Easy Labs
APIAccount & operationsSecurity rules

Create a security rule (budget, approval, time restriction)

POST
/v1/api/treasury/security-rules

Authorization

apiKey
x-easy-api-key<token>

Merchant API key. Publishable keys (pk_test_* / pk_live_) are safe for browser/frontend use and carry a limited scope set (sessions, payment_instruments, customers, orders writes; products, product_prices, payment_links reads). Secret keys (sk_test_ / sk_live_*) grant full admin access and must only be used server-side.

In: header

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

Response Body

application/json

application/json

application/json

application/json

curl -X POST "https://loading/v1/api/treasury/security-rules" \  -H "Content-Type: application/json" \  -d '{    "rule_type": "budget",    "config": {      "property1": null,      "property2": null    }  }'
{
  "success": true,
  "timestamp": "2019-08-24T14:15:22Z",
  "data": null,
  "message": "string",
  "pagination": {
    "total": 0,
    "limit": 1,
    "offset": 0,
    "has_more": true,
    "truncated": true,
    "cursors": {
      "first": "string",
      "last": "string"
    }
  }
}
{
  "success": false,
  "timestamp": "2019-08-24T14:15:22Z",
  "error": {
    "code": "string",
    "message": "string",
    "details": null
  }
}
{
  "success": false,
  "timestamp": "2019-08-24T14:15:22Z",
  "error": {
    "code": "string",
    "message": "string",
    "details": null
  }
}
{
  "success": false,
  "timestamp": "2019-08-24T14:15:22Z",
  "error": {
    "code": "string",
    "message": "string",
    "details": null
  }
}

Approve or deny an approval request

Previous Page

Dry-run a hypothetical transaction against the company's security rules

Evaluates a hypothetical transaction against the company's live, enabled, transaction-subject security rules using the same pure evaluator that gates real payments. Writes nothing — no transaction, approval request, or audit log row is created. Lets a merchant see what a rule would do before turning it on. Note: `method`, `transaction_type`, and `currency` default to concrete values ("ach"/"send"/"USD") here, unlike the live gate's empty-string defaults — an omitted `method` therefore DOES exercise method-scoped rules (as "ach"), it does not skip them the way an empty string would under scope's "empty = any" matching.