# Add a new authorisation rule

Creates an authorisation rule. It won't be enabled unless it is applied.

{% admonition type="warning" %}
An ALLOW rule permits only the transactions that match the specified criteria and blocks all others. For instance, a rule allowing SGD transactions will block all transactions that are not in SGD.
{% /admonition %}

Endpoint: POST /spend/applications/{clientId}/spend-controls/rules
Security: ClientCredentialsToken

## Path parameters:

  - `clientId` (string, required)
    The application client ID.

## Header parameters:

  - `X-External-Correlation-Id` (string)
    Optional UUID for correlating requests across systems. If provided, Wise echoes it back in the response. Maximum 36 characters. Learn more.
    Example: "f47ac10b-58cc-4372-a567-0e02b2c3d479"

## Request fields (application/json):

  - `type` (string)
    The type of authorisation rule.
    Enum: "MCC", "CURRENCY"

  - `operation` (string)
    Determines whether the transactions should be allowed or blocked.
    Enum: "ALLOW", "BLOCK"

  - `description` (string)
    The description of the authorisation rule.

  - `values` (array)
    A list of values based on the type of rule. For example, setting MCC as type requires values to be set as ["1234", "5678"].

## Response 200 fields (application/json):

  - `id` (integer)
    The unique ID for the authorisation rule.
    Example: 123

  - `type` (string)
    The type of authorisation rule.
    Enum: same as `type` (2 values)

  - `operation` (string)
    Determines whether the transactions should be allowed or blocked.
    Enum: same as `operation` (2 values)

  - `description` (string)
    The description of the authorisation rule.
    Example: "my authorisation rule"

  - `values` (array)
    A list of values based on the type of rule configured.
    Example: ["1234","5678"]