# Add a new authorisation rule

Creates an authorisation rule. It won't be enabled unless it is [applied](/api-reference/legacy/spend-controls/spendcontrolsruleapply).
An `ALLOW` rule permits only the transactions that match the specified criteria and blocks all others. For instance, a rule allowing `SGD` transactions will block all transactions that are not in `SGD`.

Endpoint: POST /v3/spend/applications/{clientId}/spend-controls/rules
Security: ClientCredentialsToken

## Security:

  - `ClientCredentialsToken` (unknown)
    http bearer JWT

## Path parameters:

  - `clientId` (string, required)
    The application client ID.

## Header parameters:

  - `X-External-Correlation-Id` (string)
    Optional UUID for correlating requests across systems. If provided, Wise echoes it back in the response. Maximum 36 characters. [Learn more](/guides/developer/headers/correlation-id).

## Request fields (application/json):

  - `type` (string)
    The type of authorisation rule.
    Enum: "MCC", "CURRENCY"

  - `operation` (string)
    Determines whether the transactions should be allowed or blocked.
    Enum: "ALLOW", "BLOCK"

  - `description` (string)
    The description of the authorisation rule.

  - `values` (array)
    A list of values based on the `type` of rule. For example, setting `MCC` as `type` requires `values` to be set as `["1234", "5678"]`.

## Response 200:

  - `200` (unknown)
    The created rule.

## Response 200 fields (application/json):

  - `id` (integer)
    The unique ID for the authorisation rule.

  - `type` (string)
    The type of authorisation rule.
    Enum: "MCC", "CURRENCY"

  - `operation` (string)
    Determines whether the transactions should be allowed or blocked.
    Enum: "ALLOW", "BLOCK"

  - `description` (string)
    The description of the authorisation rule.

  - `values` (array)
    A list of values based on the `type` of rule configured.

## Response 200 headers (application/json):

  - `X-External-Correlation-Id` (string)
    Echoed back when `X-External-Correlation-Id` was included in the request. [Learn more](/guides/developer/headers/correlation-id).
    Example: f47ac10b-58cc-4372-a567-0e02b2c3d479

  - `x-trace-id` (string)
    Unique trace identifier assigned by Wise. Useful when contacting support about a specific request.
    Example: fba501b6d453b96789f52338f019341f

## Response 429:

  - `429` (unknown)
    Rate limit exceeded. Retry after the number of seconds specified in the `Retry-After` header.

## Response 429 headers (application/json):

  - `Retry-After` (integer)
    Number of seconds to wait before retrying the request.
    Example: 5

  - `X-Rate-Limited-By` (string)
    Identifies the rate limiter that triggered the 429 response.
    Example: wise-public-api

  - `X-External-Correlation-Id` (string)
    Echoed back when `X-External-Correlation-Id` was included in the request. [Learn more](/guides/developer/headers/correlation-id).
    Example: f47ac10b-58cc-4372-a567-0e02b2c3d479

  - `x-trace-id` (string)
    Unique trace identifier assigned by Wise. Useful when contacting support about a specific request.
    Example: fba501b6d453b96789f52338f019341f