Issuing authorization rulesPrivate preview

Issuing rules help you prevent unauthorized activity by blocking authorizations that match custom conditions. For example, you can block card transactions outside of your geography, above a certain amount, or where certain fraud signals are present. Access Issuing rules in the Stripe Issuing Dashboard by selecting the Rules tab.

When an authorization is declined due to triggering a rule, the Authorization object’s status is set to closed and its request_history.reason, is set to rule_blocked.

Generate default rules

When you first log in to Issuing rules, you can generate a set of rules tailored to your use case by answering some questions. You can delete or disable any of these generated rules, the same as rules that you create. To answer the questions later, click Remind me later.

Create a rule

To create a rule, open the Rules tab in your Issuing Dashboard and complete the following steps:

1. Select + New rule.

2. If you’re a Connect platform, you can specify the connected accounts to apply the rule to. If you don’t define an audience, the rule applies to all of your connected accounts.

3. Give the rule a descriptive name.

4. From the Attributes dropdown, select the attribute to use in evaluating the rule’s condition. For example, if you want to block authorizations from a specific country, select the Merchant country attribute. To instead use a custom metadata value, turn on the Use my own metadata toggle and enter the metadata.

5. From the next dropdown, select the operator for the condition. The dropdown includes operators applicable to the selected attribute. For details about each operator’s syntax and behavior, see the Radar operator list.

6. Set the threshold value to compare to the attribute. Depending on the selected attribute and operator, you can select one or more of the following options:

   • A value you enter or select from a list of values.
   • Another attribute’s value.
   • A value from your own metadata.

7. Optionally, add another attribute to the rule. See Complex rules.

8. Enable the rule. Enabling the rule immediately deploys it to production.

To determine appropriate threshold values for your use case, we recommend backtesting your historical authorization data. Also, string comparisons are case-insensitive.

Evaluate rule performance

Review the performance of your rules on a regular basis, and replace them if needed. The list of rules displays the count and rate of blocked authorizations for each rule. To see detailed statistics about a particular rule, click it to open its details panel. You can view the count and rate by count of authorizations blocked by the rule, or their volume and rate by volume. The panel also displays a list of authorizations recently blocked by the rule, including their date, merchant, and amount.

Issuing rule metrics

Disable or delete a rule

You can’t edit a rule, but you can disable or delete it. Select the rule, then click Disable or Delete.

• Disabling a rule turns it off in production, but keeps it in your rules list in an inactive state and retains its performance history. You can re-enable a disabled rule by selecting it and clicking Enable.
• Deleting a rule stops it from running in production and permanently removes it from your rules list. It also deletes the rule’s performance history. You can’t recover a deleted rule or its history.

If you want to change an existing rule, create a new rule to replace it, then disable or delete the existing rule.

Use card metadata

Issuing rules handle metadata the same way as Radar’s metadata attributes. Metadata is interpreted as a string or number depending on the value compared with it, and its value is derived from the metadata field on the issued card. String metadata attributes are case-sensitive.

To use metadata as an attribute, turn on the Use my own metadata toggle, then enter the metadata in the Attribute field. Surround the metadata name with double colons (::), and separate subfields with a single colon (:). For example, if your card metadata looks like { controls: { id: 'newUserControl'}}, then to use the id field in a rule, enter it in the Attribute field as ::controls:id::.

To use metadata as a comparison value, select the Metadata value type, then enter the metadata in the value field. Surround the metadata name with double colons (::), and separate subfields with a single colon (:). For example, to compare an attribute to the disputeCount metadata, enter ::disputeCount::.

Complex rules

You can create complex rules that evaluate multiple attributes or groups of attributes. Groups work like parentheses in Radar’s complex conditions. After defining a condition, add another condition or group to the same rule by clicking + Add more and selecting what to add.

Conditions always belong to a group. The first condition belongs to a default group, and any conditions not explicitly added to a different group or subgroup also belong to the default group.

By default, each condition or group is appended with an AND operator. You can change it to OR using the dropdown.

The following example uses two conditions joined by AND to block authorizations from businesses in Antarctica when the authorization (merchant) currency is USD.

A rule with multiple conditions

Each group displays a dropdown at the top with the default value Matches. You can negate the group by selecting Does not match. Negating a group makes the condition true when the group evaluates to false, equivalent to applying a NOT operator to the group.

To delete a condition or group from the rule, click the X icon in the top right of the condition or group. If the rule contains only one group and one condition, you can’t delete them.

Webhook logic

Stripe evaluates Issuing rules before sending the issuing_authorization.request event. If you have a webhook listening for that event, then authorizations declined by Issuing rules don’t trigger it.

Attribute list

Most attributes correspond to properties in the Authorization API. When using a string operator on an attribute that contains an enum value, get the enum strings from the corresponding property’s API Reference entry. When using certain other operators, you can select values or attributes from a dropdown.

Authorization details

Verification data

Merchant data

Enriched merchant data Private preview

You can create granular authorization rules using data from the enriched_merchant_data property of the Authorization object. The following table shows some of the fields available on this property. Open real-time authorizations while logged in to your Stripe account to learn more and sign up to join the preview.

Risk assessment

Velocity checks