# Testing source: https://developer.mastercard.com/mastercard-threat-intelligence/documentation/testing/index.md ## Overview {#overview} This document provides high-level testing scenarios for the Mastercard Threat Intelligence API endpoints. The scenarios are based on the Swagger definition and are intended to help validate request handling, response structure, filtering, sorting, pagination, entitlement behavior, and error handling across all supported use cases. ### Testing scope {#testing-scope} | Use case | Endpoint(s) covered | |---------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | Merchant Threat Intelligence | * `POST /exposures/domains` | | Payment Ecosystem Threat Intelligence | * `GET /exposures/vulnerabilities` | | Card Testing | * `POST /threats/observed-testings/searches` * `POST /threats/testing-behaviors/searches` * `POST /threats/transactions/searches` * `GET /threats/card-testings/filter-options` | ## Merchant Threat Intelligence Testing Scenarios {#merchant-threat-intelligence-testing-scenarios} ### Endpoint {#endpoint} ```plaintext POST /exposures/domains ``` ### Purpose {#purpose} Validate merchant domain risk lookup using domain inputs and inquiry reason. ### Request areas to validate {#request-areas-to-validate} | Area | Details | |---------------------------|-------------------------------------------------------------------------| | Request body | `DomainSearch` | | Required fields | `reason`, `domains` | | Allowed reason values | `MERCHANT_UNDERWRITING_CONCERNS`, `COLLUSIVE_MERCHANT`, `SCAM_MERCHANT` | | Domain list constraints | Minimum 1 domain, maximum 50 domains | | Expected success response | `DomainReportCollection` | | Expected error responses | `400 Bad Request`, `403 Forbidden` | ### Positive test scenarios {#positive-test-scenarios} | Scenario ID | Scenario | Request setup | Expected result | |-------------|----------------------------------------|------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------| | MTI-DOM-001 | Search a single valid merchant domain | Send one valid domain with a supported `reason`. | API returns `200`. Response contains `reports` array with requested domain and `status`. | | MTI-DOM-002 | Search multiple valid merchant domains | Send multiple valid domains, within the max item limit, with a supported `reason`. | API returns `200`. Response contains one report object per submitted domain where available. | | MTI-DOM-003 | Domain report with no risk observed | Send a domain that has no observed risk in test data. | API returns `200`. Report shows no-risk / lower-risk indicators as available in test data. | | MTI-DOM-004 | Domain report with risk observed | Send a domain configured with risk indicators in test data. | API returns `200`. Report includes `risksFound`, `totalRisks`, `categories`, and individual `risks`. | | MTI-DOM-005 | Failed domain report handling | Send a domain configured to return a failed report in test data. | API returns `200`. Report object includes the domain and `status: FAILED`. | | MTI-DOM-006 | Validate all supported inquiry reasons | Repeat valid domain search for each supported `reason` value. | API returns expected response for each supported reason. | ### Negative test scenarios {#negative-test-scenarios} | Scenario ID | Scenario | Request setup | Expected result | |-------------|------------------------|-----------------------------------------------------------------|---------------------------------------------------------------------------------| | MTI-DOM-007 | Missing `reason` | Omit `reason` from request body. | API returns `400 Bad Request`. | | MTI-DOM-008 | Invalid `reason` value | Use an unsupported value such as `MERCHANT_UNDERWRITING`. | API returns `400 Bad Request` with error description indicating allowed values. | | MTI-DOM-009 | Missing `domains` | Omit `domains` from request body. | API returns `400 Bad Request`. | | MTI-DOM-010 | Empty domain list | Send `domains: []`. | API returns `400 Bad Request`. | | MTI-DOM-011 | More than 50 domains | Send more than 50 domain names. | API returns `400 Bad Request`. | | MTI-DOM-012 | Invalid domain value | Send a domain value that does not meet validation requirements. | API returns `400 Bad Request`. | | MTI-DOM-013 | Unauthorized user | Call endpoint without required entitlement. | API returns `403 Forbidden` with access denied error. | ### Response validation checklist {#response-validation-checklist} | Validation item | Expected behavior | |-------------------|-------------------------------------------------------------------------------------------------------| | `reports` | Present in successful response. | | `domain` | Present for each report. | | `status` | Present for each report and uses `PASSED` or `FAILED`. | | `firstSeen` | Present when available and formatted as date-time. | | `timeMonitored` | Includes `years` and `months` when available. | | `categories` | Includes category-level risk details when status is `PASSED` and data is available. | | `risks` | Includes rule and timestamp details where applicable. | | `risks.timestamp` | May contain an ISO 8601 UTC date-time string or an empty string when the timestamp is not applicable. | | Error response | Includes `error` and `error_description`. Validate optional `details` field when returned. | ## Payment Ecosystem Threat Intelligence Testing Scenarios {#payment-ecosystem-threat-intelligence-testing-scenarios} ### Endpoint {#endpoint-1} ```text GET /exposures/vulnerabilities ``` ### Purpose {#purpose-1} Validate vulnerability search, filtering, pagination, sorting, and response schema for high-risk payment ecosystem vulnerabilities. ### Request areas to validate {#request-areas-to-validate-1} | Area | Details | |---------------------------|----------------------------------------------------------------------------------------------------| | Query parameters | `search_text`, `severity_label`, `lifecycle_phase`, `limit`, `offset`, `sort_by`, `sort_direction` | | Default pagination | `limit` default is 20, `offset` default is 0 | | Max page size | `limit` maximum is 500 | | Sort direction | `ASC`, `DESC` | | Expected success response | `VulnerabilityPage` | | Expected error responses | `400 Bad Request`, `403 Forbidden` | ### Positive test scenarios {#positive-test-scenarios-1} | Scenario ID | Scenario | Request setup | Expected result | |--------------|---------------------------------|----------------------------------------------------------------------|-------------------------------------------------------------------------------------------| | PETI-VUL-001 | Search without optional filters | Call endpoint without query parameters. | API returns `200` with default pagination behavior. | | PETI-VUL-002 | Search by free text | Use `search_text`, such as a vulnerability keyword. | API returns `200` with records matching available test data. | | PETI-VUL-003 | Filter by severity label | Use `severity_label=High` or another supported test value. | API returns `200`; returned records align to the requested severity when data exists. | | PETI-VUL-004 | Filter by lifecycle phase | Use `lifecycle_phase=Exploit Likely` or applicable test value. | API returns `200`; returned records align to requested lifecycle phase when data exists. | | PETI-VUL-005 | Combine text and filters | Use `search_text`, `severity_label`, and `lifecycle_phase` together. | API returns `200`; filters are applied together. | | PETI-VUL-006 | Validate pagination | Use `limit` and `offset`. | API returns `200` with `page.limit`, `page.offset`, and `page.total`. | | PETI-VUL-007 | Validate sorting ascending | Use `sort_direction=ASC`. | API returns `200`; result ordering follows the requested sort direction where applicable. | | PETI-VUL-008 | Validate sorting descending | Use `sort_direction=DESC`. | API returns `200`; result ordering follows the requested sort direction where applicable. | ### Negative test scenarios {#negative-test-scenarios-1} | Scenario ID | Scenario | Request setup | Expected result | |--------------|----------------------------------|------------------------------------------------|--------------------------------| | PETI-VUL-009 | Invalid `search_text` length | Send a search text outside allowed length. | API returns `400 Bad Request`. | | PETI-VUL-010 | Invalid `severity_label` length | Send a severity label outside allowed length. | API returns `400 Bad Request`. | | PETI-VUL-011 | Invalid `lifecycle_phase` length | Send a lifecycle phase outside allowed length. | API returns `400 Bad Request`. | | PETI-VUL-012 | Invalid `limit` below minimum | Send `limit=0`. | API returns `400 Bad Request`. | | PETI-VUL-013 | Invalid `limit` above maximum | Send `limit` greater than 500. | API returns `400 Bad Request`. | | PETI-VUL-014 | Invalid `offset` below minimum | Send a negative `offset`. | API returns `400 Bad Request`. | | PETI-VUL-015 | Invalid `sort_direction` | Send a value other than `ASC` or `DESC`. | API returns `400 Bad Request`. | | PETI-VUL-016 | Unauthorized user | Call endpoint without required entitlement. | API returns `403 Forbidden`. | ### Response validation checklist {#response-validation-checklist-1} | Validation item | Expected behavior | |---------------------------------|--------------------------------------------------------------------------------------------| | `records` | Present in successful response. | | `records.cveId` | Present for each returned vulnerability record. | | `records.riskScore` | Numeric value in the expected range when present. | | `records.severityLabel` | Present when available. | | `records.lifecyclePhase` | Present when available. | | `records.dateOfLifecycleChange` | Date-time format when present. | | `records.affectedProducts` | Array of affected products when present. | | `page.total` | Present in successful response. | | `page.offset` | Matches requested or default offset. | | `page.limit` | Matches requested or default limit. | | Error response | Includes `error` and `error_description`. Validate optional `details` field when returned. | ## Card Testing Scenarios {#card-testing-scenarios} ### Observed Testing Scenarios {#observed-testing-scenarios} #### Endpoint {#endpoint-2} ```text POST /threats/observed-testings/searches ``` #### Purpose {#purpose-2} Validate search for merchants confirmed to be used for card testing activity. #### Request areas to validate {#request-areas-to-validate-2} | Area | Details | |---------------------------|--------------------------------------------------------------------------------------------------------------------| | Request body | `ObservedTestingSearch` | | Search option | `searchText` | | Field filters | `acquirerName`, `acquirerIcas`, `merchantName`, `merchantId`, `terminalId`, `cardTestingMethod`, `cardCheckerName` | | Date filter | `cardTestingDateRange` | | Pagination | `page.limit`, `page.offset` | | Sorting | `sort.by`, `sort.direction` | | Expected success response | `ObservedTestingPage` | | Expected error responses | `400 Bad Request`, `403 Forbidden` | #### Positive test scenarios {#positive-test-scenarios-2} | Scenario ID | Scenario | Request setup | Expected result | |-------------|-----------------------------------|---------------------------------------------------|-----------------------------------------------------------------------------| | CT-OBS-001 | Search by free text | Send `searchText` only. | API returns `200` with matching observed testing records where available. | | CT-OBS-002 | Filter by acquirer name | Send `filters.fieldFilters.acquirerName`. | API returns `200`; records match acquirer filter where data exists. | | CT-OBS-003 | Filter by acquiring ICA | Send one or more `acquirerIcas`. | API returns `200`; records match requested ICA values where data exists. | | CT-OBS-004 | Filter by merchant name | Send `merchantName`. | API returns `200`; records match merchant name where data exists. | | CT-OBS-005 | Filter by merchant ID | Send `merchantId`. | API returns `200`; records match merchant ID where data exists. | | CT-OBS-006 | Filter by terminal ID | Send `terminalId`. | API returns `200`; records match terminal ID where data exists. | | CT-OBS-007 | Filter by card testing method | Send a supported `cardTestingMethod`. | API returns `200`; records match method where data exists. | | CT-OBS-008 | Filter by card checker name | Send `cardCheckerName`. | API returns `200`; records match card checker name where data exists. | | CT-OBS-009 | Filter by card testing date range | Send `cardTestingDateRange.start` and `end`. | API returns `200`; records fall within requested range where data exists. | | CT-OBS-010 | Combine search and filters | Send `searchText` with one or more field filters. | API returns `200`; combined criteria are applied. | | CT-OBS-011 | Validate pagination | Send `page.limit` and `page.offset`. | API returns `200` with expected `page` object. | | CT-OBS-012 | Validate sorting | Send `sort.by` and `sort.direction`. | API returns `200`; result ordering follows requested sort where applicable. | #### Negative test scenarios {#negative-test-scenarios-2} | Scenario ID | Scenario | Request setup | Expected result | |-------------|-----------------------------|-------------------------------------------------------|-----------------------------------------------------------------| | CT-OBS-013 | Invalid pagination limit | Send `page.limit` less than 1. | API returns `400 Bad Request` with pagination validation error. | | CT-OBS-014 | Invalid pagination offset | Send negative `page.offset`. | API returns `400 Bad Request`. | | CT-OBS-015 | Invalid sort direction | Send unsupported `sort.direction`. | API returns `400 Bad Request`. | | CT-OBS-016 | Invalid card testing method | Send unsupported `cardTestingMethod`. | API returns `400 Bad Request`. | | CT-OBS-017 | Invalid date range | Send malformed date-time values. | API returns `400 Bad Request`. | | CT-OBS-018 | Unauthorized user | Call endpoint without required acquiring entitlement. | API returns `403 Forbidden`. | #### Response validation checklist {#response-validation-checklist-2} | Validation item | Expected behavior | |-----------------------------|------------------------------------------| | `records` | Present in successful response. | | `records.acquirerName` | Present for each record. | | `records.acquirerCid` | Present for each record. | | `records.acquirerIca` | Present for each record. | | `records.merchantName` | Present for each record. | | `records.merchantId` | Present for each record. | | `records.cardTestingMethod` | Present and uses an allowed value. | | `records.cardCheckerName` | Present for each record. | | `records.cardTestingDate` | Present and formatted as date-time. | | `page` | Includes `total`, `offset`, and `limit`. | ### Testing Behaviors Scenarios {#testing-behaviors-scenarios} #### Endpoint {#endpoint-3} ```text POST /threats/testing-behaviors/searches ``` #### Purpose {#purpose-3} Validate search for merchants likely facilitating card testing activity based on aggregate transaction behavior. #### Request areas to validate {#request-areas-to-validate-3} | Area | Details | |---------------------------|----------------------------------------------------------------------------------------------------------------| | Request body | `TestingBehaviorSearch` | | Search option | `searchText` | | Field filters | `acquirerName`, `acquirerIcas`, `merchantName`, `merchantId`, `terminalId`, `classificationSeverity` | | Date filters | `classificationDateRange`, `mostRecentAuthorizationDateRange` | | Range filters | `asiTransactionCountRange`, `totalTransactionCountRange`, `clearingTransactionCountRange`, `approvalRateRange` | | Pagination | `page.limit`, `page.offset` | | Sorting | `sort.by`, `sort.direction` | | Expected success response | `TestingBehaviorPage` | | Expected error responses | `400 Bad Request`, `403 Forbidden` | #### Positive test scenarios {#positive-test-scenarios-3} | Scenario ID | Scenario | Request setup | Expected result | |-------------|----------------------------------------------------------|--------------------------------------------------------------------------|-----------------------------------------------------------------------------------| | CT-TB-001 | Search by free text | Send `searchText` only. | API returns `200` with matching testing behavior records where available. | | CT-TB-002 | Filter by classification severity | Send `classificationSeverity` as `HIGH`, `MEDIUM`, `LOW`, or `INACTIVE`. | API returns `200`; records match requested severity where data exists. | | CT-TB-003 | Filter by acquirer | Send `acquirerName` or `acquirerIcas`. | API returns `200`; records match acquiring entity where data exists. | | CT-TB-004 | Filter by merchant | Send `merchantName` or `merchantId`. | API returns `200`; records match merchant where data exists. | | CT-TB-005 | Filter by terminal ID | Send `terminalId`. | API returns `200`; records match terminal where data exists. | | CT-TB-006 | Filter by classification date range | Send `classificationDateRange.start` and `end`. | API returns `200`; records fall within range where data exists. | | CT-TB-007 | Filter by most recent authorization date range | Send `mostRecentAuthorizationDateRange.start` and `end`. | API returns `200`; records fall within range where data exists. | | CT-TB-008 | Filter by ASI transaction count range | Send `asiTransactionCountRange.min` and `max`. | API returns `200`; records match ASI range where data exists. | | CT-TB-009 | Filter by total transaction count range | Send `totalTransactionCountRange.min` and `max`. | API returns `200`; records match total transaction count range where data exists. | | CT-TB-010 | Filter by clearing transaction count range | Send `clearingTransactionCountRange.min` and `max`. | API returns `200`; records match clearing count range where data exists. | | CT-TB-011 | Filter by approval rate range | Send `approvalRateRange.min` and `max`. | API returns `200`; records match approval rate range where data exists. | | CT-TB-012 | Combine search, filters, ranges, pagination, and sorting | Send multiple criteria in one request. | API returns `200`; combined criteria are applied. | #### Negative test scenarios {#negative-test-scenarios-3} | Scenario ID | Scenario | Request setup | Expected result | |-------------|---------------------------------|-------------------------------------------------------|--------------------------------| | CT-TB-013 | Invalid classification severity | Send unsupported `classificationSeverity`. | API returns `400 Bad Request`. | | CT-TB-014 | Invalid count range | Send a range where `min` is greater than `max`. | API returns `400 Bad Request`. | | CT-TB-015 | Invalid approval rate range | Send approval rate outside 0 to 100. | API returns `400 Bad Request`. | | CT-TB-016 | Invalid date range | Send malformed date-time values. | API returns `400 Bad Request`. | | CT-TB-017 | Invalid pagination limit | Send `page.limit` less than 1. | API returns `400 Bad Request`. | | CT-TB-018 | Invalid sort direction | Send unsupported `sort.direction`. | API returns `400 Bad Request`. | | CT-TB-019 | Unauthorized user | Call endpoint without required acquiring entitlement. | API returns `403 Forbidden`. | #### Response validation checklist {#response-validation-checklist-3} | Validation item | Expected behavior | |---------------------------------------|----------------------------------------------------------| | `records.acquirerName` | Present for each record. | | `records.acquirerCid` | Present for each record. | | `records.acquirerIca` | Present for each record. | | `records.merchantName` | Present for each record. | | `records.merchantId` | Present for each record. | | `records.terminalId` | Present for each record. | | `records.classificationSeverity` | Present and uses `INACTIVE`, `LOW`, `MEDIUM`, or `HIGH`. | | `records.classificationDate` | Present and formatted as date-time. | | `records.mostRecentAuthorizationDate` | Present and formatted as date-time. | | `records.approvalRate` | Present and within 0 to 100. | | `records.asiTransactionCount` | Present and numeric. | | `records.totalTransactionCount` | Present and numeric. | | `records.clearingTransactionCount` | Present and numeric. | | `page` | Includes `total`, `offset`, and `limit`. | *** ** * ** *** ### Transactions Scenarios {#transactions-scenarios} #### Endpoint {#endpoint-4} ```text POST /threats/transactions/searches ``` #### Purpose {#purpose-4} Validate search for individual authorization attempts identified as high-confidence card testing transactions. #### Request areas to validate {#request-areas-to-validate-4} | Area | Details | |---------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | Request body | `TransactionsSearch` | | Search option | `searchText` | | Field filters | `customerName`, `issuerIcas`, `bins`, `bankNetReference`, `transactionStatusIndicator`, `issuerResponseCode`, `riskScore`, `reasonCode`, `acquirerIca`, `merchantId`, `merchantName` | | Date filter | `transactionDateRange` | | Amount filter | `transactionAmountRange` | | Pagination | `page.limit`, `page.offset` | | Sorting | `sort.by`, `sort.direction` | | Expected success response | `TransactionsPage` | | Expected error responses | `400 Bad Request`, `403 Forbidden` | #### Positive test scenarios {#positive-test-scenarios-4} | Scenario ID | Scenario | Request setup | Expected result | |-------------|----------------------------------------|----------------------------------------------|--------------------------------------------------------------------------------| | CT-TRX-001 | Search by free text | Send `searchText` only. | API returns `200` with matching transaction records where available. | | CT-TRX-002 | Filter by issuer name | Send `customerName`. | API returns `200`; records match issuer name where data exists. | | CT-TRX-003 | Filter by issuer ICA | Send one or more `issuerIcas`. | API returns `200`; records match issuer ICA where data exists. | | CT-TRX-004 | Filter by BIN | Send one or more `bins`. | API returns `200`; records match BIN values where data exists. | | CT-TRX-005 | Filter by Banknet reference | Send `bankNetReference`. | API returns `200`; matching transaction is returned where data exists. | | CT-TRX-006 | Filter by transaction status indicator | Send supported `transactionStatusIndicator`. | API returns `200`; records match status indicator where data exists. | | CT-TRX-007 | Filter by issuer response code | Send `issuerResponseCode`. | API returns `200`; records match response code where data exists. | | CT-TRX-008 | Filter by risk score | Send `riskScore`. | API returns `200`; records match risk score where data exists. | | CT-TRX-009 | Filter by reason code | Send `reasonCode`. | API returns `200`; records match reason code where data exists. | | CT-TRX-010 | Filter by acquirer ICA | Send `acquirerIca`. | API returns `200`; records match acquiring ICA where data exists. | | CT-TRX-011 | Filter by merchant | Send `merchantId` or `merchantName`. | API returns `200`; records match merchant where data exists. | | CT-TRX-012 | Filter by transaction date range | Send `transactionDateRange.start` and `end`. | API returns `200`; records fall within requested date range where data exists. | | CT-TRX-013 | Filter by transaction amount range | Send `transactionAmountRange.min` and `max`. | API returns `200`; records match amount range where data exists. | | CT-TRX-014 | Combine search and filters | Send `searchText` with multiple filters. | API returns `200`; combined criteria are applied. | | CT-TRX-015 | Validate pagination and sorting | Send `page` and `sort`. | API returns `200` with expected page object and sort behavior. | #### Negative test scenarios {#negative-test-scenarios-4} | Scenario ID | Scenario | Request setup | Expected result | |-------------|--------------------------------------|------------------------------------------------------|--------------------------------| | CT-TRX-016 | Invalid risk score below minimum | Send `riskScore` below 0. | API returns `400 Bad Request`. | | CT-TRX-017 | Invalid risk score above maximum | Send `riskScore` above 999. | API returns `400 Bad Request`. | | CT-TRX-018 | Invalid issuer response code | Send response code outside valid range. | API returns `400 Bad Request`. | | CT-TRX-019 | Invalid transaction status indicator | Send unsupported `transactionStatusIndicator`. | API returns `400 Bad Request`. | | CT-TRX-020 | Invalid transaction amount range | Send amount range where `min` is greater than `max`. | API returns `400 Bad Request`. | | CT-TRX-021 | Invalid transaction date range | Send malformed date-time values. | API returns `400 Bad Request`. | | CT-TRX-022 | Invalid pagination limit | Send `page.limit` less than 1. | API returns `400 Bad Request`. | | CT-TRX-023 | Invalid sort direction | Send unsupported `sort.direction`. | API returns `400 Bad Request`. | | CT-TRX-024 | Unauthorized user | Call endpoint without required issuing entitlement. | API returns `403 Forbidden`. | #### Response validation checklist {#response-validation-checklist-4} | Validation item | Expected behavior | |--------------------------------------|--------------------------------------------------------------------------| | `records.customerName` | Present for each record. | | `records.issuerCid` | Present for each record. | | `records.issuerIca` | Present for each record. | | `records.bin` | Present for each record. | | `records.transactionDate` | Present and formatted as date-time. | | `records.transactionAmount` | Present and numeric. | | `records.bankNetReference` | Present for each record. | | `records.transactionStatusIndicator` | Present and uses an allowed value. | | `records.riskScore` | Present and within 0 to 999. | | `records.reasonCode` | Present for each record. | | `records.acquirerIca` | Present for each record. | | `records.merchantId` | Present for each record. | | `records.merchantName` | Present for each record. | | `records.pan` | Present in schema; validate only with synthetic or approved test values. | | `records.transactionId` | Present for each record. | | `records.currencyCode` | Present and uses a three-letter currency code. | | `page` | Includes `total`, `offset`, and `limit`. | ### Card Testing: Filter Options Scenarios {#card-testing-filter-options-scenarios} #### Endpoint {#endpoint-5} ```text GET /threats/card-testings/filter-options ``` #### Purpose {#purpose-5} Validate retrieval of allowed CID, ICA, and BIN filter values based on the caller's API access. #### Request areas to validate {#request-areas-to-validate-5} | Area | Details | |---------------------------|---------------------------------------------------------| | Query parameter | `type` | | Required parameter | `type` | | Allowed values | `TRANSACTIONS`, `OBSERVED_TESTING`, `TESTING_BEHAVIORS` | | Expected success response | `Filters` | | Expected error responses | `400 Bad Request`, `403 Forbidden` | #### Positive test scenarios {#positive-test-scenarios-5} | Scenario ID | Scenario | Request setup | Expected result | |-------------|-------------------------------------------|--------------------------------|-----------------------------------------------------------------------------| | CT-FLT-001 | Retrieve transaction filter options | Send `type=TRANSACTIONS`. | API returns `200` with allowed `cids`, `icas`, and `bins` where applicable. | | CT-FLT-002 | Retrieve observed testing filter options | Send `type=OBSERVED_TESTING`. | API returns `200` with allowed `cids` and `icas` where applicable. | | CT-FLT-003 | Retrieve testing behaviors filter options | Send `type=TESTING_BEHAVIORS`. | API returns `200` with allowed `cids` and `icas` where applicable. | | CT-FLT-004 | Validate response list format | Send any supported `type`. | API returns arrays for filter option values. | #### Negative test scenarios {#negative-test-scenarios-5} | Scenario ID | Scenario | Request setup | Expected result | |-------------|------------------------|---------------------------------------------|-------------------------------------------------------------------------| | CT-FLT-005 | Missing type parameter | Omit `type`. | API returns `400 Bad Request`. | | CT-FLT-006 | Invalid type parameter | Send unsupported value. | API returns `400 Bad Request` with allowed values in error description. | | CT-FLT-007 | Unauthorized user | Call endpoint without required entitlement. | API returns `403 Forbidden`. | #### Response validation checklist {#response-validation-checklist-5} | Validation item | Expected behavior | |-----------------|--------------------------------------------------------------------------------------------| | `cids` | Returned as an array when available. | | `icas` | Returned as an array when available. | | `bins` | Returned as an array when applicable, especially for transaction filter options. | | Error response | Includes `error` and `error_description`. Validate optional `details` field when returned. | ## Cross-endpoint Testing Scenarios {#cross-endpoint-testing-scenarios} ### Authentication and entitlement {#authentication-and-entitlement} | Scenario ID | Scenario | Expected result | |----------------|----------------------------------------------------------------------|----------------------------------------------------------------------------------| | CROSS-AUTH-001 | Authorized user calls endpoint with correct entitlement. | API returns expected successful response. | | CROSS-AUTH-002 | User without entitlement calls endpoint. | API returns `403 Forbidden`. | | CROSS-AUTH-003 | User attempts to access data outside allowed CID, ICA, or BIN scope. | API returns access-restricted behavior as defined by entitlement implementation. | ### Pagination {#pagination} | Scenario ID | Scenario | Expected result | |----------------|--------------------------------------------------|-------------------------------------------------------------| | CROSS-PAGE-001 | Request first page using `limit=20`, `offset=0`. | API returns first page and page object reflects request. | | CROSS-PAGE-002 | Request later page using non-zero `offset`. | API returns records for requested offset where data exists. | | CROSS-PAGE-003 | Request max allowed `limit`. | API returns up to requested limit and page metadata. | | CROSS-PAGE-004 | Request invalid limit. | API returns `400 Bad Request`. | ### Sorting {#sorting} | Scenario ID | Scenario | Expected result | |----------------|-----------------------------|-----------------------------------------------------------------------| | CROSS-SORT-001 | Sort using `ASC`. | API returns `200` and records are sorted ascending where applicable. | | CROSS-SORT-002 | Sort using `DESC`. | API returns `200` and records are sorted descending where applicable. | | CROSS-SORT-003 | Use invalid sort direction. | API returns `400 Bad Request`. | ### Date range filtering {#date-range-filtering} | Scenario ID | Scenario | Expected result | |----------------|-------------------------------------------------------------------------------------|---------------------------------------------------------------------| | CROSS-DATE-001 | Send valid UTC start and end date-time values. | API returns `200`; records match requested range where data exists. | | CROSS-DATE-002 | Send malformed date-time values. | API returns `400 Bad Request`. | | CROSS-DATE-003 | Send future-only date range for fields where only current and past dates are valid. | API returns validation behavior as defined by implementation. | ### Error response format {#error-response-format} | Scenario ID | Scenario | Expected result | |---------------|------------------------------------|------------------------------------------------------------------------------------------| | CROSS-ERR-001 | Trigger `400 Bad Request`. | Response includes `error` and `error_description`. | | CROSS-ERR-002 | Trigger `403 Forbidden`. | Response includes `error` and `error_description`. | | CROSS-ERR-003 | Validate optional `details` field. | When present, `details` provides additional diagnostic information related to the error. | ## Suggested Test Execution Checklist {#suggested-test-execution-checklist} | Step | Validation activity | |------|-----------------------------------------------------------------------------------------------------| | 1 | Confirm endpoint is available in sandbox. | | 2 | Confirm test user has correct entitlement for the use case. | | 3 | Execute happy-path request. | | 4 | Validate response status code. | | 5 | Validate response schema and required fields. | | 6 | Validate field-level constraints and allowed values. | | 7 | Execute filter-specific tests. | | 8 | Execute pagination and sorting tests where supported. | | 9 | Execute negative tests for invalid request values. | | 10 | Execute unauthorized access test. | | 11 | Capture issues with request payload, endpoint, actual response, expected response, and environment. | ### Defect logging guidance {#defect-logging-guidance} When logging defects, include the following information: | Field | Description | |-------------------------------------|-----------------------------------------------------------------------| | Endpoint | API method and path. | | Environment | Sandbox or production-like test environment. | | Scenario ID | Scenario identifier from this document. | | Request payload or query parameters | Include sanitized request details. | | Expected result | What should have happened based on the Swagger. | | Actual result | What happened during testing. | | Response status code | HTTP status code returned by the API. | | Response body | Sanitized response body. | | Entitlement context | Whether the test user was authorized for the endpoint and data scope. | | Impact | Brief description of business or user impact. | ## Next Steps {#next-steps} Now that you have completed the testing scenarios, continue to the [Code and Formats](https://developer.mastercard.com/mastercard-threat-intelligence/documentation/code-and-formats/index.md) page to learn how to interpret API responses, handle errors, and troubleshoot common issues.