# Consume Card Testing
source: https://developer.mastercard.com/mastercard-threat-intelligence/tutorial/api-sandbox-guide/step-9/index.md

Card Testing intelligence helps you investigate card testing activity across the payment ecosystem. Card testing is when criminals run small authorization attempts to validate stolen card details before larger fraud.

*** ** * ** ***

### The Three Views {#the-three-views}

Card Testing exposes three complementary views:

|       View        |                        Purpose                        | Primary Users |
|-------------------|-------------------------------------------------------|---------------|
| Observed Testing  | Merchants confirmed to be used for card testing.      | Acquirers     |
| Testing Behaviors | Merchants that show behavior linked to card testing.  | Acquirers     |
| Transactions      | Individual authorizations identified as card testing. | Issuers       |

Issuers use the transactions view to find compromised cards. Acquirers use the observed testing and testing behaviors views to find affected merchants.

*** ** * ** ***

### The Search Endpoints {#the-search-endpoints}

Each view has its own search endpoint. All three accept a partial text search, field filters, sorting, and pagination:

* `observedTestingSearch` sends a POST request to `/threats/observed-testings/searches`.
* `testingBehaviorSearch` sends a POST request to `/threats/testing-behaviors/searches`.
* `transactionsSearch` sends a POST request to `/threats/transactions/searches`.

*** ** * ** ***

### The Filter Options Endpoint {#the-filter-options-endpoint}

Card Testing also offers an optional helper endpoint:

* `getFilterOptions` sends a GET request to `/threats/card-testings/filter-options`.

Both acquirers and issuers can call it. It returns the set of CIDs, ICAs, and BINs for which card testing data exists. You use these values to populate filters for the search endpoints.

The returned identifiers depend on the caller's role:

* An acquirer is identified by CID and ICA.
* An issuer is identified by CID, ICA, and BIN.

This endpoint is a convenience. You can search without it, but it helps you show only filter values that return data.

*** ** * ** ***

### The Code {#the-code}

Add this method to your application. It reads the filter options, then runs all three searches:

```java
/** Card Testing: investigate card testing activity across three views. */
static void runCardTesting(ApiClient apiClient) {
    System.out.println("== Card Testing ==");
    CardTestingApi api = new CardTestingApi(apiClient);

    try {
        System.out.println("Filter options (TRANSACTIONS): " + api.getFilterOptions("TRANSACTIONS"));
    } catch (ApiException e) {
        printError(e);
    }

    try {
        ObservedTestingSearch request = new ObservedTestingSearch()
                .searchText("Brooklyn")
                .page(new Pagination().limit(5).offset(0))
                .sort(new Sorting().by("cardTestingDate").direction(Sorting.DirectionEnum.DESC));
        System.out.println("Observed testing: " + api.observedTestingSearch(request));
    } catch (ApiException e) {
        printError(e);
    }

    try {
        TestingBehaviorSearch request = new TestingBehaviorSearch()
                .searchText("Brooklyn")
                .page(new Pagination().limit(5).offset(0))
                .sort(new Sorting().by("classificationDate").direction(Sorting.DirectionEnum.DESC));
        System.out.println("Testing behaviors: " + api.testingBehaviorSearch(request));
    } catch (ApiException e) {
        printError(e);
    }

    try {
        TransactionsSearch request = new TransactionsSearch()
                .filters(new TransactionFilters()
                        .fieldFilters(new TransactionFiltersFieldFilters()
                                .issuerIcas(List.of("900100001"))))
                .page(new Pagination().limit(5).offset(0))
                .sort(new Sorting().by("transactionDate").direction(Sorting.DirectionEnum.DESC));
        System.out.println("Transactions: " + api.transactionsSearch(request));
    } catch (ApiException e) {
        printError(e);
    }
    System.out.println();
}
```

The observed testing and testing behaviors searches use a free-text `searchText`. The transactions search instead uses a field filter. It narrows results to one issuer ICA with `issuerIcas`. You can find valid ICA values with the `getFilterOptions` call.

You set only the fields you want to filter on. The client omits the fields you leave unset, so the search is not over-constrained.

*** ** * ** ***

### Read the Response {#read-the-response}

Each search returns a page object with a list of records and pagination details. The `getFilterOptions` call returns a `Filters` object that holds the available `cids`, `icas`, and `bins`.

Your access scopes decide which views return data. A call outside your role can return an empty result or an access error, which the demo reports gracefully.

You assemble the full application, including the `printError` helper, in the next step.

*** ** * ** ***