# Support
source: https://developer.mastercard.com/digital-redemptions/documentation/support/index.md

## FAQ {#faq}

#### General {#general}

* When the customer enters their card number, call `POST /redeemers/search` to confirm the card belongs to a participating rewards program and retrieve the points balance. Show the balance and its currency value, then call `POST /redemptions` when the customer chooses to pay with points and charge any remainder to the card. The full sequence is in [Redeem Points on a Merchant Website](https://developer.mastercard.com/digital-redemptions/documentation/experience-design-guide/design/redemption-merchant-website-non-sso/index.md).
* The issuer rewards portal sends the cardholder to a participating merchant through single sign-on (SSO). The merchant retrieves the points balance with the Redeemers Profile API, prices items in points and currency, and completes the purchase with `POST /redemptions`. The full sequence is in [Redeem Points From an Issuer Rewards Website](https://developer.mastercard.com/digital-redemptions/documentation/experience-design-guide/design/redemption-issuer-rwd-website-sso/index.md).
* The merchant calls `POST /redemptions/{id}/credits` with the original redemption ID. The points return to the cardholder's rewards account immediately in their original aging status. Use `partialCreditPoints` for a partial return. Mastercard reconciles the refund cost between the issuer program and the merchant. See [Reverse Redemption](https://developer.mastercard.com/digital-redemptions/documentation/use-cases/redemptions/reverse-redemption/index.md).
* The process for redeeming points online or through an app depends on the merchant's checkout process. Typically, the cardholder selects a product or service and enters their personal details to complete the transaction. When they enter their credit card number, the merchant checks whether the card is eligible for Digital Redemptions and how many points are available.
* Yes. If the merchant receives a single sign-on (SSO) token before checkout, it can use the cardholder information from that flow to display the points balance earlier. After SSO, the merchant can also call a Redeemer Profile endpoint to retrieve and display the points balance.
* When the Credit Redemption API is used to reverse a prior redemption, Mastercard's system will facilitate a refund of points to the Cardholder's account. Mastercard will reconcile the appropriate cost of the refund between the Issuer Program and the Merchant.
* Yes. Redeemer Profile responses provide the points balance, its cash value, and its currency. Redemption requests use currencyCode where applicable so the merchant can present and process the value in the program's configured currency. See [Create Redemptions](https://developer.mastercard.com/digital-redemptions/documentation/use-cases/redemptions/post-redemptions/index.md).
* No. However, if the merchant does not store basic information about participating card programs, every transaction must call Mastercard to check whether the card is eligible for points redemption. Storing BIN range information locally can provide a first-level program eligibility check before the merchant sends a Digital Redemptions API request.
* Mastercard manages issuer rewards programs globally. The merchant enters into an agreement with Mastercard to connect as a rewards partner to the Mastercard Rewards System. Issuer programs can opt in to become available for redemption in the merchant checkout. Your Mastercard Account Manager handles the commercial arrangements.
* A cardholder can redeem points in as many separate transactions as they like, provided they have sufficient points.
* The Mastercard Rewards Platform is a full-service, global loyalty platform that utilizes industry-leading technology to deliver customized loyalty programs.
* The platform houses products and solutions that encourage customers to use a specific card or brand, helping clients attract, engage, and retain consumers across a wide range of segments.
* The platform uses enrollment data, complex scoring, and tiering to deliver a customized cardholder experience.
POST requests are not inherently idempotent. Repeating a request can create a
new resource or return an error, depending on the operation:

1. `POST /redemptions` returns a new redemption ID and the remaining points balance for each successful request. When the account no longer has enough points, the API returns an insufficient-points error.
2. `POST /redemptions/{id}/credits` handles repeated requests in two ways:

* For a full credit, repeating the request returns an error that the redemption has already been credited.
* For a partial credit, each successful request returns a new credit redemption ID until the original redemption is fully credited. Further requests return an already-credited error.
* The cards registered in Mastercard's managed rewards programs are credit cards. Some issuer programs use Visa card portfolios rather than Mastercard-branded cards. Current rewards programs do not include prepaid cards.
* The API Reference lists the allowed user ID types for each operation. Most redemption operations accept RANAC. If you have a BAN or BCN instead, call `POST /redeemers/search` to retrieve the RANAC, then use it in subsequent API calls. See [Search Redeemer Profile](https://developer.mastercard.com/digital-redemptions/documentation/use-cases/redeemers-profile/search-redeemer-profile/index.md).
See [Scenarios for Redemption Request](https://developer.mastercard.com/digital-redemptions/documentation/use-cases/redemptions/post-redemptions/index.md#scenarios-for-redemption-request) for complete examples.

1. If a request contains pointsRedeemed, provide the appropriate redemptionMatrixItemId.
2. If a request contains cashEquivalent, provide the appropriate redemptionItemId.
3. If a request contains both values, pointsRedeemed must equal the points calculated from cashEquivalent. For example, if 25,000 points are worth $250, cashEquivalent must be $250.
4. If the request does not provide quantity, the API uses `1` by default.
* Mastercard Rewards System allows accounts with Redeem Only (0) or Good Standing (1) status to perform redemptions. The same rule applies to credit redemptions.

* For an invalid account status, the API returns the appropriate error message.

|  Account Status  |                                                                  Result                                                                  |
|------------------|------------------------------------------------------------------------------------------------------------------------------------------|
| Redeem Only(0)   | Successful Redemption                                                                                                                    |
| Good Standing(1) | Successful Redemption                                                                                                                    |
| New(2)           | "Description": "INSUFFICIENT_POINTS", "Details": "The number of points redeemed was greater than the available points for the household" |
| Cancelled(3)     | "Description": "INSUFFICIENT_POINTS", "Details": "The number of points redeemed was greater than the available points for the household" |
| On Hold(4)       | "Description": "INSUFFICIENT_POINTS", "Details": "The number of points redeemed was greater than the available points for the household" |
| Inactive(5)      | "Description": "INVALID_ACCOUNT_STATUS", "Details": "No accounts in good standing"                                                       |

* Digital Redemptions is a RESTful API that uses **OAuth 1.0a** for authentication. Your API requests must include a valid OAuth 1.0a Authorization header in Sandbox and Production. See [API Basics](https://developer.mastercard.com/digital-redemptions/documentation/api-basics/index.md) for details.
* **OAuth 1.0a** : Uses an [OAuth 1.0a](https://developer.mastercard.com/platform/documentation/security-and-authentication/using-oauth-1a-to-access-mastercard-apis/) Authorization Header with RSA request signing.
* Requests and responses that exchange PCI or PII data with Digital Redemptions are also encrypted using JSON Web Encryption (JWE). Refer to the [Securing Sensitive Data Using Payload Encryption guide](https://developer.mastercard.com/platform/documentation/security-and-authentication/securing-sensitive-data-using-payload-encryption/) for more details.

Note: Mastercard provides a different set of keys specific to either the Sandbox or the Production environment.

#### Onboarding {#onboarding}

* Yes, Mastercard Digital Redemptions is available for global use.
You sign up by creating a Mastercard Developers project that includes the
Mastercard Digital Redemptions API. The project gives you Sandbox
credentials straight away; Production access is a separate request.

1. Create an account at [Mastercard Developers](https://developer.mastercard.com) and confirm your email address.
2. Go to **My Projects** , select **Create New Project** , and choose **Mastercard Digital Redemptions** as the API service.
3. Download the `.p12` signing key and encryption keys when prompted.
4. Send your Sandbox Client ID to your Mastercard Product Delivery or CIS Implementation Manager so it is mapped to a test Rewards program.

For the full walkthrough with screenshots, see the [Quick Start Guide](https://developer.mastercard.com/digital-redemptions/documentation/quick-start-guide/index.md).
* To get the price quotation, contact your Mastercard account representative. If you don't have a Mastercard representative, reach out for help from the [support page](https://developer.mastercard.com/digital-redemptions/documentation/support/index.md#get-help).
* 401 Unauthorized  
  {  
  "Errors": { "Error": \[ { "ReasonCode": "DECLINED", "Description": "Unauthorized - Access Not Granted", "Recoverable": false, "Details": null, "Source": "Gateway" } \] } }
* 404 Not found  
  { "Errors": { "Error": \[ { "Source": "RedemptionsAPI", "ReasonCode": "-5", "Description": "INVALID_ACCOUNT_NOT_FOUND", "Recoverable": false, "Details": "Invalid Account" } \] } }
* 200  
  Success response
Encryption keys are generated for each project and each environment. The
Mastercard encryption key is downloaded automatically when the project is
created; the client encryption certificate is downloaded from the project
dashboard.

1. Sign in to [Mastercard Developers](https://developer.mastercard.com/dashboard) and open your project under **My Projects**.
2. Under **Client Encryption Keys** , select **Manage**.
3. Select **Download** to save the Sandbox or Production client encryption certificate (`.pem`).
4. Copy the key **Fingerprint** shown on the same screen; you need it in your client configuration.

See the [Sandbox access tutorial](https://developer.mastercard.com/digital-redemptions/documentation/tutorials-and-guides/sandbox-access-tutorial/index.md) for screenshots of each step.
Production keys are issued after Mastercard approves a Production access
request for your project. Approval typically takes 3-5 working days.

1. Sign in to [Mastercard Developers](https://developer.mastercard.com/dashboard) and open your project under **My Projects**.
2. Select **Request Production Access**.
3. Enter a key alias and keystore password, then select **Update project** and download the Production `.p12` key file.
4. When the approval email arrives, download the Production client encryption key from **Client Encryption Keys**.
5. Send your Production Client ID to your Mastercard Product Delivery or CIS Implementation Manager.

The complete workflow, including entry and exit criteria for each stage, is in [Move Project to Production](https://developer.mastercard.com/digital-redemptions/documentation/tutorials-and-guides/production-access-tutorial/index.md).

#### Integration {#integration}

Sandbox calls fail until Mastercard has mapped your Sandbox Client ID to a
test Rewards program. Your Sandbox keys themselves are valid as soon as the
project is created.

Common causes:

* Your Sandbox Client ID has not yet been sent to, or configured by, your Mastercard Product Delivery or CIS Implementation Manager. You receive `401 Unauthorized - Access Not Granted`.
* The Client ID is configured but not mapped to a Rewards program, or the test RANAC is not enrolled. You receive `INVALID_ACCOUNT_NOT_FOUND`.
* The request is signed with Production keys, or the OAuth signature is malformed. You receive `401`.

To resolve:

1. Open your project in [Mastercard Developers](https://developer.mastercard.com/dashboard), go to **Sandbox Keys** , and copy the consumer key. The first 48 characters, up to `!`, are the Client ID.
2. Send the Client ID to your Product Delivery or CIS Implementation Manager and ask for the test program mapping. Allow 5-7 business days.
3. Once confirmed, repeat the [first Sandbox call](https://developer.mastercard.com/digital-redemptions/documentation/quick-start-guide/index.md#make-your-first-sandbox-call) and check for HTTP `200`.

The full provisioning workflow is in the [Sandbox access tutorial](https://developer.mastercard.com/digital-redemptions/documentation/tutorials-and-guides/sandbox-access-tutorial/index.md).
* Calls that take more than 15 seconds to process get timed out. You will receive a timeout error from Mastercard API Gateway.
* You may retry as soon or as often as needed.
* The sandbox in Mastercard Developers is linked to the Mastercard Test Facility (MTF). You can perform full testing in the Sandbox before launching into Production environments.
Test accounts are created in your Rewards program by Mastercard, not from
the Developer Dashboard, because each account must be enrolled in the
program with a points balance.

1. List the scenarios you need to cover, for example a household with two redeemers, an account with zero points, or an account in `REDEEMONLY` status.
2. Send the list, with your Sandbox Client ID, to your Mastercard account representative or Product Delivery Manager.
3. When the accounts are created you receive the RANAC, and where relevant the RANCU, for each one. Verify each with `GET /redeemers/{user_id}` before you use it in tests.

If you do not have a Mastercard representative, submit a request through [Get Help](https://developer.mastercard.com/digital-redemptions/documentation/support/index.md#get-help).

#### Policy {#policy}

* Yes, all Digital Redemptions APIs are Payment Card Industry (PCI) compliant.
* The communication between client applications and Mastercard is secured using [TLS/SSL](https://en.wikipedia.org/wiki/Transport_Layer_Security), which means data is encrypted by default when transmitted across networks.
* Requests and responses that exchange PCI or PII data with Digital Redemptions APIs are also encrypted using JSON Web Encryption (JWE). Refer to the [Securing Sensitive Data Using Payload Encryption](https://developer.mastercard.com/platform/documentation/security-and-authentication/securing-sensitive-data-using-payload-encryption/) guide.
* While there is no throttling policy, Mastercard reserves the right to limit user requests to preserve the reliability of the system.

#### Support {#support}

* For technical support, use the [Get Help](https://developer.mastercard.com/digital-redemptions/documentation/support/index.md#get-help) section at the bottom of this page.
The [API Status Page](https://developer.mastercard.com/api-status) shows
the current health of every Mastercard Developers API in Sandbox and
Production, and lists any open incidents.

1. Open the [API Status Page](https://developer.mastercard.com/api-status).
2. Find **Mastercard Digital Redemptions** in the list and check the Sandbox and Production indicators.
3. If the service shows an incident, wait for the status to return to operational before you retry; if the service is operational and your calls still fail, check the error code in [Codes and Formats](https://developer.mastercard.com/digital-redemptions/documentation/code-and-formats/index.md).
4. If the failure persists with an operational status, raise a ticket through [Get Help](https://developer.mastercard.com/digital-redemptions/documentation/support/index.md#get-help) and include the timestamp, endpoint, and the `Errors` object from the response.

## Get Help {#get-help}

### Contact Us for Technical Support {#contact-us-for-technical-support}