📄 Guide
The authorization leg needs no synchronous action from you — DCS decides every authorization in real time, and your job is to consume three transaction events well: the authorization result (CARD_TRANSACTION), settlement posting (CARD_TRANSACTION_SETTLEMENT) and the debt alert (CARD_TRANSACTION_DEBT). This page follows a transaction through its life cycle: the check chain DCS runs at authorization, what each event means for the money, and which field to trust when you reconcile. Life-cycle concepts are in The transaction life cycle.
Authorization: the check chain on the DCS side
When the cardholder pays, DCS runs a check chain in real time; failing any link declines the authorization:- Entity status — the company, the employee and the card must all be in a transactable state;
- Limit rules — the velocity rules the card falls under are evaluated (rule setup in Setting spend limits);
- Available balance — the company’s fund-pool balance must fully cover the authorized amount.
postStatus = UNPOSTED. Authorization and settlement are typically hours to days apart.
CARD_TRANSACTION: the authorization-result event
Authorization and release results are pushed through a single webhook,CARD_TRANSACTION — approvals and declines share the event, distinguished by status (A approved / D declined). The data fields:
Example (an approved purchase):
Settlement: from hold to posting
When the merchant later submits for clearing, DCS debits the actual settled amount and posts the transaction:postStatus moves from UNPOSTED to POSTED, the transaction lands on the cycle’s statement, and the webhook CARD_TRANSACTION_SETTLEMENT is pushed.
The settled amount can differ from the authorized amount — tips, exchange-rate differences, or the merchant capturing less. Reconcile against the actual amount in the settlement event; never assume it equals the hold placed at authorization. Records and statement queries are in Funding and reconciliation.
What reversals, refunds and debt mean for the money
Settlement is not the only way forward. The following three scenarios carry different fund semantics — do not reuse one bookkeeping rule across them:Authorization to posting at a glance
Consuming the events well
All three transaction events are HTTP POST callbacks that DCS pushes to you, sharing one envelope structure plus the same signature-verification, retry and idempotency rules:- Deduplicate on
webhookId— process each delivery exactly once no matter how often it is retried; - Read the outcome from
status, and join a transaction’s authorization to its settlement viatransactionId; - Post to your books from the settlement event; treat the authorization event as hold display only.
Next steps
- Shape approval rates with velocity rules: Setting spend limits
- Taking part in verification when an online purchase triggers 3DS: Handling 3DS challenges

