# API Basics
source: https://developer.mastercard.com/account-catalog-services/documentation/api-basics/index.md

## API Security {#api-security}

### Client Authentication {#client-authentication}

Mastercard uses the following authentications:

* [OAuth 1.0a](https://developer.mastercard.com/platform/documentation/authentication/using-oauth-1a-to-access-mastercard-apis/) for Account Catalog Services API.
* [MTLS](https://developer.mastercard.com/platform/documentation/security-and-authentication/using-mtls-to-access-mastercard-apis/) for Account Catalog Services Detail response API.

You can manage your authentication keys from your [Developer Dashboard](https://developer.mastercard.com/dashboard) after you created a project using Account Catalog Services.

### Transport Encryption {#transport-encryption}

The transport between client applications and Mastercard is secured using [TLS / SSL](https://en.wikipedia.org/wiki/Transport_Layer_Security), which means data is encrypted by default when transmitted across networks.  

In addition to that, Account Catalog Services uses [JWE encryption](https://developer.mastercard.com/platform/documentation/security-and-authentication/securing-sensitive-data-using-payload-encryption/#jwe-encryption) to provide end-to-end payload encryption to secure sensitive data like Personally Identifying Information (PII).
You can download and manage your encryption keys from your [Developer Dashboard](https://developer.mastercard.com/dashboard).
Tip: Do you want to learn more about the authentication and encryption schemes Mastercard uses? For that, read our [Securing Sensitive Data Using Payload Encryption](https://developer.mastercard.com/platform/documentation/security-and-authentication/securing-sensitive-data-using-payload-encryption/) guides.

## How to Consume the Account Catalog Services API? {#how-to-consume-the-account-catalog-services-api}

Note: There are multiple ways of integrating with Account Catalog Services:

1. Using a generated API client (recommended)
2. Using a method of your choice

### Generating your own Account Catalog Services API client {#generating-your-own-account-catalog-services-api-client}

Create customizable API clients from the Account Catalog Services API specification and let Mastercard open-source client libraries handle the authentication for you. This approach offers more flexibility and is strongly recommended.  

For this, follow our [Generating and Configuring a Mastercard API Client](https://developer.mastercard.com/platform/documentation/security-and-authentication/generating-and-configuring-a-mastercard-api-client/) tutorial with:

* The following API specification: [acs-api-swagger.yaml](https://static.developer.mastercard.com/content/account-catalog-services/swagger/acs-api-swagger.yaml) (69KB)

<!-- -->

* The encryption certificate generated while you created a project using Account Catalog Services.
* The following configuration will be used for encryption and decryption:

* Java

```java
JweConfig jweConfig = JweConfigBuilder.aJweEncryptionConfig()
        .withEncryptionCertificate(encryptionCertificate)
        .withDecryptionKey(decryptionKey)
        .withDecryptionPath("$.encryptedValue", "$")
        .withEncryptionPath("$", "$")
        .withEncryptedValueFieldName("encryptedValue")
        .build();
```

### Using a method of your choice {#using-a-method-of-your-choice}

Account Catalog Services exposes a REST API: you are free to use the REST / HTTP client of your choice and can still leverage the Mastercard open-source [client authentication](https://developer.mastercard.com/platform/documentation/security-and-authentication/using-oauth-1a-to-access-mastercard-apis/#client-libraries) and [client encryption](https://developer.mastercard.com/platform/documentation/security-and-authentication/securing-sensitive-data-using-payload-encryption/#client-libraries) libraries for signing your requests and dealing with payload encryption.

For that, please refer to the Account Catalog Services [API Reference](https://developer.mastercard.com/account-catalog-services/documentation/api-reference/index.md).

## How to consume Account Catalog Services Detail response API? {#how-to-consume-account-catalog-services-detail-response-api}

Mastercard will be sending the outbound response to the issuer's or processor's endpoint of the Account Catalog Services Detail Response API.  

This is an ad-hoc response, a customer can opt for the outbound API service by contacting [Global Customer Support](mailto:customer_support@mastercard.com).  

For more information, download and view the
[acs-api-outbound.yaml](https://static.developer.mastercard.com/content/account-catalog-services/swagger/acs-api-outbound.yaml) (24KB)

### MTLS Certificates for Outbound API Authentication {#mtls-certificates-for-outbound-api-authentication}

To establish a trusted connection for the Outbound APIs, Mastercard uses [MTLS](https://developer.mastercard.com/platform/documentation/security-and-authentication/using-mtls-to-access-mastercard-apis/) authentication.

For MTLS authentication, ensure that you have the following certificates installed into your server's trust store in both your test and production environments:
> Account Catalog Services Detail response API uses DigiCert as the Certificate Authority (CA) for its server certificate.

All communication between the Account Catalog Services API and the issuer's servers is secured using mutually authenticated TLS. In addition, all PCI sensitive data (such as PAN) is encrypted for transport using a separate key.

All key exchanges comply with the Mastercard Public Key Infrastructure policy.
Note: Keys are subject to renewal according to Mastercard policy. For more information, refer to the renew process [here](https://developer.mastercard.com/platform/documentation/credential-management/oauth-key-management/).

For more information about the encryption schemes Mastercard uses?, refer to the [Securing Sensitive Data Using Payload Encryption](https://developer.mastercard.com/platform/documentation/security-and-authentication/securing-sensitive-data-using-payload-encryption/) guides.

## API Availability {#api-availability}

The Account Catalog Services API is available in the production environment.

## Environments {#environments}

The following table describes the different environments that are available for the Account Catalog Services API and Account Catalog Services Detail response API:

| **Environment** |                                                                         **Description**                                                                          |
|-----------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Sandbox (MTF)   | Pre-production test environment containing the latest pre-release version of the real APIs, intended for full integration testing prior to moving to production. |
| Production      | Full production environment containing the latest production API release.                                                                                        |