# API Basics
source: https://developer.mastercard.com/consumer-credit-analytics/documentation/api-basics/index.md

The Consumer Credit Analytics API is an HTTP‑based, RESTful API that uses OAuth 1.0a with RSA‑based request signing for authentication and supports end‑to‑end payload encryption to protect sensitive data. This section describes the core concepts required to integrate with the Consumer Credit Analytics API, including authentication, encryption, and environment configuration.

You can manage your authentication keys from your [Developer Dashboard](https://developer.mastercard.com/dashboard) after you create a project using the Consumer Credit Analytics (CCA) API.

## Client Authentication {#client-authentication}

Tip: For more details about the authentication scheme that Mastercard uses, refer to the [Using OAuth 1.0a to Access Mastercard APIs](https://developer.mastercard.com/platform/documentation/authentication/using-oauth-1a-to-access-mastercard-apis/) guide.

## Transport Encryption {#transport-encryption}

The transport between client applications and Mastercard is secured using [TLS/SSL](https://en.wikipedia.org/wiki/Transport_Layer_Security) which means data is secured by default when transmitted across networks. In addition, Mastercard uses end‑to‑end payload encryption to encrypt sensitive data such as personally identifiable information (PII).
Note: Refer to [Securing Sensitive Data Using Payload Encryption](https://developer.mastercard.com/platform/documentation/security-and-authentication/securing-sensitive-data-using-payload-encryption/) to learn more about our encryption methods.

### Payload Encryption {#payload-encryption}

In addition to the OAuth authentication, when using CCA, any PCI sensitive and all account holder Personally Identifiable Information (PII) data must be encrypted. Sensitive data is encrypted using a symmetric session (one-time-use) key. The symmetric session key is then wrapped with an RSA Public Key supplied by Mastercard during the API setup phase (the Customer Encryption Key). Since the request and response contains sensitive data, the request and response payload are encrypted using the JWE encryption scheme.

Refer to the [sample encrypted request and response](https://developer.mastercard.com/consumer-credit-analytics/documentation/tutorials-and-guides/api-testing-tutorial/index.md) section for more details.

### Encryption Libraries {#encryption-libraries}

Mastercard has abstracted the encryption scheme in the [client encryption libraries](https://developer.mastercard.com/platform/documentation/security-and-authentication/securing-sensitive-data-using-payload-encryption/#client-libraries) available in most used development languages. We highly recommend you utilize these libraries to encrypt the sensitive data used by this service.

You can use the following configuration for client encryption libraries in this service.

    JweConfig jweConfig = JweConfigBuilder.aJweEncryptionConfig()
    .withEncryptionCertificate(encryptionCertificate)
    .withEncryptionKeyFingerprint(encryptionKeyFingerprint)
    .withDecryptionKey(decryptionKey)
    .build();

## How to Consume the Consumer Credit Analytics (CCA) API? {#how-to-consume-the-consumer-credit-analytics-cca-api}

Note: There are multiple ways of integrating with the Consumer Credit Analytics (CCA) API.

1. Using a generated API client (recommended).
2. Using a method of your choice.

### Generating your own Consumer Credit Analytics API client {#generating-your-own-consumer-credit-analytics-api-client}

Create customizable API clients from the Consumer Credit Analytics API specification and let Mastercard open-source client libraries handle the authentication for you. This approach offers more flexibility and is strongly recommended.

For this, follow our [Generating and Configuring a Mastercard API Client](https://developer.mastercard.com/platform/documentation/getting-started-with-mastercard-apis/generating-and-configuring-a-mastercard-api-client/) tutorial with:

* The following API specification: [consumer-credit-analytics.yaml](https://static.developer.mastercard.com/content/consumer-credit-analytics/swagger/consumer-credit-analytics.yaml) (22KB)
* The [Reference Application](https://developer.mastercard.com/consumer-credit-analytics/documentation/developer-tools/reference-app/index.md) shows a typical usage of the Consumer Credit Analytics API. We strongly recommend you use our Reference App to consume this API.

### Using a method of your choice {#using-a-method-of-your-choice}

The Consumer Credit Analytics API exposes a REST API: you are free to use the REST/HTTP client of your choice and can still leverage the Mastercard open-source [client libraries](https://developer.mastercard.com/platform/documentation/authentication/using-oauth-1a-to-access-mastercard-apis/) for signing your requests.

For that, refer to the Consumer Credit Analytics API [REST API Reference](https://developer.mastercard.com/consumer-credit-analytics/documentation/api-reference/index.md).

## Environment Descriptions {#environment-descriptions}

The table below describes the two different environments that are available.

| **Environment** |                          **Base URL**                          |                                                                                                                                                                         **Description**                                                                                                                                                                          |
|-----------------|----------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Sandbox         | `https://sandbox.api.mastercard.com/consumer/credit-analytics` | Early access environment containing limited-capability mock APIs, intended to assist with the initial integration for new clients. The sandbox returns mock responses for a defined request. The samples can be used as a reference for sending requests and receiving responses. The Sandbox will only validate the length and data type of request parameters. |
| Production      | `https://api.mastercard.com/consumer/credit-analytics`         | Full production environment containing the latest production API release. Once all testing has been completed and you are ready to go live, you should request access to the live production environment.                                                                                                                                                        |

## Next steps {#next-steps}

Now that you have an understanding of the services authentication and encryption, proceed to the [Use Cases](https://developer.mastercard.com/consumer-credit-analytics/documentation/use-cases/index.md) section to learn about the different use cases of the service.