# Testing
source: https://developer.mastercard.com/mastercard-agent-pay/documentation/testing/index.md
Use the following test scenarios and test cards to validate your integration in the sandbox environment.
Before you begin, review the [Verifiable Intent](https://developer.mastercard.com/mastercard-agent-pay/documentation/verifiable-intent/index.md) documentation to understand the credential hierarchy, trust model, and intent registration process used throughout the test scenarios. Familiarity with these concepts will help you understand how Identity Layer (L1), Authorization Layer (L2), and Execution Layer (L3) credentials are created, linked, and validated during intent registration and checkout.
### Test Scenarios {#test-scenarios}
| Test Area | Scenario |
|-------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------|
| [Identity Credential Enrollment](https://developer.mastercard.com/mastercard-agent-pay/documentation/testing/index.md#identity-credential-enrollment) | Enroll a payment card and create the Identity Layer (L1) credential. |
| [Immediate Purchase Flow](https://developer.mastercard.com/mastercard-agent-pay/documentation/testing/index.md#immediate-purchase-flow) | Register an Immediate intent using the Identity Layer (L1) and Authorization Layer (L2) credentials, then complete checkout. |
| [Autonomous Purchase Flow](https://developer.mastercard.com/mastercard-agent-pay/documentation/testing/index.md#autonomous-purchase-flow) | Register an Autonomous intent using the Identity Layer (L1), Authorization Layer (L2), and Execution Layer (L3) credentials, then complete checkout. |
| [Constraint Validation](https://developer.mastercard.com/mastercard-agent-pay/documentation/testing/index.md#constraint-validation) | Register an Autonomous intent that exceeds delegated constraints and verify that the intent is rejected. |
| [Trust Chain Validation](https://developer.mastercard.com/mastercard-agent-pay/documentation/testing/index.md#trust-chain-validation) | Register an intent with an invalid trust chain and verify that chain-of-trust validation fails. |
Note: This documentation reflects the August 2026 Sandbox release. Before integrating with Production, confirm the required fields, onboarding requirements, and implementation details with your Mastercard representative.
### Testing Notes {#testing-notes}
* Include `srcClientId` and `serviceId` in subsequent API requests where applicable.
* The Card Enrollment response in the **Identity Credential Enrollment** scenario returns `srcCorrelationId` and `srcDigitalCardId`. Save these values and use them in subsequent requests where applicable.
## Identity Credential Enrollment {#identity-credential-enrollment}
Enroll a payment card and generate the reusable Identity Layer (L1) credential. This credential serves as the foundation for both Immediate and Autonomous payment flows.
**Assumptions**
* The Agentic Commerce Provider (ACP) has onboarded an identity solution to Mastercard Checkout Solutions (MCS) and has received a `certifiedSolutionId`.
* The cardholder's PAN is eligible for tokenization.
**When**
> On the ACP interface, the cardholder initiates an agentic commerce experience and provides valid card details, including `primaryAccountNumber`, `panExpirationMonth`, `panExpirationYear`, and `cardSecurityCode`. The ACP encrypts the card data and calls the [Cards](https://developer.mastercard.com/mastercard-agent-pay/documentation/api-reference/index.md#card) API for enrollment.
```json
{
"srcClientId": "eccbf087-f159-4d69-b31d-00bec75c0474",
"serviceId": "SECURE_COF_COMMERCE_PLATFORM#SAMPLE_MERCHANT#01",
"cardSource": "CARDHOLDER",
"encryptedCard": "eyJhbGciOiJSU0EtT0FFUC0yNTYiLCJlbmMiOiJBMjU2R0NNIn0.g5H2kPq7Rc9nT1vLx4wZ...aB9cD3eF.Xy12ZtQ8mN.7bKr0LdWpa.Vv0Rt7"
}
```
**Then**
> **Step 1:**
> Upon successful enrollment, Mastercard returns the `maskedCard` object and `srcCorrelationId` to the ACP. Save the returned `srcDigitalCardId`, as it is required for subsequent API calls.
```json
{
"srcCorrelationId": "43d4c8e5-b57e-4794-ac9b-6a454c9325cb",
"maskedCard": {
"srcDigitalCardId": "LN5tPawLQK6M4y4jl7_vIQ000000000000US",
"panBin": "512034",
"panLastFour": "7890",
"tokenUniqueReference": "DM4MMC1US000000013a3b395556c420e85bfebe54b219e36",
"panExpirationMonth": "12",
"panExpirationYear": "2027",
"paymentCardType": "CREDIT",
"paymentCardDescriptor": "mastercard",
"paymentAccountReference": "50015018T6JE5ZORJON0QTP9HHMYN",
"dateOfCardCreated": "2025-06-12T14:29:30.685Z",
"digitalCardData": {
"status": "ACTIVE",
"descriptorName": "MasterCard Test Bank",
"issuerName": "Example Bank",
"isCoBranded": "false"
}
}
}
```
> **Step 2:**
> The ACP calls the [Authentication Methods Lookup](https://developer.mastercard.com/mastercard-agent-pay/documentation/api-reference/index.md#authentication) to retrieve the authentication methods available for the enrolled card. Verify that the response includes `MANAGED_AUTHENTICATION` in the `authenticationMethodType` field.
```json
{
"srcClientId": "eccbf087-f159-4d69-b31d-00bec75c0474",
"serviceId": "SECURE_COF_COMMERCE_PLATFORM#SAMPLE_MERCHANT#01",
"srcDigitalCardId": "LN5tPawLQK6M4y4jl7_vIQ000000000000US",
"srcCorrelationId": "43d4c8e5-b57e-4794-ac9b-6a454c9325cb",
"authenticationContext": {
"authenticationReasons": [
"CONSUMER_IDENTITY_VALIDATION",
"AUTHENTICATOR_REGISTRATION"
]
},
"srcDpaId": "5e0d4b84-189d-4c86-822d-590602f62062"
}
```
```json
{
"srcCorrelationId": "43d4c8e5-b57e-4794-ac9b-6a454c9325cb",
"authenticationMethods": [
{
"authenticationMethodType": "3DS",
"authenticationSubject": "CARDHOLDER",
"authenticationReasons": [
"ENROLL_FINANCIAL_INSTRUMENT",
"AUTHENTICATOR_REGISTRATION"
],
"uriData": {
"uri": "https://sandbox.src.mastercard.com/auth",
"uriType": "WEB_URI"
}
},
{
"authenticationMethodType": "MANAGED_AUTHENTICATION",
"authenticationSubject": "CARDHOLDER",
"authenticationReasons": [
"ENROLL_FINANCIAL_INSTRUMENT"
],
"uriData": {
"uri": "https://sandbox.src.mastercard.com/auth",
"uriType": "WEB_URI"
}
},
{
"authenticationMethodType": "FIDO2",
"authenticationSubject": "CARDHOLDER",
"authenticationReasons": [
"AUTHENTICATOR_REGISTRATION",
"TRANSACTION_AUTHENTICATION"
],
"uriData": {
"uri": "https://sandbox.src.mastercard.com/auth",
"uriType": "WEB_URI"
},
"authenticator": [
{
"type": "FIDO2",
"certifiedSolutionId": "10010",
"externalCredentialId": "39479fd5-53b0-4802-bb13-91518c9f9e35",
"credentialId": "pd295b2b-66ce-48d8-acbc-cc82f51479d8",
"credentials": {
"attestation": { },
"assertion": {
"device": { },
"client": "Binding / Payment Assertion - from client"
}
},
"status": "AVAILABLE",
"metadata": { }
}
]
},
{
"authenticationMethodType": "ISSUER_RBA",
"authenticationSubject": "CARDHOLDER",
"authenticationReasons": [
"ENROLL_FINANCIAL_INSTRUMENTS",
"CONSUMER_IDENTITY_VALIDATION"
],
"uriData": { }
}
],
"mfaEligibility": [
{
"certifiedMfaMethodId": "10001",
"certifiedSolutionId": "10001",
"authenticatingEntityId": "A3001",
"isMultiFactorAuthenticationSupported": true,
"isLiabilityShiftEligible": true
},
{
"certifiedMfaMethodId": "10002",
"certifiedSolutionId": "10002",
"authenticatingEntityId": "A3002",
"isMultiFactorAuthenticationSupported": true,
"isLiabilityShiftEligible": true
},
{
"certifiedMfaMethodId": "30001",
"certifiedSolutionId": "30001",
"authenticatingEntityId": "A1000",
"isMultiFactorAuthenticationSupported": false,
"isLiabilityShiftEligible": false
},
{
"certifiedMfaMethodId": "30002",
"certifiedSolutionId": "30002",
"authenticatingEntityId": "A1000",
"isMultiFactorAuthenticationSupported": false,
"isLiabilityShiftEligible": false
}
]
}
```
> **Step 3:**
> The ACP uses the [Authentication](https://developer.mastercard.com/mastercard-agent-pay/documentation/api-reference/index.md#authentication) API to create a Mastercard-managed authentication session for cardholder identity validation. Save the returned `authenticationSessionId`, authentication URI, and `sessionAssuranceValue`. The initial authentication state is `PENDING` or `NOT_AUTHENTICATED`.
```json
{
"srcClientId": "eccbf087-f159-4d69-b31d-00bec75c0474",
"serviceId": "SECURE_COF_COMMERCE_PLATFORM#SAMPLE_MERCHANT#01",
"srcDigitalCardId": "LN5tPawLQK6M4y4jl7_vIQ000000000000US",
"srcCorrelationId": "43d4c8e5-b57e-4794-ac9b-6a454c9325cb",
"authenticationMethod": {
"authenticationMethodType": "MANAGED_AUTHENTICATION",
"authenticationSubject": "CARDHOLDER"
},
"authenticationContext": {
"authenticationReasons": [
"CONSUMER_IDENTITY_VALIDATION"
],
"dpaData": {
"dpaPresentationName": "Ecom Holdings Online Inc",
"dpaName": "Ecom Holdings Online Inc",
"acquirerId": "M123456",
"acquirerBin": "A123456"
},
"dpaTransactionOptions": {
"merchantName": "Ecom Holdings Online Inc",
"merchantCategoryCode": "0020",
"merchantCountryCode": "US",
"threeDsInputData": {
"forceChallenge": true,
"billingAddress": {}
},
"dpaLocale": "en_US"
},
"callbackUri": {
"uri": "https://acp.example.com/callback",
"uriType": "WEB_URI"
}
}
}
```
```json
{
"srcCorrelationId": "43d4c8e5-b57e-4794-ac9b-6a454c9325cb",
"authenticationSessionId": "ad1aba13-3c44-47d2-8274-90a965b5749f",
"authenticationResult": "NOT_AUTHENTICATED",
"authenticationStatus": "PENDING",
"methodAttributes": {
"uriData": {
"uri": "https://sandbox.src.mastercard.com/auth",
"uriType": "WEB_URI"
}
},
"sessionAssuranceValue": "c2Vzc2lvbkFzc3VyYW5jZVZhbHVlU2FtcGxl",
"authenticationSessionExpiry": "2025-07-15T15:48:07+00:00"
}
```
> **Step 4:**
> The ACP redirects the cardholder to the Mastercard Managed Authentication UI using the authentication URI returned in Step 3. The UI guides the cardholder through identity verification and passkey registration.
> **Step 5:**
> The cardholder completes passkey registration in the Authentication UI. Mastercard sends the authentication outcome to the configured HTTPS `callbackUri`. If a callback is not received, for example due to a network interruption, verify the authentication status in Step 6 before continuing.
**Example URLs**
```text
- Example Authentication URL:
https://sandbox.src.mastercard.com/auth?sav=&traceId=
- HTTPS callbackUri example with base64-encoded authentication status
https://stage.mcsrcteststore.com/macstools/auth-processing?res=
```
> **Step 6:**
> The ACP retrieves the authentication session using the returned `authenticationSessionId` to confirm that passkey registration was completed successfully. Continue only when `authenticationResult` is `AUTHENTICATED` and `authenticationStatus` is `COMPLETE` (`verificationMethod` = `07`). Retain the returned `assuranceData` for the binding process.
```json
{
"srcClientId": "eccbf087-f159-4d69-b31d-00bec75c0474",
"serviceId": "SECURE_COF_COMMERCE_PLATFORM#SAMPLE_MERCHANT#01",
"srcDigitalCardId": "LN5tPawLQK6M4y4jl7_vIQ000000000000US",
"srcCorrelationId": "43d4c8e5-b57e-4794-ac9b-6a454c9325cb",
"srciTransactionId": "18df482e-31f2-4289-b0d7-4d768b72d3ed",
"authenticationSessionId": "ad1aba13-3c44-47d2-8274-90a965b5749f",
"authenticationMethod": {
"authenticationMethodType": "MANAGED_AUTHENTICATION",
"authenticationSubject": "CARDHOLDER"
}
}
```
```json
{
"srcCorrelationId": "43d4c8e5-b57e-4794-ac9b-6a454c9325cb",
"srciTransactionId": "18df482e-31f2-4289-b0d7-4d768b72d3ed",
"authenticationSessionId": "ad1aba13-3c44-47d2-8274-90a965b5749f",
"authenticationResult": "AUTHENTICATED",
"authenticationStatus": "COMPLETE",
"assuranceData": {
"verificationData": [
{
"verificationType": "CARDHOLDER",
"verificationEntity": "01",
"verificationMethod": "07",
"verificationResults": "01",
"verificationTimestamp": "1678294563",
"verificationEvents": [
"TRANSACTION_AUTHENTICATION"
],
"additionalData": "eyJraWQiOiJtYXN0ZXJjYXJkLXZpLWtleS0xIiwidHlwIjoiSldUIiwiYWxnIjoiUlMyNTYifQ.eyJhdWQiOiJodHRwczovL21hc3RlcmNhcmQuY29tIiwidmVyaWZpY2F0aW9uUmVzdWx0cyI6IjAxIn0.q8Xf2A9dHbLp5rT2vB6vNaC5dF8gH1jK3lM6nP9qR2s"
}
]
}
}
```
> **Step 7:**
> Generate a binding assertion JWT signed with the cardholder's private key using the `ES256` algorithm. Set the issuer (`iss`) to the ACP, the audience (`aud`) to Mastercard, and include the required credential-binding claims.
**Binding Assertion JWT**
**Header**
```json
{
"kid": "user-key-1",
"typ": "JWT+ext.binding_assertion_token",
"alg": "ES256"
}
```
**Payload**
```json
{
"iss": "https://acp.example.com",
"aud": "https://www.mastercard.com",
"iat": "1633632285",
"exp": "1633632285",
"jti": "7c9e6679-7425-40de-944b-e07fc1f90ae7",
"certifiedSolutionId": "10001",
"externalCredentialId": "39479fd5-53b0-4802-bb13-91518c9f9e35",
"mfaMethodConsentAt": "1633632285"
}
```
> **Step 8:**
> The ACP uses the [Bind](https://developer.mastercard.com/mastercard-agent-pay/documentation/api-reference/index.md#bindMfaMethod) Method to establish a binding between the cardholder and the certified solution. Include the binding assertion JWT generated in Step 7. Verify that `verificationMethod` is`05`, `verificationResults` is `01`, then decode `assuranceData.verificationData[0].additionalData` to obtain the L1 SD-JWT credential.
```json
{
"srcClientId": "eccbf087-f159-4d69-b31d-00bec75c0474",
"serviceId": "SECURE_COF_COMMERCE_PLATFORM#SAMPLE_MERCHANT#01",
"srcDigitalCardId": "LN5tPawLQK6M4y4jl7_vIQ000000000000US",
"srcCorrelationId": "43d4c8e5-b57e-4794-ac9b-6a454c9325cb",
"authenticator": {
"type": "PROPRIETARY",
"certifiedSolutionId": "10001",
"externalCredentialId": "39479fd5-53b0-4802-bb13-91518c9f9e35",
"credentials": {
"assertion": {
"client": "eyJraWQiOiJ1c2VyLWtleS0xIiwidHlwIjoiSldUK2V4dC5iaW5kaW5nX2Fzc2VydGlvbl90b2tlbiIsImFsZyI6IkVTMjU2In0.eyJpc3MiOiJodHRwczovL2FjcC5leGFtcGxlLmNvbSIsImF1ZCI6Imh0dHBzOi8vd3d3Lm1hc3RlcmNhcmQuY29tIn0.Kf7Xa2QzRb9nT1vLx4wZaB9cD3eFXy12Zt"
}
}
},
"assuranceData": {
"verificationData": [
{
"verificationEntity": "01",
"verificationEvents": [
"01"
],
"verificationType": "CARDHOLDER",
"verificationResults": "01",
"verificationMethod": "27",
"verificationTimestamp": "2023-04-20T20:33:10.111Z",
"additionalData": "eyJ0b2tlblVuaXF1ZVJlZmVyZW5jZSI6IkRFVklDRSBUVVIiLCJkc3JwQ3J5cHRvZ3JhbSI6InBsYWNlaG9sZGVyIn0="
}
]
}
}
```
```json
{
"srcCorrelationId": "43d4c8e5-b57e-4794-ac9b-6a454c9325cb",
"externalCredentialId": "39479fd5-53b0-4802-bb13-91518c9f9e35",
"status": "ACTIVE",
"credentialId": "pd295b2b-66ce-48d8-acbc-cc82f51479d8",
"assuranceData": {
"verificationData": [
{
"verificationType": "CARDHOLDER",
"verificationEntity": "02",
"verificationMethod": "05",
"verificationResults": "01",
"verificationTimestamp": "1782407763864",
"verificationEvents": [
"65"
],
"additionalData": "eyJhbGciOiJSUzI1NiIsImtpZCI6Im1hc3RlcmNhcmQtdmkta2V5LTEiLCJ0eXAiOiJzZCtqd3QifQ.eyJ2Y3QiOiJtYXN0ZXJjYXJkLmRpZ2l0YWxwYXltZW50Y3JlZGVudGlhbC4xIiwic2NvcGVzIjpbIklOVEVOVCJdfQ.Rb9nT1vLx4wZaB9cD3eFXy12Zt~"
}
]
}
}
```
> **Step 9:**
> The ACP decodes and validate the returned L1 SD-JWT. Confirm that `scope_data.card_id` matches the enrolled card, `cnf.jwk` contains the expected public key, and the `scopes` claim includes `INTENT`. The L1 credential remains valid for one year and can be reused in both Immediate and Autonomous payment flows.
**L1 SD-JWT structure**
**L1 Header**
```json
{
"alg": "RS256",
"kid": "mastercard-vi-key-1",
"typ": "sd+jwt"
}
```
**L1 Payload (always-visible claims)**
```json
{
"iss": "https://mastercard.com",
"sub": "pd295b2b-66ce-48d8-acbc-cc82f51479d8",
"aud": "https://mastercard.com",
"iat": 1752593587,
"exp": 1784129587,
"_sd_alg": "sha-256",
"vct": "mastercard.digitalpaymentcredential.1",
"cnf": { "jwk": { "kid": "user-key-1", "kty": "EC", "crv": "P-256", "x": "f83OjKq2rBhR2kP9dKzkY3vN8pQ2rT5wX9aZ1bC4dE", "y": "9dKzkY3vN8pQ2rT5wX9aZ1bC4dEf83OjKq2rBhR2kP" } },
"scheme": "Mastercard",
"scope_data": { "card_id": "LN5tPawLQK6M4y4jl7_vIQ000000000000US" },
"scopes": ["INTENT"]
}
```
## Immediate Purchase Flow {#immediate-purchase-flow}
In the Immediate purchase payment flow, use the Identity Layer (L1) credential created during Identity Credential Enrollment to generate an Authorization Layer (L2) payment mandate, authenticate the transaction, register the L1 and L2 intent, and complete checkout.
**Assumptions**
* A valid L1 SD-JWT and associated `srcDigitalCardId` are available from the Identity Credential Enrollment scenario
* The agent has assembled the final cart and is ready for cardholder approval.
* The ACP will register an Immediate intent using an L1 and L2 credential chain.
**When**
> The cardholder reviews and approves the payment details for the finalized cart. The ACP initiates passkey transaction authentication by calling the [Authentication](https://developer.mastercard.com/mastercard-agent-pay/documentation/api-reference/index.md#authentication) API with `authenticationReasons` value as `TRANSACTION_AUTHENTICATION`.
```json
{
"srcClientId": "eccbf087-f159-4d69-b31d-00bec75c0474",
"serviceId": "SECURE_COF_COMMERCE_PLATFORM#SAMPLE_MERCHANT#01",
"srcDigitalCardId": "LN5tPawLQK6M4y4jl7_vIQ000000000000US",
"srcCorrelationId": "43d4c8e5-b57e-4794-ac9b-6a454c9325cb",
"authenticationMethod": {
"authenticationMethodType": "MANAGED_AUTHENTICATION",
"authenticationSubject": "CARDHOLDER"
},
"authenticationContext": {
"authenticationReasons": [
"TRANSACTION_AUTHENTICATION"
],
"dpaData": {
"dpaPresentationName": "Ecom Holdings Online Inc",
"dpaName": "Ecom Holdings Online Inc",
"acquirerId": "M123456",
"acquirerBin": "A123456"
},
"dpaTransactionOptions": {
"transactionAmount": {
"transactionAmount": "60.98",
"transactionCurrencyCode": "USD"
},
"merchantName": "Ecom Holdings Online Inc",
"merchantCategoryCode": "0020",
"merchantCountryCode": "US",
"threeDsInputData": {
"forceChallenge": true,
"billingAddress": {}
},
"dpaLocale": "en_US"
},
"callbackUri": {
"uri": "https://acp.example.com/callback",
"uriType": "WEB_URI"
}
}
}
```
**Then**
> **Step 1:**
> Mastercard returns the authentication URI, `authenticationSessionId`, and `sessionAssuranceValue`. The initial authentication status is `PENDING`, and the authentication result value is `NOT_AUTHENTICATED`.
```json
{
"srcCorrelationId": "43d4c8e5-b57e-4794-ac9b-6a454c9325cb",
"authenticationSessionId": "ad1aba13-3c44-47d2-8274-90a965b5749f",
"authenticationResult": "NOT_AUTHENTICATED",
"authenticationStatus": "PENDING",
"methodAttributes": {
"intentId": "61XJzB_BQ9qa29nGa7JZrQ000000000000US",
"uriData": {
"uri": "https://sandbox.src.mastercard.com/auth",
"uriType": "WEB_URI"
}
},
"sessionAssuranceValue": "c2Vzc2lvbkFzc3VyYW5jZVZhbHVlU2FtcGxl",
"authenticationSessionExpiry": "2025-07-15T15:48:07+00:00"
}
```
> **Step 2:**
> The cardholder approves and authenticates the transaction using the registered passkey. After authentication is complete, Mastercard redirects the ACP to the configured callback URI.
> **Step 3:**
> The ACP retrieves the authentication session using the `authenticationSessionId` obtained during Identity Credential Enrollment. Continue only when `authenticationStatus` is `COMPLETE` and the response includes proof of authentication in `assuranceData.verificationData`.
```json
{
"srcClientId": "eccbf087-f159-4d69-b31d-00bec75c0474",
"serviceId": "SECURE_COF_COMMERCE_PLATFORM#SAMPLE_MERCHANT#01",
"srcDigitalCardId": "LN5tPawLQK6M4y4jl7_vIQ000000000000US",
"srcCorrelationId": "43d4c8e5-b57e-4794-ac9b-6a454c9325cb",
"srciTransactionId": "18df482e-31f2-4289-b0d7-4d768b72d3ed",
"authenticationSessionId": "ad1aba13-3c44-47d2-8274-90a965b5749f",
"authenticationMethod": {
"authenticationMethodType": "MANAGED_AUTHENTICATION",
"authenticationSubject": "CARDHOLDER"
}
}
```
```json
{
"srcCorrelationId": "43d4c8e5-b57e-4794-ac9b-6a454c9325cb",
"srciTransactionId": "18df482e-31f2-4289-b0d7-4d768b72d3ed",
"authenticationSessionId": "ad1aba13-3c44-47d2-8274-90a965b5749f",
"authenticationResult": "AUTHENTICATED",
"authenticationStatus": "COMPLETE",
"assuranceData": {
"verificationData": [
{
"verificationType": "CARDHOLDER",
"verificationEntity": "01",
"verificationMethod": "06",
"verificationResults": "01",
"verificationTimestamp": "1678294563",
"verificationEvents": [
"TRANSACTION_AUTHENTICATION"
],
"additionalData": "eyJraWQiOiJtYXN0ZXJjYXJkLXZpLWtleS0xIiwidHlwIjoiSldUIiwiYWxnIjoiUlMyNTYifQ.eyJhdWQiOiJodHRwczovL21hc3RlcmNhcmQuY29tIiwidmVyaWZpY2F0aW9uUmVzdWx0cyI6IjAxIn0.q8Xf2A9dHbLp5rT2vB6vNaC5dF8gH1jK3lM6nP9qR2s"
}
]
}
}
```
> **Step 4:**
> The ACP creates and sign the L2 closed payment mandate for the approved cart using the cardholder key bound to the L1 `cnf.jwk`.
>
> The resulting credential is serialized as:
>
> `eyJhbGciOiJFUzI1NiIsInR5cCI6ImtiLXNkLWp3dCJ9.eyJub25jZSI6ImtZM3ZOOHBRIn0.Kf7Xa2QzRb9nT1v~WyJzYWx0MTIzIiwibWFuZGF0ZS5wYXltZW50LjEiXQ~`.
**L2 SD-JWT (Immediate --- closed mandate)**
**L2 Header (without kid)**
```json
{
"alg": "ES256",
"typ": "kb-sd-jwt"
}
```
**L2 Payload (always-visible claims)**
```json
{
"nonce": "kY3vN8pQ2rT5wX9aZ1bC4d",
"iss": "https://acp.example.com/wallet",
"aud": "https://www.mastercard.com",
"iat": 1752593587,
"exp": 1752594487,
"sd_hash": "9gEhY7TZdmLr77dKazGkI16OH7K-bqKt5Nkq6D3un0",
"delegate_payload": [
{ "...": "aZ3rW1oQ7bTn0LdWpaVv0Rt7Kf7Xa2QzRb9nT1vLx4" },
{ "...": "bQ5OehVaxbGcfqwuAfoZ6CVANgTmfqmfL-j_HORCSg" }
],
"_sd_alg": "sha-256"
}
```
**L2 Disclosed Payment Mandates (only payment is revealed)**
```json
{
"vct": "mandate.payment.1",
"payment_instrument": { "type": "mastercard.srcDigitalCard", "id": "LN5tPawLQK6M4y4jl7_vIQ000000000000US", "description": "Mastercard **** 1234" },
"payment_amount": { "currency": "USD", "amount": 6098 },
"payee": { "name": "Ecom Holdings Online Inc", "website": "https://example.com/ecom-online-ltd/" },
"transaction_id": "Rt7Kf7Xa2QzRb9nT1vLx4wZaB9cD3eFXy12ZtQ8mNa"
}
```
> **Step 5:**
> The ACP base64-encode the L1 and L2 credentials, concatenate them using `~~`, and encrypt the resulting chain `base64(L1)~~base64(L2)` using the Mastercard public key to create a JWE payload.
**Chain of trust**
```text
Immediate: base64(L1)~~base64(L2)
Where base64 is standard base64 (RFC 4648 Section 4, with +, /, and = padding), not base64url.
Encrypt the assembled string as a JWE object using the Mastercard public key.
```
> **Step 6:**
> The ACP registers the Immediate verifiable intent by calling the [Verifiable Intent](https://developer.mastercard.com/mastercard-agent-pay/documentation/api-reference/index.md#verifiable-intent) API. Save the returned `intentId` and `orders[0].orderId`, which are required during checkout.
```json
{
"srcClientId": "eccbf087-f159-4d69-b31d-00bec75c0474",
"serviceId": "SECURE_COF_COMMERCE_PLATFORM#SAMPLE_MERCHANT#01",
"srcCorrelationId": "43d4c8e5-b57e-4794-ac9b-6a454c9325cb",
"externalAgentIdentifier": "cd0bb3c5-3d8d-4fb4-895a-337b28cd5ec9",
"digitalAccountCredentials": {
"digitalAccountReferenceType": "SRC_DIGITAL_CARD_ID",
"digitalAccountReferenceValue": "LN5tPawLQK6M4y4jl7_vIQ000000000000US"
},
"assuranceData": "eyJraWQiOiJtYXN0ZXJjYXJkLXZpLWtleS0xIiwidHlwIjoiSldUIiwiYWxnIjoiUlMyNTYifQ.eyJhdWQiOiJodHRwczovL21hc3RlcmNhcmQuY29tIiwidmVyaWZpY2F0aW9uUmVzdWx0cyI6IjAxIn0.q8Xf2A9dHbLp5rT2vB6vNaC5dF8gH1jK3lM6nP9qR2s",
"intentContext": {
"verifiableIntent": {
"format": "SD-JWT",
"encryptedPayload": "eyJhbGciOiJSU0EtT0FFUC0yNTYiLCJlbmMiOiJBMjU2R0NNIn0.Qw8Nm3pL5rT2vB...9kZHs4aC.rD6fG1hJ.n0Ld8YtQ.Rw1"
}
}
}
```
```json
{
"intentId": "61XJzB_BQ9qa29nGa7JZrQ000000000000US",
"srcCorrelationId": "43d4c8e5-b57e-4794-ac9b-6a454c9325cb",
"dateOfIntentCreated": "2025-07-15T15:33:07+00:00",
"dateOfIntentUpdated": "2025-07-15T15:33:07+00:00",
"externalAgentIdentifier": "cd0bb3c5-3d8d-4fb4-895a-337b28cd5ec9",
"orders": [
{
"orderId": "61XJzNWUwZDRiODQtMTg5Z000000000000US",
"dateOfOrderCreated": "2025-07-15T15:33:07+00:00",
"dateOfOrderUpdated": "2025-07-15T15:33:07+00:00",
"dateOfOrderExpiry": "2025-07-15T15:49:07+00:00"
}
]
}
```
> **Step 7:**
> The ACP calls the [Checkout](https://developer.mastercard.com/mastercard-agent-pay/documentation/api-reference/index.md#checkout) API to retrieve the checkout token payload. A successful response returns an approved order with `order.orderStatus` as `APPROVED`.
```json
{
"srcClientId": "eccbf087-f159-4d69-b31d-00bec75c0474",
"serviceId": "SECURE_COF_COMMERCE_PLATFORM#SAMPLE_MERCHANT#01",
"srcDigitalCardId": "LN5tPawLQK6M4y4jl7_vIQ000000000000US",
"srcCorrelationId": "43d4c8e5-b57e-4794-ac9b-6a454c9325cb",
"dpaTransactionOptions": {
"transactionAmount": {
"transactionAmount": "60.98",
"transactionCurrencyCode": "USD"
},
"customInputData": {
"orderId": "61XJzNWUwZDRiODQtMTg5Z000000000000US",
"intentId": "61XJzB_BQ9qa29nGa7JZrQ000000000000US"
},
"paymentOptions": [
{ "dynamicDataType": "CARD_APPLICATION_CRYPTOGRAM_SHORT_FORM" }
]
},
"dpaData": {
"dpaName": "Ecom Holdings Online Inc",
"dpaUri": "https://example.com/ecom-online-ltd/"
}
}
```
```json
{
"checkoutResponseJWS": {
"jose_header": {
"iss": "mastercard.com",
"iat": "1752593587",
"alg": "RS256",
"jti": "a7d63347-6162-4744-b2dc-948c615f569b",
"kid": "2025-vi-payload-verification"
},
"jws_payload": {
"srcCorrelationId": "43d4c8e5-b57e-4794-ac9b-6a454c9325cb",
"encryptedPayload": "eyJhbGciOiJSU0EtT0FFUC0yNTYiLCJlbmMiOiJBMjU2R0NNIn0.Mn4pLqZ9wRc7...Qz9p1Lx8.Yt3rB6vN.aC5dF8gH.R0k",
"maskedCard": {
"srcDigitalCardId": "LN5tPawLQK6M4y4jl7_vIQ000000000000US",
"panBin": "512034",
"panLastFour": "7890",
"tokenLastFour": "2608",
"digitalCardData": {
"status": "ACTIVE",
"descriptorName": "mastercard",
"artUri": "https://sbx.assets.mastercard.com/card-art/combined-image-asset/mastercard.png"
},
"panExpirationMonth": "12",
"panExpirationYear": "2027",
"paymentCardType": "DEBIT",
"serviceId": "SECURE_COF_COMMERCE_PLATFORM#SAMPLE_MERCHANT#01",
"dateOfCardCreated": "2025-07-15T15:33:07+00:00"
},
"order": {
"orderId": "61XJzNWUwZDRiODQtMTg5Z000000000000US",
"orderStatus": "APPROVED"
},
"keyFingerprintId": "db54c40e7deb35ddd7a721b3ee19f2e191a7be7777d8e5c505ed52634aa8e099",
"eci": "06"
},
"jws_signature": "MEUCIQDa7Bf9RcXy12ZtQ8mN7bKr0LdWpaVv0Rt7Kf7Xa2QzRbAiEA9nT1vLx4wZaB9cD3eFXy12ZtQ8mN7bKr0LdWpaVv0Rt7"
}
}
```
## Autonomous Purchase Flow {#autonomous-purchase-flow}
In the Autonomous purchase payment flow, use the Identity Layer (L1) credential created during Identity Credential Enrollment to delegate payment authority to an agent through an Authorization Layer (L2) open mandate. The agent then creates an Execution Layer (L3) execution mandate, registers the L1, L2, and L3 credential chain, and completes checkout.
**Assumptions**
* A valid L1 SD-JWT and associated `srcDigitalCardId` are available from the Identity Credential Enrollment test scenario.
* The cardholder has approved and authenticated the conditions for a future purchase.
* The agent has finalized the order within the delegated constraints and signed the L3 SD-JWT.
* The ACP will register an Autonomous intent using an L1, L2, and L3 chain of trust.
**When**
> The cardholder approves and authenticates the conditions of a future purchase, delegating execution authority to the Agent. The ACP initiates passkey transaction authentication by calling the [Authentication](https://developer.mastercard.com/mastercard-agent-pay/documentation/api-reference/index.md#authentication) API with `authenticationReasons` as `TRANSACTION_AUTHENTICATION` to authenticate the cardholder and confirm consent for the delegated purchase conditions.
```json
{
"srcClientId": "eccbf087-f159-4d69-b31d-00bec75c0474",
"serviceId": "SECURE_COF_COMMERCE_PLATFORM#SAMPLE_MERCHANT#01",
"srcDigitalCardId": "LN5tPawLQK6M4y4jl7_vIQ000000000000US",
"srcCorrelationId": "43d4c8e5-b57e-4794-ac9b-6a454c9325cb",
"authenticationMethod": {
"authenticationMethodType": "MANAGED_AUTHENTICATION",
"authenticationSubject": "CARDHOLDER"
},
"authenticationContext": {
"authenticationReasons": [
"TRANSACTION_AUTHENTICATION"
],
"dpaData": {
"dpaPresentationName": "Ecom Holdings Online Inc",
"dpaName": "Ecom Holdings Online Inc",
"acquirerId": "M123456",
"acquirerBin": "A123456"
},
"dpaTransactionOptions": {
"transactionAmount": {
"transactionAmount": "60.98",
"transactionCurrencyCode": "USD"
},
"merchantName": "Ecom Holdings Online Inc",
"merchantCategoryCode": "0020",
"merchantCountryCode": "US",
"threeDsInputData": {
"forceChallenge": true,
"billingAddress": {}
},
"dpaLocale": "en_US"
},
"callbackUri": {
"uri": "https://acp.example.com/callback",
"uriType": "WEB_URI"
}
}
}
```
**Then**
> **Step 1:**
> Mastercard returns the authentication URI, `authenticationSessionId`, and `sessionAssuranceValue`. The initial authentication status is `PENDING`, and the authentication result is `NOT_AUTHENTICATED`.
```json
{
"srcCorrelationId": "43d4c8e5-b57e-4794-ac9b-6a454c9325cb",
"authenticationSessionId": "ad1aba13-3c44-47d2-8274-90a965b5749f",
"authenticationResult": "NOT_AUTHENTICATED",
"authenticationStatus": "PENDING",
"methodAttributes": {
"intentId": "61XJzB_BQ9qa29nGa7JZrQ000000000000US",
"uriData": {
"uri": "https://sandbox.src.mastercard.com/auth",
"uriType": "WEB_URI"
}
},
"sessionAssuranceValue": "c2Vzc2lvbkFzc3VyYW5jZVZhbHVlU2FtcGxl",
"authenticationSessionExpiry": "2025-07-15T15:48:07+00:00"
}
```
> **Step 2:**
> The cardholder authenticates the delegated purchase conditions using the registered passkey. After authentication is complete, Mastercard redirects the ACP to the configured callback URI.
> **Step 3:**
> The ACP retrieves the authentication results by calling the [Authentication](https://developer.mastercard.com/mastercard-agent-pay/documentation/api-reference/index.md#authentication) API and using the `authenticationSessionId` obtained during **Identity Credential Enrollment**. Continue only after successful authentication and retain the assurance data for intent registration.
```json
{
"srcClientId": "eccbf087-f159-4d69-b31d-00bec75c0474",
"serviceId": "SECURE_COF_COMMERCE_PLATFORM#SAMPLE_MERCHANT#01",
"srcDigitalCardId": "LN5tPawLQK6M4y4jl7_vIQ000000000000US",
"srcCorrelationId": "43d4c8e5-b57e-4794-ac9b-6a454c9325cb",
"srciTransactionId": "18df482e-31f2-4289-b0d7-4d768b72d3ed",
"authenticationSessionId": "ad1aba13-3c44-47d2-8274-90a965b5749f",
"authenticationMethod": {
"authenticationMethodType": "MANAGED_AUTHENTICATION",
"authenticationSubject": "CARDHOLDER"
}
}
```
```json
{
"srcCorrelationId": "43d4c8e5-b57e-4794-ac9b-6a454c9325cb",
"srciTransactionId": "18df482e-31f2-4289-b0d7-4d768b72d3ed",
"authenticationSessionId": "ad1aba13-3c44-47d2-8274-90a965b5749f",
"authenticationResult": "AUTHENTICATED",
"authenticationStatus": "COMPLETE",
"assuranceData": {
"verificationData": [
{
"verificationType": "CARDHOLDER",
"verificationEntity": "01",
"verificationMethod": "06",
"verificationResults": "01",
"verificationTimestamp": "1678294563",
"verificationEvents": [
"TRANSACTION_AUTHENTICATION"
],
"additionalData": "eyJraWQiOiJtYXN0ZXJjYXJkLXZpLWtleS0xIiwidHlwIjoiSldUIiwiYWxnIjoiUlMyNTYifQ.eyJhdWQiOiJodHRwczovL21hc3RlcmNhcmQuY29tIiwidmVyaWZpY2F0aW9uUmVzdWx0cyI6IjAxIn0.q8Xf2A9dHbLp5rT2vB6vNaC5dF8gH1jK3lM6nP9qR2s"
}
]
}
}
```
> **Step 4:**
> The ACP creates and signs the L2 open payment mandate using the cardholder's key bound to the L1 `cnf` claim. The mandate embeds the agent's public key and delegated spending constraints, such as allowed payees and transaction amount limits.
**L2 SD-JWT (Autonomous --- open mandate)**
**L2 Header**
```json
{
"alg": "ES256",
"typ": "kb-sd-jwt+kb",
"kid": "user-key-1"
}
```
**L2 Payload**
```json
{
"nonce": "mB7nK2pL9qR4sT6vW8xY0z",
"iss": "https://acp.example.com/wallet",
"aud": "https://agent.example.com",
"iat": 1752593587,
"exp": 1755185587,
"sd_hash": "9gEhY7TZdmLr77dKazGkI16OH7K-bqKt5Nkq6D3un0",
"delegate_payload": [
{ "...": "cD3eFXy12ZtQ8mN7bKr0LdWpaVv0Rt7Kf7Xa2QzRb9" },
{ "...": "dF8gH1jK3lM6nP9qR2saC5-Rt7Kf7Xa2QzRb9nT1vL" }
],
"_sd_alg": "sha-256"
}
```
**L2 Disclosed Mandates**
```json
{
"vct": "mandate.payment.open.1",
"cnf": { "kid": "agent-key-1", "jwk": { "kty": "EC", "crv": "P-256", "x": "hR2kP9dKzkY3vN8pQ2rT5wX9aZ1bC4dEf83OjKq2rBh", "y": "kY3vN8pQ2rT5wX9aZ1bC4dEf83OjKq2rBhR2kP9dKz" } },
"payment_instrument": { "type": "mastercard.srcDigitalCard", "id": "LN5tPawLQK6M4y4jl7_vIQ000000000000US", "description": "..." },
"constraints": [
{ "type": "payment.allowed_payees", "allowed": [ { "...": "gH1jK3lM6nP9qR2saC5dF8-9gEhY7TZdmLr77dKazG" } ] },
{ "type": "payment.amount_range", "currency": "USD", "min": 0, "max": 999999 },
{ "type": "payment.reference", "conditional_transaction_id": "dF8gH1jK3lM6nP9qR2saC5-Rt7Kf7Xa2QzRb9nT1vL" }
]
}
```
> **Step 5:**
> After receiving delegated authority, the agent finalises the order and creates an L3 closed payment mandate that complies with the constraints defined in the L2 credential.
>
> The agent then signs the L3 credential using the key referenced in the L2 cnf claim (serialised as:
> `eyJhbGciOiJFUzI1NiIsInR5cCI6ImtiLXNkLWp3dCJ9.eyJub25jZSI6ImFDNWRGOGdIIn0.Rb9nT1vLx4wZaB9~WyJzYWx0OTg3IiwibWFuZGF0ZS5wYXltZW50LjEiXQ~`).
**L3 SD-JWT (Autonomous --- closed mandate)**
**L3 Header**
```json
{
"alg": "ES256",
"typ": "kb-sd-jwt",
"kid": "agent-key-1"
}
```
**L3 Payload**
```json
{
"nonce": "aC5dF8gH1jK3lM6nP9qR2s",
"iss": "https://agent.example.com",
"aud": "https://www.mastercard.com",
"iat": 1752593587,
"exp": 1752595387,
"sd_hash": "6CVANgTmfqmfL-j_HORCSg7bQ5OehVaxbGcfqwuAfoZ",
"delegate_payload": [ { "...": "eF83OjKq2rBhR2kP9dKzkY3vN8pQ2rT5wX9aZ1bC4d" } ],
"_sd_alg": "sha-256"
}
```
**L3 Disclosure**
```json
{
"vct": "mandate.payment.1",
"transaction_id": "tx-7f3a9c2e-4b1d-48e6-9a12",
"payee": { "id": "merchant-uuid", "name": "Ecom Holdings Online Inc", "website": "https://example.com/ecom-online-ltd/" },
"payment_amount": { "currency": "USD", "amount": 6098 },
"payment_instrument": { "type": "mastercard.srcDigitalCard", "id": "LN5tPawLQK6M4y4jl7_vIQ000000000000US", "description": "Mastercard **** 1234" }
}
```
> **Step 6:**
> The ACP base64-encode all credential layers, concatenate them using `~~`, and encrypt the resulting credential chain `base64(L1)~~base64(L2)~~base64(L3)` as a JWE using the Mastercard public key.
**Chain of trust**
```text
Autonomous: base64(L1)~~base64(L2)~~base64(L3)
Where base64 is standard base64 (RFC 4648 Section 4, with +, /, and = padding), not base64url.
Encrypt the assembled string as a JWE object using the Mastercard public key.
```
> **Step 7:**
> The ACP registers the Autonomous verifiable intent by calling the [Verifiable Intent](https://developer.mastercard.com/mastercard-agent-pay/documentation/api-reference/index.md#verifiable-intent) API. Save the returned `intentId` and `orders[0].orderId` for use during checkout.
```json
{
"srcClientId": "eccbf087-f159-4d69-b31d-00bec75c0474",
"serviceId": "SECURE_COF_COMMERCE_PLATFORM#SAMPLE_MERCHANT#01",
"srcCorrelationId": "43d4c8e5-b57e-4794-ac9b-6a454c9325cb",
"externalAgentIdentifier": "cd0bb3c5-3d8d-4fb4-895a-337b28cd5ec9",
"digitalAccountCredentials": {
"digitalAccountReferenceType": "SRC_DIGITAL_CARD_ID",
"digitalAccountReferenceValue": "LN5tPawLQK6M4y4jl7_vIQ000000000000US"
},
"assuranceData": "eyJraWQiOiJtYXN0ZXJjYXJkLXZpLWtleS0xIiwidHlwIjoiSldUIiwiYWxnIjoiUlMyNTYifQ.eyJhdWQiOiJodHRwczovL21hc3RlcmNhcmQuY29tIiwidmVyaWZpY2F0aW9uUmVzdWx0cyI6IjAxIn0.q8Xf2A9dHbLp5rT2vB6vNaC5dF8gH1jK3lM6nP9qR2s",
"intentContext": {
"verifiableIntent": {
"format": "SD-JWT",
"encryptedPayload": "eyJhbGciOiJSU0EtT0FFUC0yNTYiLCJlbmMiOiJBMjU2R0NNIn0.Vv0Xy7bTn0Ld...aZ3rW1oQ.Kf7Xa2Qz.p1Lx8YtR.Hs4"
}
}
}
```
```json
{
"intentId": "61XJzB_BQ9qa29nGa7JZrQ000000000000US",
"srcCorrelationId": "43d4c8e5-b57e-4794-ac9b-6a454c9325cb",
"dateOfIntentCreated": "2025-07-15T15:33:07+00:00",
"dateOfIntentUpdated": "2025-07-15T15:33:07+00:00",
"externalAgentIdentifier": "cd0bb3c5-3d8d-4fb4-895a-337b28cd5ec9",
"orders": [
{
"orderId": "61XJzNWUwZDRiODQtMTg5Z000000000000US",
"dateOfOrderCreated": "2025-07-15T15:33:07+00:00",
"dateOfOrderUpdated": "2025-07-15T15:33:07+00:00",
"dateOfOrderExpiry": "2025-07-15T15:49:07+00:00"
}
]
}
```
> **Step 8:**
> The ACP then calls the [Checkout](https://developer.mastercard.com/mastercard-agent-pay/documentation/api-reference/index.md#checkout) API to retrieve the checkout token payload. A successful response returns an approved order with `order.orderStatus` as `APPROVED`.
```json
{
"srcClientId": "eccbf087-f159-4d69-b31d-00bec75c0474",
"serviceId": "SECURE_COF_COMMERCE_PLATFORM#SAMPLE_MERCHANT#01",
"srcDigitalCardId": "LN5tPawLQK6M4y4jl7_vIQ000000000000US",
"srcCorrelationId": "43d4c8e5-b57e-4794-ac9b-6a454c9325cb",
"dpaTransactionOptions": {
"transactionAmount": {
"transactionAmount": "60.98",
"transactionCurrencyCode": "USD"
},
"customInputData": {
"orderId": "61XJzNWUwZDRiODQtMTg5Z000000000000US",
"intentId": "61XJzB_BQ9qa29nGa7JZrQ000000000000US"
},
"paymentOptions": [
{ "dynamicDataType": "CARD_APPLICATION_CRYPTOGRAM_SHORT_FORM" }
]
},
"dpaData": {
"dpaName": "Ecom Holdings Online Inc",
"dpaUri": "https://example.com/ecom-online-ltd/"
}
}
```
```json
{
"checkoutResponseJWS": {
"jose_header": {
"iss": "mastercard.com",
"iat": "1752593587",
"alg": "RS256",
"jti": "a7d63347-6162-4744-b2dc-948c615f569b",
"kid": "2025-vi-payload-verification"
},
"jws_payload": {
"srcCorrelationId": "43d4c8e5-b57e-4794-ac9b-6a454c9325cb",
"encryptedPayload": "eyJhbGciOiJSU0EtT0FFUC0yNTYiLCJlbmMiOiJBMjU2R0NNIn0.Mn4pLqZ9wRc7...Qz9p1Lx8.Yt3rB6vN.aC5dF8gH.R0k",
"maskedCard": {
"srcDigitalCardId": "LN5tPawLQK6M4y4jl7_vIQ000000000000US",
"panBin": "512034",
"panLastFour": "7890",
"tokenLastFour": "2608",
"digitalCardData": {
"status": "ACTIVE",
"descriptorName": "mastercard",
"artUri": "https://sbx.assets.mastercard.com/card-art/combined-image-asset/mastercard.png"
},
"panExpirationMonth": "12",
"panExpirationYear": "2027",
"paymentCardType": "DEBIT",
"serviceId": "SECURE_COF_COMMERCE_PLATFORM#SAMPLE_MERCHANT#01",
"dateOfCardCreated": "2025-07-15T15:33:07+00:00"
},
"order": {
"orderId": "61XJzNWUwZDRiODQtMTg5Z000000000000US",
"orderStatus": "APPROVED"
},
"keyFingerprintId": "db54c40e7deb35ddd7a721b3ee19f2e191a7be7777d8e5c505ed52634aa8e099",
"eci": "06"
},
"jws_signature": "MEUCIQDa7Bf9RcXy12ZtQ8mN7bKr0LdWpaVv0Rt7Kf7Xa2QzRbAiEA9nT1vLx4wZaB9cD3eFXy12ZtQ8mN7bKr0LdWpaVv0Rt7"
}
}
```
## Constraint Validation {#constraint-validation}
This scenario validates that Autonomous intent registration is rejected when the transaction exceeds the spending constraints delegated in the L2 open mandate. The agent creates an L3 order that violates one or more constraints defined in the L2 credential, causing intent registration to fail.
**Assumptions**
* The cardholder has delegated payment authority to the agent through an L2 open mandate that defines permitted payees and transaction limits.
* The agent creates an L3 order that exceeds one or more of the delegated constraints.
* The ACP submits the L1, L2, and L3 chain of trust for intent registration.
**When**
> The agent generates an order that violates one or more constraints defined in the L2 open mandate, such as exceeding the approved transaction amount or using a payee that is not permitted. For example, if the maximum L2 payment.amount_range is 6098 (USD 60.98), the L3 payment_amount is set to 7098 (USD 70.98).
> The ACP then submits the resulting L1, L2, and L3 credential chain and calls the [Verifiable Intent](https://developer.mastercard.com/mastercard-agent-pay/documentation/api-reference/index.md#verifiable-intent) API.
```json
{
"srcClientId": "eccbf087-f159-4d69-b31d-00bec75c0474",
"serviceId": "SECURE_COF_COMMERCE_PLATFORM#SAMPLE_MERCHANT#01",
"srcCorrelationId": "43d4c8e5-b57e-4794-ac9b-6a454c9325cb",
"externalAgentIdentifier": "cd0bb3c5-3d8d-4fb4-895a-337b28cd5ec9",
"digitalAccountCredentials": {
"digitalAccountReferenceType": "SRC_DIGITAL_CARD_ID",
"digitalAccountReferenceValue": "LN5tPawLQK6M4y4jl7_vIQ000000000000US"
},
"assuranceData": "eyJraWQiOiJtYXN0ZXJjYXJkLXZpLWtleS0xIiwidHlwIjoiSldUIiwiYWxnIjoiUlMyNTYifQ.eyJhdWQiOiJodHRwczovL21hc3RlcmNhcmQuY29tIiwidmVyaWZpY2F0aW9uUmVzdWx0cyI6IjAxIn0.q8Xf2A9dHbLp5rT2vB6vNaC5dF8gH1jK3lM6nP9qR2s",
"intentContext": {
"verifiableIntent": {
"format": "SD-JWT",
"encryptedPayload": "eyJhbGciOiJSU0EtT0FFUC0yNTYiLCJlbmMiOiJBMjU2R0NNIn0.Vv0Xy7bTn0Ld...aZ3rW1oQ.Kf7Xa2Qz.p1Lx8YtR.Hs4"
}
}
}
```
**Then**
> Mastercard rejects the intent because the payment amount specified in the L3 credential exceeds the constraints defined in the L2 mandate. No `intentId` or order is created. Update the credential chain to comply with the delegated constraints before attempting registration again.
```json
{
"status": 400,
"reason": "INVALID_STATE",
"message": "Verifiable intent validation failed",
"errordetail": [
{
"source": "intentContext.verifiableIntent.encryptedPayload",
"reason": "INVALID_VALUE",
"message": "A field value in the verifiable intent is inconsistent across credential layers",
"sourceType": "BODY"
}
]
}
```
## Trust Chain Validation {#trust-chain-validation}
This scenario validates that intent registration is rejected when the submitted SD-JWT credential chain fails chain-of-trust validation. Validation can fail because of an invalid signature, an untrusted signer, or missing required claims.
**Assumptions**
* The submitted SD-JWT credential chain contains an invalid signature, an untrusted signer, or is missing one or more required claims.
* The ACP submits the credential chain for intent registration.
**When**
> The ACP submits an SD-JWT credential chain that contains an invalid signature, an untrusted signer, or one or more missing required claims, and then calls the [Verifiable Intent](https://developer.mastercard.com/mastercard-agent-pay/documentation/api-reference/index.md#verifiable-intent) API.
```json
{
"srcClientId": "eccbf087-f159-4d69-b31d-00bec75c0474",
"serviceId": "SECURE_COF_COMMERCE_PLATFORM#SAMPLE_MERCHANT#01",
"srcCorrelationId": "43d4c8e5-b57e-4794-ac9b-6a454c9325cb",
"externalAgentIdentifier": "cd0bb3c5-3d8d-4fb4-895a-337b28cd5ec9",
"digitalAccountCredentials": {
"digitalAccountReferenceType": "SRC_DIGITAL_CARD_ID",
"digitalAccountReferenceValue": "LN5tPawLQK6M4y4jl7_vIQ000000000000US"
},
"assuranceData": "eyJraWQiOiJtYXN0ZXJjYXJkLXZpLWtleS0xIiwidHlwIjoiSldUIiwiYWxnIjoiUlMyNTYifQ.eyJhdWQiOiJodHRwczovL21hc3RlcmNhcmQuY29tIiwidmVyaWZpY2F0aW9uUmVzdWx0cyI6IjAxIn0.q8Xf2A9dHbLp5rT2vB6vNaC5dF8gH1jK3lM6nP9qR2s",
"intentContext": {
"verifiableIntent": {
"format": "SD-JWT",
"encryptedPayload": "eyJhbGciOiJSU0EtT0FFUC0yNTYiLCJlbmMiOiJBMjU2R0NNIn0.CORRUPTdata9nT1vLx...invalidSIG.zzzz0000.badpayload99.xx0"
}
}
}
```
**Then**
> Mastercard rejects the intent because the submitted credential chain fails validation. For example, an invalid or untrusted signature results in a `CORRUPT_DATA`, while missing required claims return `errordetail.reason: CANNOT_BE_NULL`.
```json
{
"status": 400,
"reason": "INVALID_STATE",
"message": "Verifiable intent validation failed",
"errordetail": [
{
"source": "intentContext.verifiableIntent.encryptedPayload",
"reason": "CORRUPT_DATA",
"message": "The verifiable intent presentation contains a credential with an untrusted signature",
"sourceType": "BODY"
}
]
}
```
## Test Cards {#test-cards}
Use the Sandbox environment to validate your Verifiable Intent integration. Before registering or authenticating an intent, ensure that the PAN has been successfully tokenized using an eligible test card.
### Tokenization Eligible Test Cards {#tokenization-eligible-test-cards}
| Card Number | Expiry Date (MMYY) | CVV | Region | Authentication Outcome |
|-------------------|--------------------|----------------|--------|---------------------------------------------------------------|
| 5120348833167890 | *Any Future Date* | *Any 3 digits* | *U.S.* | * Successful 3DS Challenge * Eligible for Mastercard Passkeys |
| 5120342356075028 | *Any Future Date* | *Any 3 digits* | *U.S.* | * Successful 3DS Challenge * Eligible for Mastercard Passkeys |
| 5204245286625466 | *Any Future Date* | *Any 3 digits* | *U.S.* | * Successful 3DS Challenge * Eligible for Mastercard Passkeys |
| 55204245357809585 | *Any Future Date* | *Any 3 digits* | *U.S.* | * Successful 3DS Challenge * Eligible for Mastercard Passkeys |
| 5204731620368483 | *Any Future Date* | *Any 3 digits* | *U.S.* | * Successful 3DS Challenge * Eligible for Mastercard Passkeys |
| 5204731620958796 | *Any Future Date* | *Any 3 digits* | *U.S.* | * Successful 3DS Challenge * Eligible for Mastercard Passkeys |