# Support
source: https://developer.mastercard.com/mastercard-processing-mastercard/documentation/support/index.md

## FAQ {#faq}

### General {#general}

The Mastercard Processing -- Mastercard Services API enables PAN-less issuers to integrate with Mastercard program APIs (such as the Mastercard Carbon Calculator API) without handling or storing the full Primary Account Number (PAN). The API retrieves the PAN internally from the Mastercard Processing Card Management System (CMS) using the `cardContractId` and returns a JWE-encrypted payload that can be forwarded directly to the target Mastercard program API. The API uses the following security methods:   
• **OAuth 1.0a** for client authentication.  
• **JSON Web Encryption (JWE)** for end-to-end payload encryption. Mastercard Processing is currently available in EMEA region.  
Additional countries may be supported based on demand and subject to Mastercard legal and compliance checks.

### Onboarding {#onboarding}

Access is granted through **Mastercard Developers** .   
To get started:   
• Create a project   
• Select **Mastercard Processing - Mastercard Services**   
• Generate Sandbox or Production credentials.   
For Production or MTF onboarding, a CIS-managed onboarding project is required.
* Sandbox: Provides simulated responses using mock data. Intended for early development and experimentation.
* Mastercard Test Facility (MTF): A Production-like environment used for full integration testing and User Acceptance Testing (UAT).
* Production: The live commercial environment.
* Sandbox access is available immediately after project creation and credential generation in Mastercard Developers.
* MTF and Production access is enabled as part of a **CIS-managed onboarding project**, which grants API access after configuration and approval.
All Sandbox and Production keys used by Mastercard Processing -- Mastercard Services expire after **13 months** .   
New keys must be generated through Mastercard Developers before expiration to ensure uninterrupted service.

### Integration {#integration}

Send a `POST` request to `/cards/searches` with the following information:

* `requestType` (currently supported value: `CARBON_CALCULATOR`)
* `carbonCalculatorProfiles` (a list containing `cardContractId` and required fields)
* `Client-Encryption-Key` (the public RSA key generated in Mastercard Developers for the Carbon Calculator API)  

The API then:

* Retrieves the PAN from the Mastercard Processing CMS.
* Constructs the downstream program payload.
* Encrypts the payload using the provided `Client-Encryption-Key`.
* Returns a JWE structure ready to be forwarded to the Mastercard Carbon Calculator API.
`cardContractId` is the technical identifier assigned to a card contract during issuance through Mastercard Processing Core APIs. It uniquely identifies the card within Mastercard Processing CMS. If `id` is omitted, the API automatically sets `id` = `cardContractId` inside the encrypted payload. Yes. You can include **up to 100 cards** in a single request. Each card must be represented as a separate `carbonCalculatorProfile` object. If one or more cardContractId values are invalid:

* The API returns a `failedCards` array containing the invalid identifiers (`cardContractId`).
* Each entry includes a `reasonCode` and a description.
* Valid cards are still processed and included in the encrypted payload.
Forward the complete JWE payload (`encryptedData`, `encryptedKey`, `publicKeyFingerprint`, `oaepHashingAlgorithm`, `iv`) unchanged (**as-is** ) to the Mastercard Carbon Calculator API `/service-providers/payment-cards` endpoint. Sandbox returns **static mock responses** based on predefined test values. These responses are simulated and are not retrieved from Mastercard Processing CMS.

### Policy and performance {#policy-and-performance}

No. The issuer never receives or has access to the PAN.  
The PAN is retrieved internally within the Mastercard Processing CMS and encrypted using the issuer's public Client Encryption Key. The resulting payload can only be decrypted by the Mastercard Carbon Calculator, which holds the corresponding private key. Yes, the service is payment card industry (PCI) compliant.   
It is specifically designed to keep issuers de-scoped (PAN-less) by ensuring that the PAN is never exposed to issuer systems. Sensitive data is protected through JWE payload encryption. The API supports a rate limit of 30 requests per second (RPS) per API client. The average response time per endpoint is under 490 ms.

## Get Help {#get-help}

### Contact us for Technical Support. {#contact-us-for-technical-support}