# Spend Controls

Control which card transactions are permitted by creating rules based on merchant category code (MCC) or transaction currency.
An authorisation rule dictates whether transactions should be declined or approved based on a pre-determined set of rules. A transaction can only pass if it satisfies all the applied rules.
Creating a rule has no practical implication until it is [applied](/api-reference/legacy/spend-controls/spendcontrolsruleapply). Applying a rule results in the authorisation rule being evaluated against every incoming card authorisation request.
Rules are scoped at the application level. Use a [client credentials token](/api-reference/legacy/oauth-token/oauthtokencreate) to call these endpoints.

 - [Authorisation Rule](https://docs.wise.com/api-reference/legacy/spend-controls/rule.md): Schema: #/components/schemas/rule
 - [POST /v3/spend/applications/{clientId}/spend-controls/rules](https://docs.wise.com/api-reference/legacy/spend-controls/spendcontrolsrulecreate.md): Creates an authorisation rule. It won't be enabled unless it is [applied](/api-reference/legacy/spend-controls/spendcontrolsruleapply). An `ALLOW` rule permits only the transactions that match the spe
 - [GET /v3/spend/applications/{clientId}/spend-controls/rules](https://docs.wise.com/api-reference/legacy/spend-controls/spendcontrolsruleslist.md): Retrieves all the existing authorisation rules, regardless of whether or not they are applied.
 - [POST /v3/spend/applications/{clientId}/spend-controls/rules/apply](https://docs.wise.com/api-reference/legacy/spend-controls/spendcontrolsruleapply.md): Apply an authorisation rule. This will result in the rule being evaluated against every incoming card authorisation request.
 - [POST /v3/spend/applications/{clientId}/spend-controls/rules/unapply](https://docs.wise.com/api-reference/legacy/spend-controls/spendcontrolsruleunapply.md): Deactivates an authorisation rule. This will result in all card transactions **not** being evaluated against this rule. The rule still [exists](/api-reference/legacy/spend-controls/spendcontrolsrulesl
 - [GET /v3/spend/applications/{clientId}/spend-controls/rules/applied](https://docs.wise.com/api-reference/legacy/spend-controls/spendcontrolsappliedruleslist.md): Returns the list of all the active authorisation rules that have been applied.
 - [DELETE /v3/spend/applications/{clientId}/spend-controls/rules/{ruleId}](https://docs.wise.com/api-reference/legacy/spend-controls/spendcontrolsruledelete.md): Deletes an authorisation rule that is **currently not applied**. If a rule is applied, you should [unapply](/api-reference/legacy/spend-controls/spendcontrolsruleunapply) the rule before deleting it.