /{id}/token/spendcontrols/delete`

<br />