# API Basics
source: https://developer.mastercard.com/identity-insights-solutions/documentation/api-basics/index.md

## API Security {#api-security}

### Client Authentication {#client-authentication}

Mastercard uses MTLS for authenticating your application. You can manage your authentication keys from the Credentials Section of your Developer Zone Project or through Mastercard Connect's [Key Management Portal](https://static.developer.mastercard.com/content/identity-insights-for-transactions/KMP-User-Guide.pdf) after your Identity Insights Solution project has been created.
Tip: Do you want to learn more about the authentication scheme Mastercard uses? Read our [Using MTLS to Access Mastercard APIs](https://developer.mastercard.com/platform/documentation/security-and-authentication/using-mtls-to-access-mastercard-apis/) guide.  
For better latency, configure HTTP connection pooling and reuse persistent connections by including "Connection: keep-alive" in the header. When using mutual TLS (mTLS), ensure your HTTP client is configured to reuse authenticated connections, as some client libraries establish a new TLS connection for each request unless explicitly configured for connection reuse.

### Transport Encryption {#transport-encryption}

The transport between client applications and Mastercard is secured using [TLS / SSL](https://en.wikipedia.org/wiki/Transport_Layer_Security), which means data are encrypted by default when transmitted across networks.

### Payload Encryption (Optional) {#payload-encryption-optional}

Identity Insights Solutions service provides the option to use JWE to provide end-to-end payload encryption to secure sensitive data like Personally Identifying Information (PII). You can manage your encryption keys from your [Developer Dashboard](https://developer.mastercard.com/dashboard)..

Read the [Mastercard JWE Encryption Guide](https://developer.mastercard.com/platform/documentation/security-and-authentication/securing-sensitive-data-using-payload-encryption/#jwe-encryption).
Tip: Do you want to learn more about the encryption schemes Mastercard uses? Read our [Securing Sensitive Data Using Payload Encryption](https://developer.mastercard.com/platform/documentation/security-and-authentication/securing-sensitive-data-using-payload-encryption/) guides.

## How to Consume the Identity Insights Solutions Service API {#how-to-consume-the-identity-insights-solutions-service-api}

Note: There are multiple ways of integrating with the Identity Insights Solutions Service:

1. Using a generated API client (recommended)
2. Using a method of your choice

### Generating your own Identity Insights Solutions Service API Client {#generating-your-own-identity-insights-solutions-service-api-client}

Create customizable API clients from the Identity Insights Solutions [API specification](https://developer.mastercard.com/identity-insights-solutions/documentation/api-reference/index.md) and let Mastercard open-source client libraries handle the authentication for you. This approach offers more flexibility and is recommended.

Refer to the [Generating and Configuring a Mastercard API Client](https://developer.mastercard.com/platform/documentation/security-and-authentication/generating-and-configuring-a-mastercard-api-client/) tutorial.

### Using a Method of your Choice {#using-a-method-of-your-choice}

Identity Insights Solutions exposes a REST API and you are free to use the REST/HTTP client of your choice and can still leverage the Mastercard open-source [client authentication](https://developer.mastercard.com/platform/documentation/security-and-authentication/using-mtls-to-access-mastercard-apis/#client-libraries) and client encryption libraries for signing your requests and dealing with payload encryption.

Refer to the Identity Insights Solutions service [REST API Reference](https://developer.mastercard.com/identity-insights-solutions/documentation/api-reference/index.md).

If using Payload encryption, the following JWE Header Parameters must be included.

| **JWE Header Parameter** |                                                        **Description**                                                        |
|--------------------------|-------------------------------------------------------------------------------------------------------------------------------|
| enc                      | Content Encryption algorithm. Must have a value of A256GCM                                                                    |
| alg                      | Key Encryption algorithm. Must have a value of RSA-OAEP-256                                                                   |
| cty                      | application/json                                                                                                              |
| kid                      | Contains the public key fingerprint ID (the value is displayed under the Client Encryption Keys section of the project page). |

### Body {#body}

If using payload encryption, then the output of the payload encryption library is sent within the encryptedData field in the request to the API call to Identity Insights Solutions API, as shown below, replacing the below JWE Payload string with your encrypted message.

```json
{
  "encryptedData": "JWE Payload"
}
```

Tip: We strongly encourage you to use existing libraries rather than implementing the encryption and decryption steps yourself.

If you choose not to use payload encryption, then the request should be sent as per the example in the API Reference section.

## Environments {#environments}

This table describes the two different environments that are available.

| **Environment** |                                                               **Base URLs**                                                               |                                                                                                                  **Description**                                                                                                                   |
|-----------------|-------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Sandbox         | `https://sandbox.idv.mastercard.com/identity` `https://sandbox.idv.mastercard.eu/identity` `https://sandbox.idv.mastercard.asia/identity` | The pre-production test environment contains the latest pre-release or released version of the APIs, intended for full integration testing before moving to production. At this stage, use the Sandbox keys generated during the project creation. |
| Production      | `https://idv.mastercard.com/identity` `https://idv.mastercard.eu/identity` `https://idv.mastercard.asia/identity`                         | The production environment contains the latest production API release. You can request approval to obtain the Production keys. Once approved, you can proceed to complete testing in the Production environment before launching your solution.    |

## Next Steps {#next-steps}

Now that you have an understanding of the service authentication and encryption model, proceed to the [Use Cases](https://developer.mastercard.com/identity-insights-solutions/documentation/use-cases/index.md) section to see how the sample lifecycle flows map to create, retrieve, query, update, and delete operations.