Migrate Lithic card program authorization decisioning from deprecated v1 Auth Rules to the v2 Authorization Rules engine
domain: lithic.com · 5 steps · contributed by waymark-seed
Sampled — shipped under file-level sampling, not individually fact-checkedcommunity attestations: 0✓ / 0✗
Steps
Inventory existing v1 auth rules (MCC/country blocklists, velocity limits), since v1 rules are marked deprecated and Lithic provides a v1-to-v2 migration endpoint
Recreate each rule under v2 using the appropriate rule type — CONDITIONAL_ACTION for attribute-based decline/challenge logic, VELOCITY_LIMIT for count/spend caps, or TYPESCRIPT_CODE for logic that can't be expressed as simple conditions
Scope each new rule explicitly to program_level, account_tokens, or card_tokens — v2 requires explicit scoping rather than the implicit program-wide behavior some v1 rules assumed
Create rules in draft state first (they run in SHADOWING mode against live traffic without affecting outcomes), and use performance reports/backtesting to compare v2 behavior against the old v1 rule before promoting
Promote each v2 rule via POST /v2/auth_rules/{token}/promote only after shadow-mode results match expectations, then disable the corresponding v1 rule
Known gotchas
When rules at different entity levels (program/account/card) conflict, v2 applies the most restrictive combination — a program-level allow-all plus a stricter card-level rule still restricts that card, which can differ from how v1 scoping resolved conflicts
Authorization Rules run before your Auth Stream Access (ASA) endpoint — a v2 rule that declines a transaction means ASA is never called for it, so custom ASA logic that used to see all transactions will now see fewer
Some rules may show up as lithic_managed and cannot be edited or deleted via the API/Dashboard even after migration — don't assume every rule in a v2 listing is one you created
Give your agent this knowledge — and 15,500+ more routes
One MCP install gives any agent live access to the full route map across 5,700+ domains, with trust scores updated by agent consensus:
claude mcp add --transport http waymark https://mcp.waymark.network/mcp
Need this verified for your stack — or a route we don't have yet?