# Testing
source: https://developer.mastercard.com/fld-fraud-submission/documentation/testing/index.md

Use this page to plan and execute Sandbox validation for the Confirmed Fraud API. It covers the recommended workflow, positive and negative coverage, and the reference guides you need for operation-level execution.
Note: Start all validation in the Sandbox environment before moving to Production. Make sure you have created a project on Mastercard Developers, generated Sandbox credentials, and received the required approvals.

### Choose a testing method {#choose-a-testing-method}

Choose a testing method that best matches how you want to validate requests:

* [Insomnia Collection](https://developer.mastercard.com/fld-fraud-submission/documentation/developer-tools/insomnia/index.md) --- an alternative API client with a ready-to-use workspace.
* [Reference Application](https://developer.mastercard.com/fld-fraud-submission/documentation/developer-tools/reff_app/index.md) --- a working Spring Boot implementation you can run and inspect.
* Custom API client generated as per guidance in [API Basics](https://developer.mastercard.com/fld-fraud-submission/documentation/api-basics/index.md#how-to-consume-the-confirmed-fraud-api).

### Recommended testing workflow {#recommended-testing-workflow}

Use this sequence to validate the main FLD operations with a realistic flow:

1. Add a fraud record (FDA).
2. Fetch the status of that record (FDS).
3. Change the fraud record (FDC).
4. Confirm a suspended record (FDE).
5. Delete a fraud record (FDD).

This flow gives you coverage across add, change, confirm, delete, and status operations, as well as authentication and encryption behavior.

## Positive testing {#positive-testing}

Positive testing confirms that valid requests succeed and return the expected data.

### Validate these behaviors {#validate-these-behaviors}

* Valid request bodies return a `200 OK` response with `responseCode` `000` and `responseMessage` `Success`.
* Added records return a generated `auditControlNumber` and a `currentStatus` of `CONFIRMED-SUCCESS`.
* Changes persist and can be verified through a follow-up status fetch (FDS).
* Confirm (FDE) and delete (FDD) operations update `currentStatus` as expected.
* Encrypted endpoints accept correctly signed and encrypted payloads.

### Positive test cases {#positive-test-cases}

Use the tabs below to view representative positive test cases for each FLD operation.
**FDA (Minimal)** --- Add a new fraud record using the minimal endpoint.

`POST fld/confirmed-frauds/mastercard-frauds`

```json
{
  "timestamp": "2026-09-21T20:34:37-06:00",
  "icaNumber": "2684",
  "refId": "f74f6461-c935-4b37-1147-0d1629e96d72",
  "providerId": "10",
  "transactionIdentifiers": [
    { "cfcKey": "ARN", "cfcValue": "01111110307000000011327" },
    { "cfcKey": "BRN", "cfcValue": "756QR7" }
  ],
  "cardNumber": "5500130000000021565",
  "transactionAmount": "3000",
  "transactionDate": "20260307",
  "fraudTypeCode": "01",
  "fraudPostedDate": "20260916",
  "fraudSubTypeCode": "K",
  "cardholderReportedDate": "20260307",
  "accountDeviceType": "1",
  "avsResponseCode": "U",
  "cardInPossession": "Y",
  "authResponseCode": "01",
  "memo": "This is a sample FDA minimal request.",
  "issuerSCAExemption": "04"
}
```

Expected result: `200 OK` and a response body containing a generated `auditControlNumber`.

```json
{
  "timestamp": "2026-09-17T10:22:25+00:00",
  "icaNumber": "2684",
  "refId": "f74f6461-c935-4b37-1147-0d1629e96d72",
  "responseCode": "000",
  "responseMessage": "Success",
  "auditControlNumber": "169772787742722",
  "matchLevelIndicator": "M",
  "financialTransactionIndicator": "APPROVED",
  "currentStatus": "CONFIRMED-SUCCESS"
}
```

**FDA (Complete)** --- Add a new fraud record using the complete endpoint.

`POST fld/confirmed-frauds/issuer-frauds`

```json
{
  "timestamp": "2026-09-21T20:34:37-06:00",
  "icaNumber": "2684",
  "refId": "297ba831-0461-412b-9040-769c6db6cc4c",
  "providerId": "10",
  "transactionIdentifiers": [
    { "cfcKey": "ARN", "cfcValue": "01111110112000000011327" }
  ],
  "cardNumber": "5500130000000021128",
  "transactionAmount": "5000",
  "transactionDate": "20260112",
  "acquirerId": "2742",
  "fraudTypeCode": "01",
  "fraudSubTypeCode": "P",
  "cardProductCode": "CIR",
  "settlementDate": "20260112",
  "fraudPostedDate": "20260112",
  "cardholderReportedDate": "20260112",
  "transactionCurrencyCode": "840",
  "billingAmount": "4000",
  "billingCurrencyCode": "840",
  "merchantId": "1234",
  "merchantName": "testq",
  "merchantCity": "test12",
  "merchantCountryCode": "USA",
  "memo": "Issuer FDA Memo"
}
```

Expected result: `200 OK` and a response body containing a generated `auditControlNumber`.

```json
{
  "timestamp": "2026-09-21T07:19:39+00:00",
  "icaNumber": "2684",
  "refId": "297ba831-0461-412b-9040-769c6db6cc4c",
  "responseCode": "000",
  "responseMessage": "Success",
  "auditControlNumber": "743574790922240",
  "matchLevelIndicator": "I",
  "currentStatus": "CONFIRMED-SUCCESS"
}
```

**FDC (Minimal)** --- Change an existing fraud record using the minimal endpoint.

`PUT fld/confirmed-frauds/mastercard-frauds`

```json
{
  "refId": "ed118n39-8748-4414-a162-d7cce2cb5vd5",
  "timestamp": "2026-09-21T20:34:37-06:00",
  "icaNumber": "2684",
  "auditControlNumber": "584849777181696",
  "cardholderReportedDate": "-",
  "issuerSCAExemption": "-",
  "memo": "This is a sample FDC minimal Nullify request",
  "fraudPostedDate": "20260916"
}
```

Expected result: `200 OK` with the same `auditControlNumber` and an unchanged `currentStatus` of `CONFIRMED-SUCCESS`.

```json
{
  "timestamp": "2026-09-21T07:22:41+00:00",
  "icaNumber": "2684",
  "refId": "ed118n39-8748-4414-a162-d7cce2cb5vd5",
  "responseCode": "000",
  "responseMessage": "Success",
  "auditControlNumber": "584849777181696",
  "matchLevelIndicator": "M",
  "financialTransactionIndicator": "APPROVED",
  "previousStatus": "CONFIRMED-SUCCESS",
  "currentStatus": "CONFIRMED-SUCCESS"
}
```

**FDC (Complete)** --- Change an existing fraud record using the complete endpoint.

`PUT fld/confirmed-frauds/issuer-frauds`

```json
{
  "refId": "ebb21942-eabd-42b6-87fd-69c19692bdc6",
  "timestamp": "2026-09-21T20:34:37-06:00",
  "icaNumber": "2684",
  "auditControlNumber": "743574790922240",
  "acquirerId": "2742",
  "cardNumber": "5500130000000021128",
  "fraudTypeCode": "01",
  "fraudSubTypeCode": "U",
  "cardProductCode": "CIR",
  "transactionDate": "20260622",
  "settlementDate": "20260622",
  "fraudPostedDate": "20260622",
  "cardholderReportedDate": "20260622",
  "transactionAmount": "56823",
  "transactionCurrencyCode": "840",
  "billingAmount": "56823",
  "billingCurrencyCode": "840",
  "merchantId": "6698696",
  "merchantName": "BANKNEWPORT",
  "merchantCity": "Phoenix",
  "merchantStateProvinceCode": "AZ",
  "merchantCountryCode": "USA",
  "merchantPostalCode": "85001",
  "merchantCategoryCode": "6011",
  "terminalAttendanceIndicator": "0",
  "terminalId": "5055D305",
  "terminalOperatingEnvironment": "1",
  "cardholderPresenceIndicator": "0",
  "cardPresenceIndicator": "1",
  "cardInPossession": "Y",
  "catLevelIndicator": "2",
  "terminalCapabilityIndicator": "0",
  "posEntryMode": "00",
  "cvcInvalidIndicator": "M",
  "avsResponseCode": "U",
  "authResponseCode": "00",
  "secureCode": "9",
  "accountDeviceType": "A",
  "transactionIndicator": "M205",
  "memo": "This is a sample FDC complete request.",
  "issuerSCAExemption": "09"
}
```

Expected result: `200 OK` with the same `auditControlNumber` and a `currentStatus` of `CONFIRMED-SUCCESS`.

```json
{
  "timestamp": "2026-09-21T08:33:47+00:00",
  "icaNumber": "2684",
  "refId": "ebb21942-eabd-42b6-87fd-69c19692bdc6",
  "responseCode": "000",
  "responseMessage": "Success",
  "auditControlNumber": "743574790922240",
  "matchLevelIndicator": "I",
  "previousStatus": "CONFIRMED-SUCCESS",
  "currentStatus": "CONFIRMED-SUCCESS"
}
```

**FDE** --- Confirm a suspended fraud record.

`PUT fld/confirmed-frauds/fraud-states`

```json
{
  "refId": "5ea0306d-a633-2480-12a5-ccab24117417",
  "timestamp": "2026-09-21T20:34:37-06:00",
  "icaNumber": "2684",
  "providerId": "10",
  "auditControlNumber": "395954220177408",
  "operationType": "FDE",
  "memo": "This is a sample FDE request.",
  "fraudPostedDate": "20250204"
}
```

Expected result: `200 OK` with `previousStatus` `CONFIRMED-SUSPENDED` and `currentStatus` `CONFIRMED-SUCCESS`.

```json
{
  "timestamp": "2026-09-21T07:23:52+00:00",
  "icaNumber": "2684",
  "refId": "5ea0306d-a633-2480-12a5-ccab24117417",
  "responseCode": "000",
  "responseMessage": "Success",
  "auditControlNumber": "395954220177408",
  "matchLevelIndicator": "M",
  "financialTransactionIndicator": "APPROVED",
  "previousStatus": "CONFIRMED-SUSPENDED",
  "currentStatus": "CONFIRMED-SUCCESS"
}
```

**FDD** --- Delete an existing fraud record.

`PUT fld/confirmed-frauds/fraud-states`

```json
{
  "timestamp": "2026-09-21T12:07:23",
  "icaNumber": "2684",
  "refId": "11d4122d-4v02-4984-1116-9f8321c6rc16",
  "providerId": "10",
  "operationType": "FDD",
  "auditControlNumber": "395954220177408",
  "memo": "This is a sample FDD EXT API request."
}
```

Expected result: `200 OK` with `previousStatus` `CONFIRMED-SUCCESS` and `currentStatus` `CONFIRMED-DELETED`.

```json
{
  "timestamp": "2026-09-21T07:32:03+00:00",
  "icaNumber": "2684",
  "refId": "11d4122d-4v02-4984-1116-9f8321c6rc16",
  "responseCode": "000",
  "responseMessage": "Success",
  "auditControlNumber": "395954220177408",
  "previousStatus": "CONFIRMED-SUCCESS",
  "currentStatus": "CONFIRMED-DELETED"
}
```

**FDS** --- Fetch the status of a fraud record.

`GET fld/confirmed-frauds/fraud-statuses/icas/2684?ref_id=f74f6461-c935-4137-1147-0d1629e16d72`

Expected result: `200 OK` and a response body describing the current status of the record.

```json
{
  "timestamp": "2026-09-21T07:28:17+00:00",
  "icaNumber": "2684",
  "refId": "f74f6461-c935-4137-1147-0d1629e16d72",
  "responseCode": "000",
  "responseMessage": "Success",
  "auditControlNumber": "395954220177408",
  "matchLevelIndicator": "M",
  "financialTransactionIndicator": "APPROVED",
  "authorizationResponse": "00 - Approved or completed successfully",
  "currentStatus": "CONFIRMED-SUCCESS",
  "channel": "EXT_API"
}
```

### Operation references {#operation-references}

Use these guides for full request and response parameters for each operation:

* [FDA Minimal Request and Response](https://developer.mastercard.com/fld-fraud-submission/documentation/parameters/fda-req-res-minimal/index.md) and [FDA Complete Request and Response](https://developer.mastercard.com/fld-fraud-submission/documentation/parameters/fda-req-res-complete/index.md)
* [FDC Minimal Request and Response](https://developer.mastercard.com/fld-fraud-submission/documentation/parameters/fdc-req-res-minimal/index.md) and [FDC Complete Request and Response](https://developer.mastercard.com/fld-fraud-submission/documentation/parameters/fdc-req-res-complete/index.md)
* [FDE Request and Response](https://developer.mastercard.com/fld-fraud-submission/documentation/parameters/fde-req-res/index.md) and [FDD Request and Response](https://developer.mastercard.com/fld-fraud-submission/documentation/parameters/fdd-req-res/index.md)
* [FDS Request and Response](https://developer.mastercard.com/fld-fraud-submission/documentation/parameters/fds-res/index.md)

For a guided, step-by-step walkthrough, use our [Testing Tutorial](https://developer.mastercard.com/fld-fraud-submission/documentation/use-cases/testing-tutorial/index.md).

## Negative testing {#negative-testing}

Negative testing confirms that invalid requests fail cleanly and return useful error details.

### Validate these behaviors {#validate-these-behaviors-1}

* Invalid field values return a `responseCode` of `100` (Failure) with a clear `ReasonCode` and `Description`.
* Requests that reference an unknown record return a `responseCode` of `200` (Failure) with a "record could not be found" message.
* Values outside the allowed length or format are rejected before processing.
* Undefined enum values, such as an unsupported `operationType`, are rejected.
* Encrypted endpoints reject malformed or unencrypted payloads when encryption is required.

### Negative test cases {#negative-test-cases}

Use the tabs below to view representative negative test cases for each FLD operation.
**Invalid `cardNumber` (Minimal)** --- Add a new fraud record with an out-of-range `cardNumber`.

`POST fld/confirmed-frauds/mastercard-frauds`

```json
{
  "timestamp": "2026-09-10T20:34:37-06:00",
  "icaNumber": "1017",
  "refId": "6b75dkeo-538d-4c91-85d5-8fd10cbcf2d1",
  "providerId": "10",
  "transactionIdentifiers": [
    { "cfcKey": "ARN", "cfcValue": "51043236132067814116788" }
  ],
  "cardNumber": "519947134163341300000",
  "transactionAmount": "4248",
  "transactionDate": "20260511",
  "fraudTypeCode": "06",
  "fraudPostedDate": "20260622",
  "fraudSubTypeCode": "U",
  "cardholderReportedDate": "20260622",
  "accountDeviceType": "F",
  "avsResponseCode": "",
  "cardInPossession": "Y",
  "authResponseCode": "00",
  "memo": "This is a sample FDA minimal request.",
  "issuerSCAExemption": "04"
}
```

Expected result: `Failure` (`responseCode` `100`) because `cardNumber` length is not within the allowed range of 12 to 19.

```json
{
  "timestamp": "2026-09-10T07:15:46+00:00",
  "refId": "6b75dkeo-538d-4c91-85d5-8fd10cbcf2d1",
  "responseCode": "100",
  "responseMessage": "Failure",
  "errorDetails": {
    "Errors": {
      "Error": [
        {
          "ReasonCode": "60004",
          "Description": "cardNumber attribute value length not in range. Minimum Length: 12 and Maximum Length: 19."
        }
      ]
    }
  }
}
```

**Invalid `ARN` (Complete)** --- Add a new fraud record with an out-of-range `ARN`.

`POST fld/confirmed-frauds/issuer-frauds`

```json
{
  "timestamp": "2026-09-10T20:34:37-06:00",
  "icaNumber": "13007",
  "operationType": "FDA",
  "refId": "b1ljmkob-478d-4bj8-9c2e-22aa2f2114b7",
  "acquirerId": "1611",
  "transactionIdentifiers": [
    { "cfcKey": "ARN", "cfcValue": "05210005174000001895414000" }
  ],
  "cardNumber": "5175461685365704",
  "fraudTypeCode": "06",
  "fraudSubTypeCode": "U",
  "cardProductCode": "MBD",
  "transactionDate": "20250601",
  "fraudPostedDate": "20260420",
  "settlementDate": "20260316",
  "cardholderReportedDate": "20260316",
  "transactionAmount": "2990",
  "transactionCurrencyCode": "392",
  "billingAmount": "3247",
  "billingCurrencyCode": "036",
  "merchantId": "38199501421",
  "merchantName": "ESTPREMIUM",
  "merchantCity": "FUKUIKEN",
  "merchantCountryCode": "JPN",
  "merchantPostalCode": "9188003",
  "merchantCategoryCode": "5661",
  "terminalAttendanceIndicator": "2",
  "terminalId": "99999999",
  "terminalOperatingEnvironment": "1",
  "terminalCapabilityIndicator": "6",
  "cardholderPresenceIndicator": "4",
  "cardPresenceIndicator": "0",
  "cardInPossession": "U",
  "catLevelIndicator": "0",
  "posEntryMode": "81",
  "cvcInvalidIndicator": "?",
  "electronicCommerceIndicator": "22",
  "avsResponseCode": "S",
  "authResponseCode": "40",
  "secureCode": "0",
  "accountDeviceType": "A",
  "memo": "null"
}
```

Expected result: `Failure` (`responseCode` `100`) because the `ARN` length must be exactly 23.

```json
{
  "timestamp": "2026-09-10T10:03:31+00:00",
  "refId": "b1ljmkob-478d-4bj8-9c2e-22aa2f2114b7",
  "responseCode": "100",
  "responseMessage": "Failure",
  "errorDetails": {
    "Errors": {
      "Error": [
        {
          "ReasonCode": "60004",
          "Description": "ARN attribute value length not in range. Minimum Length: 23 and Maximum Length: 23."
        }
      ]
    }
  }
}
```

**Invalid `auditControlNumber` (Minimal)** --- Change a record that references an unknown ACN.

`PUT fld/confirmed-frauds/mastercard-frauds`

```json
{
  "refId": "ed118n39-8748-4414-a162-d7cc12cb1vd5",
  "timestamp": "2026-09-21T20:34:37-06:00",
  "icaNumber": "2684",
  "auditControlNumber": "584849777181691",
  "cardholderReportedDate": "-",
  "issuerSCAExemption": "-",
  "memo": "This is a sample FDC minimal Nullify request",
  "fraudPostedDate": "20260916"
}
```

Expected result: `Failure` (`responseCode` `200`) because the record to be changed could not be found.

```json
{
  "timestamp": "2026-09-21T08:46:28+00:00",
  "refId": "ed118n39-8748-4414-a162-d7cc12cb1vd5",
  "responseCode": "200",
  "responseMessage": "Failure",
  "errorDetails": {
    "Errors": {
      "Error": [
        {
          "ReasonCode": "21803",
          "Description": "Record to be changed could not be found. Correct ACN and resubmit."
        }
      ]
    }
  }
}
```

**Invalid `auditControlNumber` (Complete)** --- Change a record that references an unknown ACN.

`PUT fld/confirmed-frauds/issuer-frauds`

```json
{
  "refId": "ebb21942-eabd-42b6-87fd-69c19692bdc1",
  "timestamp": "2026-09-21T20:34:37-06:00",
  "icaNumber": "2684",
  "auditControlNumber": "743574790922241",
  "acquirerId": "2742",
  "cardNumber": "5500130000000021128",
  "fraudTypeCode": "01",
  "fraudSubTypeCode": "U",
  "cardProductCode": "CIR",
  "transactionDate": "20260622",
  "settlementDate": "20260622",
  "fraudPostedDate": "20260622",
  "cardholderReportedDate": "20260622",
  "transactionAmount": "56823",
  "transactionCurrencyCode": "840",
  "billingAmount": "56823",
  "billingCurrencyCode": "840",
  "merchantId": "6698696",
  "merchantName": "BANKNEWPORT",
  "merchantCity": "Phoenix",
  "merchantStateProvinceCode": "AZ",
  "merchantCountryCode": "USA",
  "merchantPostalCode": "85001",
  "merchantCategoryCode": "6011",
  "terminalAttendanceIndicator": "0",
  "terminalId": "5055D305",
  "terminalOperatingEnvironment": "1",
  "cardholderPresenceIndicator": "0",
  "cardPresenceIndicator": "1",
  "cardInPossession": "Y",
  "catLevelIndicator": "2",
  "terminalCapabilityIndicator": "0",
  "posEntryMode": "00",
  "cvcInvalidIndicator": "M",
  "avsResponseCode": "U",
  "authResponseCode": "00",
  "secureCode": "9",
  "accountDeviceType": "A",
  "transactionIndicator": "M205",
  "memo": "This is a sample FDC complete request.",
  "issuerSCAExemption": "09"
}
```

Expected result: `Failure` (`responseCode` `200`) because the record to be changed could not be found.

```json
{
  "timestamp": "2026-09-21T08:47:28+00:00",
  "refId": "ebb21942-eabd-42b6-87fd-69c19692bdc1",
  "responseCode": "200",
  "responseMessage": "Failure",
  "errorDetails": {
    "Errors": {
      "Error": [
        {
          "ReasonCode": "21803",
          "Description": "Record to be changed could not be found. Correct ACN and resubmit."
        }
      ]
    }
  }
}
```

**Invalid `operationType`** --- Confirm a record with an undefined operation type.

`PUT fld/confirmed-frauds/fraud-states`

```json
{
  "refId": "5ea0306d-a633-2480-12a5-ccab24117417",
  "timestamp": "2026-09-21T20:34:37-06:00",
  "icaNumber": "2684",
  "providerId": "10",
  "auditControlNumber": "395954220177408",
  "operationType": "FDN",
  "memo": "This is a sample FDE request.",
  "fraudPostedDate": "20250204"
}
```

Expected result: `Failure` (`responseCode` `200`) because `operationType` is not a defined enum value.

```json
{
  "timestamp": "2026-09-21T08:48:09+00:00",
  "refId": "5ea0306d-a633-2480-12a5-ccab24117417",
  "responseCode": "200",
  "responseMessage": "Failure",
  "errorDetails": {
    "Errors": {
      "Error": [
        {
          "ReasonCode": "60006",
          "Description": "operationType attribute value is not a defined ENUM value."
        }
      ]
    }
  }
}
```

**Invalid `ref_id`** --- Fetch the status of a record using an unknown `ref_id`.

`GET fld/confirmed-frauds/fraud-statuses/icas/2684?ref_id=f74f6461-c935-4137-1147-0d1629e16d71`

Expected result: `Failure` (`responseCode` `200`) because the record searched could not be found.

```json
{
  "timestamp": "2026-09-21T08:48:40+00:00",
  "refId": "f74f6461-c935-4137-1147-0d1629e16d71",
  "responseCode": "200",
  "responseMessage": "Failure",
  "errorDetails": {
    "Errors": {
      "Error": [
        {
          "ReasonCode": "60127",
          "Description": "Record searched could not be found. Correct the input parameter and resubmit"
        }
      ]
    }
  }
}
```

### Example error response {#example-error-response}

Error responses follow a common structure. The `errorDetails` object wraps one or more `Error` entries, each carrying a `ReasonCode` and a `Description`:

```json
{
  "responseCode": "100",
  "responseMessage": "Failure",
  "errorDetails": {
    "Errors": {
      "Error": [
        {
          "ReasonCode": "60004",
          "Description": "cardNumber attribute value length not in range. Minimum Length: 12 and Maximum Length: 19."
        }
      ]
    }
  }
}
```

For the complete list of response codes, reason codes, and formatting rules, see [Codes and Formats](https://developer.mastercard.com/fld-fraud-submission/documentation/code-and-formats/index.md).

### Next steps {#next-steps}

* Consult the [API Reference](https://developer.mastercard.com/fld-fraud-submission/documentation/api-reference/index.md) for complete endpoint specifications, request and response schemas, and environment URLs.
* Download and run our [Reference Application](https://developer.mastercard.com/fld-fraud-submission/documentation/developer-tools/reff_app/index.md) to see a typical usage of the Confirmed Fraud API.
* If you run into issues, visit [Support](https://developer.mastercard.com/fld-fraud-submission/documentation/support/index.md) for FAQs and troubleshooting guidance.