# Support
source: https://developer.mastercard.com/mastercard-threat-intelligence/documentation/support/index.md

## FAQ {#faq}

### General {#general}

* The Mastercard Threat Intelligence API provides REST API access to Mastercard Threat Intelligence data, enabling organizations to identify, assess, and investigate risks across the payment ecosystem. Available intelligence includes merchant domain risk, payment ecosystem vulnerabilities, and card testing activity. For a complete overview of the product, see the [Technical Documentation](https://developer.mastercard.com/mastercard-threat-intelligence/documentation/index.md)
* The API supports three primary [use cases](https://developer.mastercard.com/mastercard-threat-intelligence/documentation/use-cases/index.md):
  1. **[Merchant Threat Intelligence](https://developer.mastercard.com/mastercard-threat-intelligence/documentation/use-cases/merchant-threat-intelligence/index.md)** - assesses merchant domain risk using payment-focused fraud and cyber threat intelligence.
  2. **[Payment Ecosystem Threat Intelligence](https://developer.mastercard.com/mastercard-threat-intelligence/documentation/use-cases/peti-vulnerabilities/index.md)** - surfaces high-risk vulnerabilities affecting payment and e-commerce software.
  3. **Card Testing Intelligence** - identifies card testing activity through observed testing data, testing behavior data for [acquirers](https://developer.mastercard.com/mastercard-threat-intelligence/documentation/use-cases/card-testing-for-acquirers/index.md), high-confidence transaction data for [issuers](https://developer.mastercard.com/mastercard-threat-intelligence/documentation/use-cases/card-testing-for-issuers/index.md), and filter options for both.
* The API supports the following environments:
  * Sandbox: `https://sandbox.cyber.mastercard.com`
  * Production: `https://cyber.mastercard.com`
* The Mastercard Threat Intelligence API includes the following [endpoints](https://developer.mastercard.com/mastercard-threat-intelligence/documentation/api-reference/index.md):
  * `POST /exposures/domains` - Search merchant domains to assess merchant risk.
  * `GET /exposures/vulnerabilities` - Search high-risk vulnerabilities affecting payment platforms.
  * `POST /threats/observed-testings/searches` - Search observed testing data.
  * `POST /threats/testing-behaviors/searches` - Search testing behavior data.
  * `POST /threats/transactions/searches` - Search transactions identified as high-confidence card testing transactions.
  * `GET /threats/card-testings/filter-options` - Retrieve card testing filter option values.
* Any user with a Mastercard Developers account can request Sandbox access to explore and test the Mastercard Threat Intelligence API. Access to the Production environment requires product enrollment, API project setup, and the appropriate approved entitlements. Some endpoints are intended for acquiring workflows, while others are intended for issuing workflows. If the required entitlements are not configured correctly, the API may return a `403 Forbidden` response. For detailed onboarding and access instructions, follow the [Quick start guide](https://developer.mastercard.com/mastercard-threat-intelligence/documentation/quick-start-guide/index.md)

*** ** * ** ***

### Onboarding {#onboarding}

* To access the Mastercard Threat Intelligence API, create or use an existing Mastercard Developers account, create a project, select the applicable Mastercard Threat Intelligence API service, and generate Sandbox or Production credentials. Production access may require product enrollment and approval before credentials can be used.For detailed, follow [Quick start guide](https://developer.mastercard.com/mastercard-threat-intelligence/documentation/quick-start-guide/index.md)
* The Mastercard Threat Intelligence API uses OAuth 2.0. It does not use OAuth 1.0a. Authentication follows the Financial-grade API (FAPI) 2.0 Security Profile with private key JSON Web Token (JWT) client authentication and Demonstrating Proof of Possession (DPoP).
* You authenticate to the token endpoint with a client assertion signed by your private key. You then send the returned access token and a DPoP proof with every request.
* The [Mastercard OAuth 2.0 client library](https://github.com/Mastercard/oauth2-client-java) handles client assertion signing, DPoP proof creation, and token caching for you.
* Before integrating, confirm the following:
  * The Mastercard Threat Intelligence [use cases](https://developer.mastercard.com/mastercard-threat-intelligence/documentation/use-cases/index.md) you are integrating with.
  * Whether your organization requires issuer or acquirer access.
  * The environment you are testing in: Sandbox or Production.
  * The API credentials and approved entitlements for the project.
  * The Company ID (CID), Interbank Card Association (ICA), or Bank Identification Number (BIN) values available for your access scope, where applicable.
* A `403 Forbidden` response indicates that access is denied. This may happen when the API project, key, product enrollment, or user entitlement does not allow access to the requested endpoint or data scope. Confirm that the correct API service and environment are being used and that the required access has been approved.

*** ** * ** ***

### Integration {#integration}

* Use [POST /exposures/domains](https://developer.mastercard.com/mastercard-threat-intelligence/documentation/use-cases/merchant-threat-intelligence/index.md). The request body must include:
  * `reason` - the reason for the domain risk inquiry.
  * `domains` - one or more merchant domains to evaluate.

Supported `reason` values are:

* `MERCHANT_UNDERWRITING_CONCERNS`
* `COLLUSIVE_MERCHANT`
* `SCAM_MERCHANT`
* The `domains` field supports a minimum of 1 domain and a maximum of 50 domains per request. Review [Merchant Threat Intelligence](https://developer.mastercard.com/mastercard-threat-intelligence/documentation/use-cases/merchant-threat-intelligence/index.md)
* Use [GET /exposures/vulnerabilities](https://developer.mastercard.com/mastercard-threat-intelligence/documentation/use-cases/peti-vulnerabilities/index.md). You can search and filter results using optional query parameters such as:
  * `search_text`
  * `severity_label`
  * `lifecycle_phase`
  * `limit`
  * `offset`
  * `sort_by`
  * `sort_direction`
* Use `GET /threats/card-testings/filter-options` with the appropriate `type` query parameter to retrieve the filter option values available to you. Supported `type` values are [TRANSACTIONS](https://developer.mastercard.com/mastercard-threat-intelligence/documentation/use-cases/card-testing-for-issuers/index.md), [OBSERVED_TESTING](https://developer.mastercard.com/mastercard-threat-intelligence/documentation/use-cases/card-testing-for-acquirers/index.md), and [TESTING_BEHAVIORS](https://developer.mastercard.com/mastercard-threat-intelligence/documentation/use-cases/card-testing-for-acquirers/index.md).
* The endpoint returns the CID, ICA, and BIN values that have data for the selected dataset. An acquirer is identified by CID and ICA. An issuer is identified by CID, ICA, and BIN.
* This endpoint is optional. It is a convenient way to discover which identifiers have data before you build a request with the `/searches` endpoints.
* Use [POST /threats/observed-testings/searches](https://developer.mastercard.com/mastercard-threat-intelligence/documentation/use-cases/card-testing-for-acquirers/index.md). This endpoint supports text search, field filters, date range filters, pagination, and sorting. Example filter fields include acquirer name, acquiring ICA, merchant name, merchant ID, terminal ID, card testing method, and card checker name.
* Use [POST /threats/testing-behaviors/searches](https://developer.mastercard.com/mastercard-threat-intelligence/documentation/use-cases/card-testing-for-acquirers/index.md). This endpoint supports text search and filters such as acquirer information, merchant information, terminal ID, classification severity, classification date range, most recent authorization date range, transaction count ranges, clearing transaction count range, and approval rate range.
* Use [POST /threats/transactions/searches](https://developer.mastercard.com/mastercard-threat-intelligence/documentation/use-cases/card-testing-for-issuers/index.md). This endpoint supports text search and filters such as issuer name, issuer ICA, BIN, Banknet reference, transaction status indicator, issuer response code, risk score, reason code, acquirer ICA, merchant ID, merchant name, transaction date range, and transaction amount range.
* Search endpoints use `limit` and `offset` for pagination. The `limit` must be between 1 and 500. The `offset` must be between 0 and 99999999.
* The [GET /exposures/vulnerabilities](https://developer.mastercard.com/mastercard-threat-intelligence/documentation/use-cases/peti-vulnerabilities/index.md) endpoint defaults `limit` to 20 when you omit it.
* Each response includes a `page` object with `limit`, `offset`, and `total`, where `total` is the number of records that match your criteria.
* [POST /exposures/domains](https://developer.mastercard.com/mastercard-threat-intelligence/documentation/use-cases/merchant-threat-intelligence/index.md) returns a domain report collection. Each report may include the requested domain, first seen date, time monitored, domain age risk category, risk counts, risk categories, individual rules, timestamps, and report status.
* [GET /exposures/vulnerabilities](https://developer.mastercard.com/mastercard-threat-intelligence/documentation/use-cases/peti-vulnerabilities/index.md) returns a paginated vulnerability result set. Each record may include the Common Vulnerabilities and Exposures (CVE) ID, risk score, severity label, lifecycle phase, lifecycle change date, affected products, assessment, and description.
* Card Testing search endpoints return paginated result sets. Depending on the endpoint, records may include acquirer details, issuer details, merchant details, terminal ID, classification severity, transaction metrics, card testing dates, risk scores, reason codes, transaction identifiers, and pagination details.

*** ** * ** ***

### Policy {#policy}

* Yes. To protect service availability and ensure a consistent experience across all customers, the API is subject to API Gateway rate limiting. The current limit is 500 requests per second (RPS). If your integration requires expected request volumes or throughput planning, contact support before production launch.
* Yes. Sandbox credentials are used for testing in the Sandbox environment. Production access requires Production credentials and any required product enrollment or entitlement approvals, follow [Quick start guide](https://developer.mastercard.com/mastercard-threat-intelligence/documentation/quick-start-guide/index.md)
* Do not use real production Primary Account Numbers (PANs), customer-sensitive values, or unapproved production data in Sandbox testing. Use only synthetic or approved test data. If production data handling is required, follow Mastercard security, privacy, and data handling requirements for the approved environment.
* No. The Mastercard Threat Intelligence API does not use field-level payload encryption, such as JSON Web Encryption (JWE). All traffic is protected in transit by Transport Layer Security (TLS) over HTTPS.
* Responses can contain sensitive data, including merchant identifiers, transaction attributes, and PANs. You are responsible for protecting this data at rest and controlling access within your organization. Review [API Basics](https://developer.mastercard.com/mastercard-threat-intelligence/documentation/api-basics/index.md)
* Card Testing supports different workflows. Observed Testing and Testing Behaviors are acquirer-focused, while Transactions is issuer-focused. Access to each endpoint depends on the enrolled product, role, project configuration, and approved data scope.
* Yes. The API is compliant with Payment Card Industry (PCI) standards. For formal compliance, security, or legal questions, contact Mastercard support or your Mastercard representative.

*** ** * ** ***

### Performance {#performance}

* To protect service availability and ensure a consistent experience across all customers, the API is subject to API Gateway rate limiting. The current limit is 500 requests per second (RPS). If your use case requires a specific TPS target, contact support before production launch.
* Use targeted filters, appropriate pagination, and sorting only where needed. Avoid overly broad searches when a specific CID, ICA, BIN, merchant, domain, date range, or transaction identifier is available.

*** ** * ** ***

### Support {#support}

* For support, contact Mastercard API Support at [apisupport@mastercard.com](mailto:apisupport@mastercard.com) or visit [Mastercard Developers Support](https://developer.mastercard.com/support).

When contacting support, include the following details where available:

1. API name: Mastercard Threat Intelligence API.
2. Environment: Sandbox or Production.
3. Endpoint and HTTP method.
4. Request timestamp and correlation/reference ID, if available.
5. Sanitized request payload or query parameters.
6. Response status code and sanitized response body.
7. A short description of the issue and expected behavior.
8. Screenshots, logs, or error messages, if available.
* Use the [Mastercard API Status Page](https://developer.mastercard.com/api-status) to review API availability information.
* A `400 Bad Request` response means the request is invalid. Check required fields, allowed values, field lengths, pagination values, date-time format, filter values, and request body structure. The error response includes an `error_description` field with additional details.
* A `403 Forbidden` response means access was denied. Confirm that the API project, product enrollment, credentials, environment, and user entitlement are correct for the endpoint and data scope being requested.
* Error responses include:
  * `source` - application that generated the error.
  * `error` - unique error constant.
  * `recoverable` - whether retrying could change the outcome.
  * `error_description` - short description of the error.

## Get Help {#get-help}

### Contact us for Technical Support. {#contact-us-for-technical-support}