Skip to main content
A Payment Rule lets an account act on its own payments before they reach the bank: block them, let them through, send them to review, or ask the buyer for 3D Secure. Each rule matches on a small set of payment attributes, and every condition must hold for it to apply. A rule’s definition is fixed once created, so the payments it decided keep naming the rule that decided them. Use Replace to change one, and List fields for the attributes, operators and values a condition can use. For a walkthrough of blocking, reviewing, challenging, and allowing checkouts to cut fraud, read the Manage Fraud guide.
A review rule can leave legacy embeds on Processing until capture. Automatic capture is scheduled for 24 hours after authorization, but completion can take longer or fail. Review rules are account-wide and still apply to legacy embeds. See review hold eligibility and checkout limitations before enabling them.

​
Endpoints

​
Attributes

​
string
required
Payment rule ID, prefixed prule_.
​
string
required
Account ID, prefixed biz_.
​
string
required
What this account’s rule requests when every condition matches. One applicable account-rule action wins, in this order: allow, block, review, enforce_3ds. An allow overrides this account’s other rules, never Whop’s own fraud controls. A review requests authorization without capture for an eligible on-session card payment through Whop Payments. Automatic capture is scheduled for 24 hours after authorization; capture or void the payment before then to decide sooner. Capture may complete later or fail. Review is skipped for unsupported methods, off-session payments, and payments already configured for manual capture. An enforce_3ds is skipped when the account rule cannot apply a challenge. Other 3DS requirements still apply.Available options: allow, block, review, enforce_3ds
​
object
required
The conditions a payment is matched against. Up to 10 conditions, and 8 KiB once serialized.

Properties

​
object[]
required
Conditions that must all match for the rule to apply. A payment attribute the rule cannot read does not match.

Properties

​
string
required
The payment attribute this condition reads.Available options: risk_score, amount_in_usd, card_country, customer_email, ip_address
​
string
required
How the payment attribute is compared to the value.Available options: eq, neq, gt, gte, lt, lte, in, not_in, contains, starts_with, ends_with, in_cidr
​
integer or string or string[]
required
The value to compare against.
​
string
required
When the rule was created, as an ISO 8601 timestamp.
​
string | null
required
When the rule was deleted, as an ISO 8601 timestamp. null unless status is deleted.
​
object
required
Custom string-to-string values for your integration. Maximum 50 keys, 40 characters per key, 500 characters per value.
​
string
required
A name for this rule. Up to 255 characters.
​
string
required
Whether the rule is applied to payments. A deleted rule is kept so the payments it already decided still name it.Available options: active, inactive, deleted
​
string
required
When the rule was last changed, as an ISO 8601 timestamp.
PaymentRule