Create rule

POST/v1/products/rules

Authorization

BearerAuth

AuthorizationBearer <token>

HTTP bearer JWT from the Corebanq auth service.

Authorization is enforced with RBAC (record-level permissions), not ad-hoc OAuth-style scopes in this spec. See each tag description and operation summaries for which record grants apply.

In: header

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

product_code?|

Wildcard when null. Known values: IWT, OWT, INT, OWN, CRW, CRD, OFR.

customer_type?|

Matches customer.type. Wildcard when null.

source_account_type?|

source_currency?|

source_channel?Channel

Transaction channel: an active misc.items name with type=TRANSACTION_CHANNEL, or the wildcard any. Same value space as from_channel / to_channel in the tariffs module (VARCHAR(50) in the database).

dest_account_type?|

dest_currency?|

dest_channel?Channel

dest_ownership?|

Destination ownership filter. "own" = customer's own account; "foreign" = third-party counterparty. Null = wildcard.

source_account_scope?|

Source account scope. "internal" = managed by Corebanq; "external" = external wire account. Null = wildcard.

dest_account_scope?|

Destination account scope. Null = wildcard.

amount_range_start?|

Lower bound (inclusive) of the matching amount range, in minor units. Null = unbounded.

amount_range_end?|

Upper bound (inclusive) of the matching amount range, in minor units. Null = unbounded.

amount_range_currency?|

Currency for the amount range condition. Null = any currency.

allowed*boolean

true = ALLOW when this rule matches; false = DENY.

min_amount?|

Advisory minimum amount returned to the client when this rule matches.

max_amount?|

Advisory maximum amount returned to the client when this rule matches.

limit_currency?|

priority*integer

Matrix evaluation order: lower integers are checked first (ascending priority, then created_at ASC); the first matching rule wins. This differs from GET /v1/products/rules list sort, which returns rows in priority DESC for admin display.

valid_from?|

Rule becomes active at this UTC timestamp. Null = immediately active.

valid_to?|

Rule expires at this UTC timestamp. Null = no expiry.

active*boolean

Soft-disable a rule without deleting it.

comment?|

Internal note visible only in the Configurator.

metadata?|

Arbitrary key/value bag for operator notes or audit tags.

Response Body

`application/json`

curl -X POST "https://example.com/v1/products/rules" \  -H "Content-Type: application/json" \  -d '{    "allowed": true,    "priority": 170,    "active": true  }'

{
  "product_code": "OFR",
  "customer_type": "SMALL_BUSINESS",
  "source_account_type": "crypto",
  "source_currency": "USDT",
  "source_channel": "SEPA",
  "dest_account_type": "fiat",
  "dest_currency": null,
  "dest_channel": "SEPA",
  "dest_ownership": "own",
  "source_account_scope": null,
  "dest_account_scope": null,
  "amount_range_start": null,
  "amount_range_end": null,
  "amount_range_currency": "EUR",
  "allowed": true,
  "min_amount": null,
  "max_amount": null,
  "limit_currency": null,
  "priority": 170,
  "valid_from": null,
  "valid_to": null,
  "active": true,
  "comment": "OFR – Off-Ramp: crypto→fiat between own accounts (SMALL_BUSINESS)",
  "metadata": {},
  "id": "8f2a1c3d-4e5b-6f7a-8b9c-0d1e2f3a4b5c",
  "tenant_id": "8f2a1c3d-4e5b-6f7a-8b9c-0d1e2f3a4b5c",
  "created_at": "2019-08-24T14:15:22Z",
  "created_by": "8f2a1c3d-4e5b-6f7a-8b9c-0d1e2f3a4b5c",
  "modified_at": "2019-08-24T14:15:22Z",
  "modified_by": "8f2a1c3d-4e5b-6f7a-8b9c-0d1e2f3a4b5c"
}

{
  "code": "validation_error",
  "message": "At least one of product_ids, source_account_id, destination_account_id, or destination_counterparty_id is required.",
  "details": {}
}

{
  "code": "validation_error",
  "message": "At least one of product_ids, source_account_id, destination_account_id, or destination_counterparty_id is required.",
  "details": {}
}

{
  "code": "validation_error",
  "message": "At least one of product_ids, source_account_id, destination_account_id, or destination_counterparty_id is required.",
  "details": {}
}

Create rule

Authorization

Request Body

Response Body

201application/json

401application/json

403application/json

422application/json

`application/json`

`application/json`

`application/json`

`application/json`