Test allow, review, and deny

Build a three-tier test: one payment is approved, one waits for approval, and one is denied. More scenarios covers blocked recipients and time windows.

Prerequisites

A Conto account and organization

An active agent with a linked, funded wallet and an SDK key in CONTO_API_KEY. The Quickstart walks through creating the wallet, connecting the agent, and generating the key

Keep the test isolated

Use a dedicated test agent and its Tempo Testnet wallet. Other organization policies, approval workflows, or wallet caps can change the result. Make sure the wallet’s per-transaction cap is at least 20 and its remaining daily budget covers the test. Pass its walletId when multiple wallets exist. Authorization tests create request records and send no funds unless you execute. The starter policies on a new agent (

25 per payment, review above

10) do not change these results. Use a DEV agent, because a production agent holds its first payment to a new address for payee review.

Test	Spend cap: 15	Review above: 10	Expected decision	Permitted next action
5	Pass	Not triggered	`APPROVED`	May execute before expiry
12	Pass	Triggered	`REQUIRES_APPROVAL`	Wait for review, then read the same request
20	Fail	Also above threshold	`DENIED`	Stop. Review cannot override a failed cap

Conto re-checks controls before a managed payment executes, so a policy change can stop a request that was approved earlier. Read lifecycle and recovery before resuming.

Step 1: Verify your setup

Confirm the agent is configured before you create policies:

curl https://conto.finance/api/sdk/setup \
  -H "Authorization: Bearer $CONTO_API_KEY"

Check that the setup summary shows:

the agent is available for payment calls
at least one wallet is available

If either check fails, go back to the Quickstart.

Step 2: Create policies

Policy A: Spend limit

Create the policy

Go to Policies > Create Policy.

Policy Name: “Manual Spend Test”
Applies to: Only assigned agents, wallets, or cards
Policy Type: Spend Limit
Max Transaction ($): 15
Description: “Deny transactions over $15”

Check the rule

The form creates this rule:

Field	Value
Rule Type	`MAX_AMOUNT`
Operator	`LTE`
Value	`15`
Action	`ALLOW`

This allows transactions up to $15. Anything above is denied.

How rule actions work: an ALLOW rule is a required condition, so a transaction that does not match it is denied. A DENY or REQUIRE_APPROVAL rule triggers when its condition matches. DENY + GREATER_THAN 15 has the same effect as this rule. REQUIRE_APPROVAL + GREATER_THAN 10 requires manual approval when the amount is over $10. See how policies are evaluated.

Policy B: Approval threshold

Create the policy

Go to Policies > Create Policy.

Policy Name: “Manual Approval Test”
Applies to: Only assigned agents, wallets, or cards
Policy Type: Approval Threshold
Require Approval Above ($): 10
Description: “Require approval for transactions over $10”

Check the rule

The form creates this rule:

Field	Value
Rule Type	`REQUIRE_APPROVAL_ABOVE`
Operator	`GREATER_THAN`
Value	`10`
Action	`REQUIRE_APPROVAL`

Transactions over $10 require manual approval in the dashboard before they can execute.

Step 3: Assign policies to the agent

Open the agent detail page

Navigate to your agent’s detail page.

Go to the Permissions tab

Click the Permissions tab.

Assign both policies

Assign “Manual Spend Test” and “Manual Approval Test” to the agent. All assigned policies are evaluated with AND logic. The most restrictive rule wins.

To confirm, re-run the GET /api/sdk/setup call from Step 1 and check that the payment-control summary reflects the assigned policies.

Step 4: Run test transactions

Use curl or any HTTP client. With the SDK, call conto.payments.request({ amount, recipientAddress, walletId, idempotencyKey }) with amounts 5, 12, and 20. Use a different key for each test, and reuse a key only to retry the same test. See Payments.

Test 1: $5 payment (expect APPROVED)

curl -X POST https://conto.finance/api/sdk/payments/request \
  -H "Authorization: Bearer $CONTO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "amount": 5,
    "recipientAddress": "0x0000000000000000000000000000000000000001",
    "purpose": "Test - under all limits",
    "category": "SAAS"
  }'

Expected response:

{
  "requestId": "cmm...",
  "status": "APPROVED",
  "amount": 5,
  "currency": "pathUSD",
  "recipient": "0x0000000000000000000000000000000000000001",
  "reasons": []
}

Test 2: $12 payment (expect REQUIRES_APPROVAL)

curl -X POST https://conto.finance/api/sdk/payments/request \
  -H "Authorization: Bearer $CONTO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "amount": 12,
    "recipientAddress": "0x0000000000000000000000000000000000000001",
    "purpose": "Test - over approval threshold"
  }'

Expected response:

{
  "requestId": "cmm...",
  "status": "REQUIRES_APPROVAL",
  "amount": 12,
  "currency": "pathUSD",
  "recipient": "0x0000000000000000000000000000000000000001",
  "reasons": ["This payment requires approval before it can proceed."]
}

Test 3: $20 payment (expect DENIED)

curl -X POST https://conto.finance/api/sdk/payments/request \
  -H "Authorization: Bearer $CONTO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "amount": 20,
    "recipientAddress": "0x0000000000000000000000000000000000000001",
    "purpose": "Test - over max amount"
  }'

Expected response:

{
  "requestId": "cmm...",
  "status": "DENIED",
  "amount": 20,
  "currency": "pathUSD",
  "recipient": "0x0000000000000000000000000000000000000001",
  "reasons": ["This payment exceeds a configured spending limit."]
}

Step 5: Execute an approved payment

If Test 1 returned APPROVED, you can execute it onchain:

curl -X POST https://conto.finance/api/sdk/payments/REQUEST_ID/execute \
  -H "Authorization: Bearer $CONTO_API_KEY"

The response includes receipt.txHash, receipt.transactionId, and receipt.settlementMode. Submission is not confirmation. Follow Track and recover a payment to verify the final state. Held and denied requests appear in Alerts & Approvals and Audit Logs, not on Transactions, which lists executed payments. Each audit entry shows which policies were evaluated, which rules matched, and the final decision.

More scenarios

Both scenarios use the same agent and a $5 payment, so only the new policy can change the result. Create each policy in Policies > Create Policy with Applies to set to Only assigned agents, wallets, or cards, then assign it on the agent’s Permissions tab.

Blocked counterparty

Field	Value
Policy Name	Test: Blocked Address
Policy Type	Counterparty
Blocked Counterparties	`0x000000000000000000000000000000000000dEaD`

curl -X POST https://conto.finance/api/sdk/payments/request \
  -H "Authorization: Bearer $CONTO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "amount": 5,
    "recipientAddress": "0x000000000000000000000000000000000000dEaD",
    "purpose": "Test: blocked recipient"
  }'

Expect DENIED with the reason This recipient is not allowed by the current payment controls. The amount does not matter. The address itself is blocked.

Time window

Field	Value
Policy Name	Test: Business Hours Only
Policy Type	Time Window
Start Time	09:00
End Time	17:00

Send a $5 payment outside 9am to 5pm UTC, or set the window to a range that excludes the current UTC time. Expect DENIED with the reason This payment is outside the permitted schedule. Remove the policy afterward so it does not block your other tests.

Time rules without a timezone are evaluated in UTC. To test a local schedule, create the rule over the API with an IANA timezone in its value. See time windows.

Troubleshooting

For setup issues such as a lost SDK key or an unfunded wallet, see If the result needs attention in the Quickstart.

Every test returns APPROVED

Check the Permissions tab on the agent detail page. Assigned policies apply only to the agents they are assigned to, and only while they are active. Also check that each policy has rules.

Payment denied but I expected REQUIRES_APPROVAL

Every applicable policy is evaluated with AND logic, whatever its priority. If one policy denies while another would require approval, the denial wins. For example, if both an approval threshold (>$10) and a spend limit (>$15) match, DENY wins over REQUIRES_APPROVAL. Priority changes sort order only. It does not override a failing rule. Check which policies are assigned on the Permissions tab.

A starter policy caps my agent lower than my policy

Every applicable policy must pass, so the strictest cap wins. New agents are linked to the starter policies (

25 per payment,

100 per day, review above

10). If the starter cap is

25 and your policy allows

100, the

25 cap wins. Edit or unassign the starter policy on the Permissions tab.

Next steps

SDK reference

Full SDK payment methods and options

Go live checklist

Checks before you enable live funds

Get started

Integrate

Payments

Conto Commerce

Spending controls

Operate

Conto Pay

Test allow, review, and deny

Prerequisites

Keep the test isolated

Step 1: Verify your setup

Step 2: Create policies

Policy A: Spend limit

Policy B: Approval threshold

Step 3: Assign policies to the agent

Step 4: Run test transactions

Test 1: $5 payment (expect APPROVED)

Test 2: $12 payment (expect REQUIRES_APPROVAL)

Test 3: $20 payment (expect DENIED)

Step 5: Execute an approved payment

More scenarios

Blocked counterparty

Time window

Troubleshooting

Next steps

SDK reference

Go live checklist

​Prerequisites

​Keep the test isolated

​Step 1: Verify your setup

​Step 2: Create policies

​Policy A: Spend limit

​Policy B: Approval threshold

​Step 3: Assign policies to the agent

​Step 4: Run test transactions

​Test 1: $5 payment (expect APPROVED)

​Test 2: $12 payment (expect REQUIRES_APPROVAL)

​Test 3: $20 payment (expect DENIED)

​Step 5: Execute an approved payment

​More scenarios

​Blocked counterparty

​Time window

​Troubleshooting

​Next steps

SDK reference

Go live checklist

Prerequisites

Keep the test isolated

Step 1: Verify your setup

Step 2: Create policies

Policy A: Spend limit

Policy B: Approval threshold

Step 3: Assign policies to the agent

Step 4: Run test transactions

Test 1: $5 payment (expect APPROVED)

Test 2: $12 payment (expect REQUIRES_APPROVAL)

Test 3: $20 payment (expect DENIED)

Step 5: Execute an approved payment

More scenarios

Blocked counterparty

Time window

Troubleshooting

Next steps