Replace rule

Authorization

BearerAuth

AuthorizationBearer <token>

HTTP bearer JWT from the Corebanq auth service.

Authorization is enforced with RBAC (record-level permissions), not ad-hoc OAuth-style scopes in this spec. See each tag description and operation summaries for which record grants apply.

In: header

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

product_code?|

Wildcard when null. Known values: IWT, OWT, INT, OWN, CRW, CRD, OFR.

customer_type?|

Matches customer.type. Wildcard when null.

source_account_type?|

source_currency?|

source_channel?string

source_ownership?|

Source ownership filter. "own" = the customer's own account; "foreign" = a third-party counterparty. Null = wildcard.

dest_account_type?|

dest_currency?|

dest_channel?string

dest_ownership?|

Destination ownership filter. "own" = customer's own account; "foreign" = third-party counterparty. Null = wildcard.

source_account_scope?|

Source account scope. "internal" = managed by Corebanq; "external" = external wire account. Null = wildcard.

dest_account_scope?|

Destination account scope. Null = wildcard.

amount_range_start?|

Lower bound (inclusive) of the matching amount range, in minor units. Null = unbounded.

amount_range_end?|

Upper bound (inclusive) of the matching amount range, in minor units. Null = unbounded.

amount_range_currency?|

Currency for the amount range condition. Null = any currency.

allowed*boolean

true = ALLOW when this rule matches; false = DENY.

min_amount?|

Advisory minimum amount returned to the client when this rule matches.

max_amount?|

Advisory maximum amount returned to the client when this rule matches.

limit_currency?|

priority*integer

Matrix evaluation order: lower integers are checked first (ascending priority, then created_at ASC); the first matching rule wins. This differs from GET /v1/products/rules list sort, which returns rows in priority DESC for admin display.

valid_from?|

Rule becomes active at this UTC timestamp. Null = immediately active.

valid_to?|

Rule expires at this UTC timestamp. Null = no expiry.

active*boolean

Soft-disable a rule without deleting it.

comment?|

Internal note visible only in the Configurator.

metadata?|

Arbitrary key/value bag for operator notes or audit tags.

Response Body

`application/json`

curl -X PUT "https://example.com/v1/products/rules/8f2a1c3d-4e5b-6f7a-8b9c-0d1e2f3a4b5c" \  -H "Content-Type: application/json" \  -d '{    "allowed": true,    "priority": 170,    "active": true  }'

{
  "product_code": "OFR",
  "customer_type": "SMALL_BUSINESS",
  "source_account_type": "crypto",
  "source_currency": "USDT",
  "source_channel": "SEPA",
  "source_ownership": "own",
  "dest_account_type": "fiat",
  "dest_currency": null,
  "dest_channel": "SEPA",
  "dest_ownership": "own",
  "source_account_scope": null,
  "dest_account_scope": null,
  "amount_range_start": null,
  "amount_range_end": null,
  "amount_range_currency": "EUR",
  "allowed": true,
  "min_amount": null,
  "max_amount": null,
  "limit_currency": null,
  "priority": 170,
  "valid_from": null,
  "valid_to": null,
  "active": true,
  "comment": "OFR – Off-Ramp: crypto→fiat between own accounts (SMALL_BUSINESS)",
  "metadata": {},
  "id": "8f2a1c3d-4e5b-6f7a-8b9c-0d1e2f3a4b5c",
  "tenant_id": "8f2a1c3d-4e5b-6f7a-8b9c-0d1e2f3a4b5c",
  "created_at": "2019-08-24T14:15:22Z",
  "created_by": "8f2a1c3d-4e5b-6f7a-8b9c-0d1e2f3a4b5c",
  "modified_at": "2019-08-24T14:15:22Z",
  "modified_by": "8f2a1c3d-4e5b-6f7a-8b9c-0d1e2f3a4b5c"
}

{
  "status": 400,
  "code": "validation_error",
  "message": "At least one of product_ids, source_account_id, destination_account_id, or destination_counterparty_id is required.",
  "details": [
    {
      "field": "amount",
      "rule": "gt",
      "param": "0",
      "message": "amount must be greater than 0"
    }
  ],
  "class": "validation",
  "retryable": false
}

{
  "status": 400,
  "code": "validation_error",
  "message": "At least one of product_ids, source_account_id, destination_account_id, or destination_counterparty_id is required.",
  "details": [
    {
      "field": "amount",
      "rule": "gt",
      "param": "0",
      "message": "amount must be greater than 0"
    }
  ],
  "class": "validation",
  "retryable": false
}

{
  "status": 400,
  "code": "validation_error",
  "message": "At least one of product_ids, source_account_id, destination_account_id, or destination_counterparty_id is required.",
  "details": [
    {
      "field": "amount",
      "rule": "gt",
      "param": "0",
      "message": "amount must be greater than 0"
    }
  ],
  "class": "validation",
  "retryable": false
}

{
  "status": 400,
  "code": "validation_error",
  "message": "At least one of product_ids, source_account_id, destination_account_id, or destination_counterparty_id is required.",
  "details": [
    {
      "field": "amount",
      "rule": "gt",
      "param": "0",
      "message": "amount must be greater than 0"
    }
  ],
  "class": "validation",
  "retryable": false
}

{
  "status": 429,
  "message": "Rate limit exceeded",
  "code": "rate_limits_m.exceeded",
  "class": "temporary",
  "retryable": true
}

{
  "status": 500,
  "message": "Database error",
  "code": "common.database_error",
  "class": "business"
}

{
  "status": 503,
  "message": "Internal server error",
  "code": "auth_m.internal_server_error",
  "class": "temporary",
  "retryable": true
}

Authorization

Path Parameters

Request Body

Response Body

200application/json

400application/json

401application/json

403application/json

404application/json

429application/json

500application/json

503application/json

Auth cache unhealthy — the error envelope (message is locale-resolved from the tenant's translations)

Graceful shutdown — not the error envelope

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`

`application/json`