# API Conventions
source: https://developer.mastercard.com/cross-border-services/documentation/api-basics/api-conventions/index.md

## API Conventions {#api-conventions}

1. URLs are case-sensitive and must be lowercase, except where resource identifiers explicitly require a different case.
2. Use hyphens (`-`) to separate words in URL path elements that contain multiple words.
3. Input parameter names and resource member names are case-sensitive.
4. Escape special characters in submitted XML using the following substitutions:
   * `<` → `&lt;`
   * `&` → `&amp;`
   * `>` → `&gt;`
   * `"` → `&quot;`
   * `'` → `'`
5. The `Transaction Reference` request parameter accepts all ASCII characters, except `{ } | ~ \ , ;`.
6. URL-encode query parameter values that contain any of the following characters:  
   `! " # $ % & ' ( ) + , / : ; < = > ? @ [ \ ] \` { \| }\`
7. All times and timestamps returned by the API are expressed in UTC.  
   Refer to [Date and Time Formats](https://developer.mastercard.com/cross-border-services/documentation/additional-resources/common-datetime-format/index.md) for details.
8. Do not include data field names when the corresponding value is empty.
9. Alphanumeric special fields accept UTF-8 characters, except `{ } | ~ \`.
10. Unicode fields accept all Unicode characters, except `{ } | ~ \`.
11. Do not include control characters or escape sequences (for example, `\n` for newline or `\r` for carriage return) in field values.