# Restrictions

Customer restrictions let you block a specific customer from making payments. You can block new payment attempts made by the customer (CIT — customer-initiated transactions), block recurring subscription charges (MIT — merchant-initiated transactions), or both.

Restrictions are separate from the Blacklist. Restrictions target a customer by their ID and can be turned on or off independently per transaction type. The Blacklist targets customers by email address and is described in the [Blacklist](#the-blacklist) section below.

## Prerequisites

* A secret API key with the `customer:manage_restrictions` permission. To work with the Blacklist through the API, the key also needs `customer_blacklist:read`, `customer_blacklist:create` or `customer_blacklist:delete`, depending on the request.
* The customer ID you want to restrict (`cus_…`).

## Apply a Restriction

Send a [`POST /v2/customers/{id}/restrictions`](https://docs.odus.com/docs/api/core/v2/customer-controller-manage-restrictions) request with the restriction flags you want to enable:

```
{

  "customer": "cus_2R0uWz4tu9wxTMBXxj9CJfSE9vV",

  "restrictCit": true,

  "restrictMit": true,

  "restrictReason": "Account suspended pending fraud review"

}
```

Set `restrictCit` to block customer-initiated payments, `restrictMit` to block merchant-initiated payments, or both. The optional `restrictReason` stores a free-text explanation on the record. Setting only one flag allows the other transaction type to proceed normally.

See the [`POST /v2/customers/{id}/restrictions`](https://docs.odus.com/docs/api/core/v2/customer-controller-manage-restrictions) reference for the full parameter list.

Example

To block a customer from making new checkout payments without stopping their active subscriptions, set only `restrictCit`:

```
{

  "customer": "cus_2R0uWz4tu9wxTMBXxj9CJfSE9vV",

  "restrictCit": true,

  "restrictMit": false

}
```

## Apply a Restriction via the Dashboard

1. Open the **Customers** section and select the customer.
2. The customer detail page shows a red **Restricted** chip next to the customer name when a restriction is already active.
3. Click the **Actions** button (top right of the customer card) and select **Restrict customer**.
4. In the dialog, fill in the **Restrict reason** field (optional).
5. Toggle **Restrict customer initiated** to block CIT payments, and/or **Restrict merchant initiated** to block MIT payments.
6. Click **Restrict** to save.

## Remove a Restriction

To lift all restrictions, send the same endpoint with both flags set to `false`:

```
{

  "customer": "cus_2R0uWz4tu9wxTMBXxj9CJfSE9vV",

  "restrictCit": false,

  "restrictMit": false

}
```

To remove only one type of restriction, set its flag to `false` while leaving the other unchanged.

Via the Dashboard, follow the same steps as applying a restriction, but toggle the relevant switches off before clicking **Restrict**.

## The `isRestricted` Field

The customer object includes an `isRestricted` boolean field. It is `true` when at least one of `restrictCit` or `restrictMit` is `true`. It is `false` only when both flags are `false`.

You can use `isRestricted` as a single check when you do not need to know which type of restriction is active.

warning

The `restrictCit`, `restrictMit`, `restrictReason`, and `isRestricted` fields are only visible when authenticated with a secret key or accessed through the Dashboard. They are not returned to a checkout key.

## Automatic Restrictions from Chargebacks

Recording a chargeback adds the customer's email to the [Blacklist](#the-blacklist) while [**Blacklist customer on chargeback**](https://docs.odus.com/docs/guides/dashboard/merchant-configuration.md#blacklist-customer-on-chargeback) is on, which it is by default. With the setting off, set `blacklistCustomer` to blacklist the customer for one chargeback. Blacklisting does not change the customer's `restrictCit` or `restrictMit` flags; set those with `customerRestrictions` in the same request. See [Handling Chargebacks](https://docs.odus.com/docs/guides/payments/chargebacks.md) for details.

## The Blacklist

The Blacklist is a separate mechanism that blocks customers by email address rather than by customer ID. When a customer whose email is on the Blacklist attempts a new payment, the payment is rejected regardless of whether their customer record has `restrictCit` set.

### View the Blacklist

Navigate to the **Blacklist** page in the Dashboard to see all blacklisted email addresses, their reason (if provided), and the date they were added.

### Check whether an email is blacklisted

Filter the Blacklist by email:

```
GET /v2/blacklist?email[eq]=user@example.com
```

An empty `data` array means the email is not on the Blacklist. Emails are stored and compared in lowercase, so the case you send does not matter.

### Add an Entry to the Blacklist

You can add an email address to the Blacklist through the Dashboard or the API.

**Dashboard:** Click the **Add** button on the Blacklist page, enter the customer's email address, add an optional reason, and click **Submit**.

**API:** Send a [`POST /v2/blacklist`](https://docs.odus.com/docs/api/core/v2/blacklist-controller-create) request:

```
{

  "email": "user@example.com",

  "reason": "Fraudulent activity detected"

}
```

Blacklisting cancels the customer's subscriptions

When you add an email to the Blacklist, ODUS also cancels **immediately** every active subscription of every customer with that email. Their invoices are not changed: an invoice whose payment is already in progress is settled by that payment, and no new charge is attempted, because the Blacklist refuses it. This applies however the entry is added: from the Dashboard, through the API, or by recording a chargeback with `blacklistCustomer`. The cancellations follow within moments of the entry being added, not in the response to the request that added it.

Each subscription sends a `subscription.cancelled` event and carries `cancellationReason: "customer_blacklisted"`. Removing the entry later does not restore them; create a new subscription instead.

Adding an email that is already on the Blacklist changes nothing.

### Remove an Entry from the Blacklist

**Dashboard:** On the Blacklist page, click the delete action next to the entry you want to remove and confirm.

**API:** Send a [`POST /v2/blacklist/{id}/delete`](https://docs.odus.com/docs/api/core/v2/blacklist-controller-delete-entry) request using the blacklist entry ID (`bl_…`). No request body is required.

note

Removing an entry from the Blacklist does not automatically remove `restrictCit` or `restrictMit` flags from the customer record. Use [`POST /v2/customers/{id}/restrictions`](https://docs.odus.com/docs/api/core/v2/customer-controller-manage-restrictions) to clear those independently if needed.

## CIT vs MIT: Key Distinction

| Flag          | Blocks                                                                                      |
| ------------- | ------------------------------------------------------------------------------------------- |
| `restrictCit` | New payment attempts initiated by the customer (e.g. checkout sessions, one-time purchases) |
| `restrictMit` | Recurring charges triggered by the merchant (e.g. scheduled subscription renewals)          |

The two flags operate independently. A customer with only `restrictMit` set can still make new purchases; a customer with only `restrictCit` set will still be charged for their active subscriptions.