# Push Multiple Accounts
source: https://developer.mastercard.com/mdes-token-connect/documentation/testing/push-multiple-accounts-test-case/index.md

|                                                                                      Scenarios                                                                                      |                              Description                              |
|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------|
| [Scenario 1](https://developer.mastercard.com/mdes-token-connect/documentation/testing/push-multiple-accounts-test-case/index.md#scenario-1--successful-multi-card-push)            | Successfully push two Mastercard credit cards to a Token Requestor    |
| [Scenario 2](https://developer.mastercard.com/mdes-token-connect/documentation/testing/push-multiple-accounts-test-case/index.md#scenario-2--push-with-signature-data)              | Successfully push cards with signature data and callback URL          |
| [Scenario 3](https://developer.mastercard.com/mdes-token-connect/documentation/testing/push-multiple-accounts-test-case/index.md#scenario-3--issuer-initiated-digitization-data)    | Successfully push cards requesting Issuer Initiated Digitization Data |
| [Scenario 4](https://developer.mastercard.com/mdes-token-connect/documentation/testing/push-multiple-accounts-test-case/index.md#scenario-4--missing-or-expired-token)              | Unauthorized request (missing/expired token)                          |
| [Scenario 5](https://developer.mastercard.com/mdes-token-connect/documentation/testing/push-multiple-accounts-test-case/index.md#scenario-5--missing-requestid-field)               | Missing required field 'requestId'                                    |
| [Scenario 6](https://developer.mastercard.com/mdes-token-connect/documentation/testing/push-multiple-accounts-test-case/index.md#scenario-6--missing-pushfundingaccounts-field)     | Missing required field 'pushFundingAccounts'                          |
| [Scenario 7](https://developer.mastercard.com/mdes-token-connect/documentation/testing/push-multiple-accounts-test-case/index.md#scenario-7--missing-tokenrequestorid-field)        | Missing required field 'tokenRequestorId'                             |
| [Scenario 8](https://developer.mastercard.com/mdes-token-connect/documentation/testing/push-multiple-accounts-test-case/index.md#scenario-8--missing-pushaccountid-field)           | Missing required field 'pushAccountId' in a funding account entry     |
| [Scenario 9](https://developer.mastercard.com/mdes-token-connect/documentation/testing/push-multiple-accounts-test-case/index.md#scenario-9--missing-accountnumber-field)           | Missing required field 'accountNumber' in card account data           |
| [Scenario 10](https://developer.mastercard.com/mdes-token-connect/documentation/testing/push-multiple-accounts-test-case/index.md#scenario-10--invalid-tokenrequestorid-length)     | Invalid value for 'tokenRequestorId' (wrong digit length)             |
| [Scenario 11](https://developer.mastercard.com/mdes-token-connect/documentation/testing/push-multiple-accounts-test-case/index.md#scenario-11--validity-period-below-minimum)       | 'pushAccountReceiptsValidityPeriod' below minimum allowed value       |
| [Scenario 12](https://developer.mastercard.com/mdes-token-connect/documentation/testing/push-multiple-accounts-test-case/index.md#scenario-12--validity-period-above-maximum)       | 'pushAccountReceiptsValidityPeriod' above maximum allowed value       |
| [Scenario 13](https://developer.mastercard.com/mdes-token-connect/documentation/testing/push-multiple-accounts-test-case/index.md#scenario-13--authentication-code-exceeds-maximum) | 'authenticationCode' exceeds maximum length                           |
| [Scenario 14](https://developer.mastercard.com/mdes-token-connect/documentation/testing/push-multiple-accounts-test-case/index.md#scenario-14--minimal-valid-request)               | Optional fields omitted --- minimal valid request                     |
| [Scenario 15](https://developer.mastercard.com/mdes-token-connect/documentation/testing/push-multiple-accounts-test-case/index.md#scenario-15--partial-push-mixed-outcome)          | Partial push --- one account succeeds, one account fails              |

*** ** * ** ***

## Scenario 1 -- Successful Multi-Card Push {#scenario-1--successful-multi-card-push}

**Assumptions**
> * The issuer has a valid Mastercard OAuth 1.0a access token for this environment.
> * Token Requestor `50110030273` (e.g., Google Pay) is active and enabled for the issuer's account ranges.
> * Both card account numbers (`5413339000001513` and `5413339000001521`) belong to the issuer's enabled account ranges and have not expired.
> * The encrypted payload is constructed using the MDES production public key and Mastercard payload encryption library.
> * `maj` path parameter is set to `1/0`.

**When**
> The issuer pushes two Mastercard credit cards to Google Pay in a single request, sending the encrypted card data along with the target Token Requestor.

Sample Request

```json
POST /mdes/connect/1/0/pushMultipleAccounts

{
  "requestId": "REQ-20240512-001",
  "tokenRequestorId": "50110030273",
  "pushFundingAccounts": {
    "encryptedPayload": {
      "publicKeyFingerprint": "243e6992ea467f1cbb9973facfcc3bf17b5cd007",
      "encryptedKey": "d5112fa08e554e3dbc455d06285...52e826dd10311cf0d63bbfb231a1a63ecc13",
      "oaepHashingAlgorithm": "SHA512",
      "iv": "1b9396c98ab2bfd195de661d70905a45",
      "encryptedData": [
        {
          "pushAccountId": "CA-132d72d4fcb2f4136a0532d3093ff1ab",
          "fundingAccountData": {
            "cardAccountData": {
              "accountNumber": "5413339000001513",
              "expiryMonth": "09",
              "expiryYear": "27"
            },
            "dataValidUntilTimestamp": "2026-05-12T15:00:00.000Z"
          }
        },
        {
          "pushAccountId": "CA-9e3f1a2b4c5d6e7f8a9b0c1d2e3f4a5b",
          "fundingAccountData": {
            "cardAccountData": {
              "accountNumber": "5413339000001521",
              "expiryMonth": "11",
              "expiryYear": "28"
            },
            "dataValidUntilTimestamp": "2026-05-12T15:00:00.000Z"
          }
        }
      ]
    }
  }
}
```

**Then**
> MDES returns HTTP 200 with a `responseId` matching the `requestId`, a `pushAccountReceipt` for each pushed card (prefixed `MCC-` for Mastercard Credit), and the available push methods (e.g., ANDROID, IOS, WEB) supported by Google Pay.

Sample Response

```json
{
  "responseId": "REQ-20240512-001",
  "pushAccountReceipts": [
    {
      "pushAccountId": "CA-132d72d4fcb2f4136a0532d3093ff1ab",
      "pushAccountReceipt": "MCC-C307F0AE-298E-48EB-AA43-A7C40B32DDDE"
    },
    {
      "pushAccountId": "CA-9e3f1a2b4c5d6e7f8a9b0c1d2e3f4a5b",
      "pushAccountReceipt": "MCC-A1B2C3D4-E5F6-7890-ABCD-EF1234567890"
    }
  ],
  "availablePushMethods": [
    {
      "type": "ANDROID",
      "uri": "https://pay.google.com/pushtoken?receipt={pushAccountReceipt}"
    },
    {
      "type": "IOS",
      "uri": "https://pay.google.com/pushtoken/ios?receipt={pushAccountReceipt}"
    },
    {
      "type": "WEB",
      "uri": "https://pay.google.com/pushtoken/web?receipt={pushAccountReceipt}"
    }
  ],
  "tokenRequestorSignatureSupport": false
}
```

*** ** * ** ***

## Scenario 2 -- Push With Signature Data {#scenario-2--push-with-signature-data}

**Assumptions**
> * The issuer has a valid Mastercard OAuth 1.0a access token.
> * Token Requestor `50110030273` supports signature verification (`tokenRequestorSignatureSupport = true`).
> * The issuer provides a callback URL for the Token Requestor to return the cardholder after provisioning.
> * The `signatureData` object is used so MDES can embed the push receipt and issuer callback info into a JWS-signed payload.
> * `maj` path parameter is `1/0`.

**When**
> The issuer pushes a single Mastercard debit card to a Token Requestor, including signature data with a callback URL and locale so that, after provisioning, the Token Requestor can redirect the cardholder back to the issuer app. The issuer also includes the cardholder's authentication code to confirm same-user presence.

Sample Request

```json
POST /mdes/connect/1/0/pushMultipleAccounts

{
  "requestId": "REQ-20240512-002",
  "tokenRequestorId": "50110030273",
  "authenticationCode": "847291",
  "pushFundingAccounts": {
    "encryptedPayload": {
      "publicKeyFingerprint": "243e6992ea467f1cbb9973facfcc3bf17b5cd007",
      "encryptedKey": "d5112fa08e554e3dbc455d06285...52e826dd10311cf0d63bbfb231a1a63ecc13",
      "oaepHashingAlgorithm": "SHA512",
      "iv": "3c8475fa12de334b96dc550631804b56",
      "encryptedData": [
        {
          "pushAccountId": "CA-debit-a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6",
          "fundingAccountData": {
            "cardAccountData": {
              "accountNumber": "5204740000001002",
              "expiryMonth": "06",
              "expiryYear": "26"
            },
            "accountHolderData": {
              "accountHolderName": "Smith/Jane",
              "accountHolderEmailAddress": "jane.smith@example.com"
            },
            "dataValidUntilTimestamp": "2026-05-12T15:30:00.000Z"
          }
        }
      ]
    }
  },
  "signatureData": {
    "callbackURL": "https://issuerbank.com/mobileapp/pushcomplete",
    "completeIssuerAppActivation": true,
    "completeWebsiteActivation": false,
    "accountHolderDataSupplied": true,
    "locale": "en_US",
    "tokenRequestorSessionId": "dbc55444-496a-4896-b41c-5d5e2dd431e2"
  }
}
```

**Then**
> MDES returns HTTP 200 with a `pushAccountReceipt` prefixed `DMC-` (Mastercard Debit) and a `signature` field containing the JWS-signed payload that the Token Requestor can use to validate the request has not been tampered with during redirection.

Sample Response

```json
{
  "responseId": "REQ-20240512-002",
  "pushAccountReceipts": [
    {
      "pushAccountId": "CA-debit-a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6",
      "pushAccountReceipt": "DMC-F4E3D2C1-B0A9-4837-9F2E-1B2C3D4E5F6A"
    }
  ],
  "availablePushMethods": [
    {
      "type": "ANDROID",
      "uri": "https://pay.google.com/pushtoken?receipt={pushAccountReceipt}"
    }
  ],
  "tokenRequestorSignatureSupport": true,
  "signature": "ew0KImFsZyI6ICJSUzI1NiIsDQoNCiJraWQiOiAiYXNkZmctcXdlcnR5LXp4Y3ZiIg0KfQ.ew0KDQrCoCJwdXNoQWNjb3VudFJlY2VpcHQiOiAiRE1DLUYyRTFEMEMxLUIwQTktNDgzNy05RjJFLTFCMkMzRDRFNUY2QSIsDQoiaXNzdWVyQ2FsbEJhY2siOiAiaHR0cHM6Ly9pc3N1ZXJiYW5rLmNvbS9tb2JpbGVhcHAvcHVzaGNvbXBsZXRlIg0KfQ.dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk"
}
```

*** ** * ** ***

## Scenario 3 -- Issuer Initiated Digitization Data {#scenario-3--issuer-initiated-digitization-data}

**Assumptions**
> * The issuer has a valid Mastercard OAuth 1.0a access token.
> * Token Requestor `50110030273` has `supportIssuerInitiatedDigitizationData = true`.
> * The issuer wants to receive the Base64-encoded `issuerInitiatedDigitizationData` in the response to pass proprietary funding account info directly to the Token Requestor.
> * `maj` path parameter is `1/0`.

**When**
> The issuer pushes one card and explicitly sets `requestIssuerInitiatedDigitizationData = true` to request that MDES include Issuer Initiated Digitization Data in each receipt entry of the response.

Sample Request

```json
POST /mdes/connect/1/0/pushMultipleAccounts

{
  "requestId": "REQ-20240512-003",
  "tokenRequestorId": "50110030273",
  "requestIssuerInitiatedDigitizationData": true,
  "pushFundingAccounts": {
    "encryptedPayload": {
      "publicKeyFingerprint": "243e6992ea467f1cbb9973facfcc3bf17b5cd007",
      "encryptedKey": "d5112fa08e554e3dbc455d06285...52e826dd10311cf0d63bbfb231a1a63ecc13",
      "oaepHashingAlgorithm": "SHA512",
      "iv": "5a7b9c1d2e3f4a5b6c7d8e9f0a1b2c3d",
      "encryptedData": [
        {
          "pushAccountId": "CA-idd-001-abc123def456ghi789",
          "fundingAccountData": {
            "cardAccountData": {
              "accountNumber": "5413339000002404",
              "expiryMonth": "03",
              "expiryYear": "29"
            },
            "dataValidUntilTimestamp": "2026-05-12T16:00:00.000Z"
          }
        }
      ]
    }
  }
}
```

**Then**
> MDES returns HTTP 200 with a `pushAccountReceipt` and includes the `issuerInitiatedDigitizationData` field (Base64-encoded funding account info) in the receipt entry, which the issuer can forward to the Token Requestor for direct provisioning.

Sample Response

```json
{
  "responseId": "REQ-20240512-003",
  "pushAccountReceipts": [
    {
      "pushAccountId": "CA-idd-001-abc123def456ghi789",
      "pushAccountReceipt": "MCC-E7F8A9B0-C1D2-3456-7890-ABCDEF123456",
      "issuerInitiatedDigitizationData": "eyJmdW5kaW5nQWNjb3VudEluZm8iOnsicHVzaEFjY291bnRSZWNlaXB0IjoiTUNDLUU3RjhBOUIwLUMxRDItMzQ1Ni03ODkwLUFCQ0RFRjEyMzQ1NiJ9fQ=="
    }
  ],
  "availablePushMethods": [
    {
      "type": "WEB",
      "uri": "https://pay.google.com/pushtoken/web?receipt={pushAccountReceipt}"
    }
  ],
  "tokenRequestorSignatureSupport": false
}
```

*** ** * ** ***

## Scenario 4 -- Missing Or Expired Token {#scenario-4--missing-or-expired-token}

**Assumptions**
> * The caller does not include a valid Mastercard OAuth 1.0a Authorization header, or the token has expired.
> * The MDES gateway rejects the request before it reaches the business logic layer.

**When**
> The issuer sends a structurally valid push request but with an absent or expired OAuth authorization header.

Sample Request

```json
POST /mdes/connect/1/0/pushMultipleAccounts
Authorization: (missing or expired OAuth token)

{
  "requestId": "REQ-20240512-004",
  "tokenRequestorId": "50110030273",
  "pushFundingAccounts": {
    "encryptedPayload": {
      "publicKeyFingerprint": "243e6992ea467f1cbb9973facfcc3bf17b5cd007",
      "encryptedKey": "d5112fa08e554e3dbc455d06285...52e826dd10311cf0d63bbfb231a1a63ecc13",
      "oaepHashingAlgorithm": "SHA512",
      "iv": "1b9396c98ab2bfd195de661d70905a45",
      "encryptedData": [
        {
          "pushAccountId": "CA-auth-test-001",
          "fundingAccountData": {
            "cardAccountData": {
              "accountNumber": "5413339000001513",
              "expiryMonth": "09",
              "expiryYear": "27"
            }
          }
        }
      ]
    }
  }
}
```

**Then**
> MDES returns an error response indicating that the caller is not authorized. No card data is pushed or receipts generated.

Sample Response

```json
{
  "errors": [
    {
      "source": "MDES",
      "reasonCode": "UNAUTHORIZED",
      "description": "OAuth signature validation failed. Ensure the Authorization header contains a valid, unexpired OAuth 1.0a token.",
      "recoverable": true
    }
  ]
}
```

*** ** * ** ***

## Scenario 5 -- Missing requestId Field {#scenario-5--missing-requestid-field}

**Assumptions**
> * The caller has a valid OAuth token.
> * All other required fields are present and valid.
> * `requestId` is omitted entirely from the request body.

**When**
> The issuer submits a push request without including the mandatory `requestId` field, which MDES uses to correlate the request with the response and for idempotency tracking.

Sample Request

```json
POST /mdes/connect/1/0/pushMultipleAccounts

{
  "tokenRequestorId": "50110030273",
  "pushFundingAccounts": {
    "encryptedPayload": {
      "publicKeyFingerprint": "243e6992ea467f1cbb9973facfcc3bf17b5cd007",
      "encryptedKey": "d5112fa08e554e3dbc455d06285...52e826dd10311cf0d63bbfb231a1a63ecc13",
      "oaepHashingAlgorithm": "SHA512",
      "iv": "1b9396c98ab2bfd195de661d70905a45",
      "encryptedData": [
        {
          "pushAccountId": "CA-132d72d4fcb2f4136a0532d3093ff1ab",
          "fundingAccountData": {
            "cardAccountData": {
              "accountNumber": "5413339000001513",
              "expiryMonth": "09",
              "expiryYear": "27"
            }
          }
        }
      ]
    }
  }
}
```

**Then**
> MDES returns an error response indicating that `requestId` is a required field. No push receipts are generated.

Sample Response

```json
{
  "errors": [
    {
      "source": "INPUT",
      "reasonCode": "MISSING_REQUIRED_FIELD",
      "description": "Missing required field - requestId",
      "recoverable": false
    }
  ]
}
```

*** ** * ** ***

## Scenario 6 -- Missing pushFundingAccounts Field {#scenario-6--missing-pushfundingaccounts-field}

**Assumptions**
> * The caller has a valid OAuth token.
> * `requestId` and `tokenRequestorId` are present and valid.
> * The `pushFundingAccounts` object (which contains the encrypted card data) is omitted.

**When**
> The issuer sends a push request with no card data --- the `pushFundingAccounts` field containing the encrypted payload is absent from the request body.

Sample Request

```json
POST /mdes/connect/1/0/pushMultipleAccounts

{
  "requestId": "REQ-20240512-006",
  "tokenRequestorId": "50110030273"
}
```

**Then**
> MDES returns an error indicating that the encrypted funding accounts payload is required. No push operations are performed.

Sample Response

```json
{
  "errors": [
    {
      "source": "INPUT",
      "reasonCode": "MISSING_REQUIRED_FIELD",
      "description": "Missing required field - pushFundingAccounts",
      "recoverable": false
    }
  ]
}
```

*** ** * ** ***

## Scenario 7 -- Missing tokenRequestorId Field {#scenario-7--missing-tokenrequestorid-field}

**Assumptions**
> * The caller has a valid OAuth token.
> * `requestId` and `pushFundingAccounts` are present and valid.
> * `tokenRequestorId` is omitted --- MDES cannot determine which Token Requestor to push the card(s) to.

**When**
> The issuer submits a push request with card data but without specifying which Token Requestor should receive the cards.

Sample Request

```json
POST /mdes/connect/1/0/pushMultipleAccounts

{
  "requestId": "REQ-20240512-007",
  "pushFundingAccounts": {
    "encryptedPayload": {
      "publicKeyFingerprint": "243e6992ea467f1cbb9973facfcc3bf17b5cd007",
      "encryptedKey": "d5112fa08e554e3dbc455d06285...52e826dd10311cf0d63bbfb231a1a63ecc13",
      "oaepHashingAlgorithm": "SHA512",
      "iv": "1b9396c98ab2bfd195de661d70905a45",
      "encryptedData": [
        {
          "pushAccountId": "CA-132d72d4fcb2f4136a0532d3093ff1ab",
          "fundingAccountData": {
            "cardAccountData": {
              "accountNumber": "5413339000001513",
              "expiryMonth": "09",
              "expiryYear": "27"
            }
          }
        }
      ]
    }
  }
}
```

**Then**
> MDES returns an error indicating that `tokenRequestorId` is missing. No push operation is initiated.

Sample Response

```json
{
  "errors": [
    {
      "source": "INPUT",
      "reasonCode": "MISSING_REQUIRED_FIELD",
      "description": "Missing required field - tokenRequestorId",
      "recoverable": false
    }
  ]
}
```

*** ** * ** ***

## Scenario 8 -- Missing pushAccountId Field {#scenario-8--missing-pushaccountid-field}

**Assumptions**
> * The caller has a valid OAuth token.
> * All top-level required fields are present.
> * One of the funding account entries in the `encryptedData` array is missing its `pushAccountId`, which MDES needs to correlate each receipt in the response back to the correct account in the request.

**When**
> The issuer pushes two cards but forgets to include `pushAccountId` for the second card entry in the encrypted payload.

Sample Request

```json
POST /mdes/connect/1/0/pushMultipleAccounts

{
  "requestId": "REQ-20240512-008",
  "tokenRequestorId": "50110030273",
  "pushFundingAccounts": {
    "encryptedPayload": {
      "publicKeyFingerprint": "243e6992ea467f1cbb9973facfcc3bf17b5cd007",
      "encryptedKey": "d5112fa08e554e3dbc455d06285...52e826dd10311cf0d63bbfb231a1a63ecc13",
      "oaepHashingAlgorithm": "SHA512",
      "iv": "1b9396c98ab2bfd195de661d70905a45",
      "encryptedData": [
        {
          "pushAccountId": "CA-132d72d4fcb2f4136a0532d3093ff1ab",
          "fundingAccountData": {
            "cardAccountData": {
              "accountNumber": "5413339000001513",
              "expiryMonth": "09",
              "expiryYear": "27"
            }
          }
        },
        {
          "fundingAccountData": {
            "cardAccountData": {
              "accountNumber": "5413339000001521",
              "expiryMonth": "11",
              "expiryYear": "28"
            }
          }
        }
      ]
    }
  }
}
```

**Then**
> MDES returns an error indicating that `pushAccountId` is a required field within each funding account entry. No push receipts are issued.

Sample Response

```json
{
  "errors": [
    {
      "source": "INPUT",
      "reasonCode": "MISSING_REQUIRED_FIELD",
      "description": "Missing required field - pushAccountId in pushFundingAccounts entry at index 1",
      "recoverable": false
    }
  ]
}
```

*** ** * ** ***

## Scenario 9 -- Missing accountNumber Field {#scenario-9--missing-accountnumber-field}

**Assumptions**
> * The caller has a valid OAuth token.
> * All top-level required fields are present.
> * A card account entry includes `cardAccountData` but omits the mandatory `accountNumber` field --- the PAN MDES needs to derive the token product prefix.

**When**
> The issuer attempts to push a card where the card account data object is present but does not contain the account number (PAN).

Sample Request

```json
POST /mdes/connect/1/0/pushMultipleAccounts

{
  "requestId": "REQ-20240512-009",
  "tokenRequestorId": "50110030273",
  "pushFundingAccounts": {
    "encryptedPayload": {
      "publicKeyFingerprint": "243e6992ea467f1cbb9973facfcc3bf17b5cd007",
      "encryptedKey": "d5112fa08e554e3dbc455d06285...52e826dd10311cf0d63bbfb231a1a63ecc13",
      "oaepHashingAlgorithm": "SHA512",
      "iv": "1b9396c98ab2bfd195de661d70905a45",
      "encryptedData": [
        {
          "pushAccountId": "CA-132d72d4fcb2f4136a0532d3093ff1ab",
          "fundingAccountData": {
            "cardAccountData": {
              "expiryMonth": "09",
              "expiryYear": "27"
            }
          }
        }
      ]
    }
  }
}
```

**Then**
> MDES returns an error indicating that `accountNumber` is a required field within `cardAccountData`. No receipt is generated.

Sample Response

```json
{
  "errors": [
    {
      "source": "INPUT",
      "reasonCode": "MISSING_REQUIRED_FIELD",
      "description": "Missing required field - accountNumber in cardAccountData",
      "recoverable": false
    }
  ]
}
```

*** ** * ** ***

## Scenario 10 -- Invalid tokenRequestorId Length {#scenario-10--invalid-tokenrequestorid-length}

**Assumptions**
> * The caller has a valid OAuth token.
> * All other fields are valid.
> * `tokenRequestorId` must be exactly 11 digits. The value supplied is either shorter or longer, making it unresolvable to a known Token Requestor in MDES.

**When**
> The issuer supplies a `tokenRequestorId` of only 9 digits (`501100302`) instead of the required 11-digit identifier.

Sample Request

```json
POST /mdes/connect/1/0/pushMultipleAccounts

{
  "requestId": "REQ-20240512-010",
  "tokenRequestorId": "501100302",
  "pushFundingAccounts": {
    "encryptedPayload": {
      "publicKeyFingerprint": "243e6992ea467f1cbb9973facfcc3bf17b5cd007",
      "encryptedKey": "d5112fa08e554e3dbc455d06285...52e826dd10311cf0d63bbfb231a1a63ecc13",
      "oaepHashingAlgorithm": "SHA512",
      "iv": "1b9396c98ab2bfd195de661d70905a45",
      "encryptedData": [
        {
          "pushAccountId": "CA-132d72d4fcb2f4136a0532d3093ff1ab",
          "fundingAccountData": {
            "cardAccountData": {
              "accountNumber": "5413339000001513",
              "expiryMonth": "09",
              "expiryYear": "27"
            }
          }
        }
      ]
    }
  }
}
```

**Then**
> MDES returns an error indicating the `tokenRequestorId` has an invalid length. The push is rejected.

Sample Response

```json
{
  "responseId": "REQ-20240512-010",
  "errors": [
    {
      "source": "INPUT",
      "reasonCode": "INVALID_FIELD_LENGTH",
      "description": "Invalid Field Length - tokenRequestorId must be exactly 11 digits",
      "recoverable": false
    }
  ]
}
```

*** ** * ** ***

## Scenario 11 -- Validity Period Below Minimum {#scenario-11--validity-period-below-minimum}

**Assumptions**
> * The caller has a valid OAuth token.
> * All other required fields are valid.
> * The `pushAccountReceiptsValidityPeriod` constraint states the value must be **greater than 4 minutes** . A value of `4` or less is invalid.

**When**
> The issuer sets `pushAccountReceiptsValidityPeriod` to `3` minutes, which is below the minimum threshold of more than 4 minutes.

Sample Request

```json
POST /mdes/connect/1/0/pushMultipleAccounts

{
  "requestId": "REQ-20240512-011",
  "tokenRequestorId": "50110030273",
  "pushAccountReceiptsValidityPeriod": 3,
  "pushFundingAccounts": {
    "encryptedPayload": {
      "publicKeyFingerprint": "243e6992ea467f1cbb9973facfcc3bf17b5cd007",
      "encryptedKey": "d5112fa08e554e3dbc455d06285...52e826dd10311cf0d63bbfb231a1a63ecc13",
      "oaepHashingAlgorithm": "SHA512",
      "iv": "1b9396c98ab2bfd195de661d70905a45",
      "encryptedData": [
        {
          "pushAccountId": "CA-validity-test-001",
          "fundingAccountData": {
            "cardAccountData": {
              "accountNumber": "5413339000001513",
              "expiryMonth": "09",
              "expiryYear": "27"
            }
          }
        }
      ]
    }
  }
}
```

**Then**
> MDES returns an error indicating that the validity period is below the acceptable minimum. No push receipts are generated.

Sample Response

```json
{
  "responseId": "REQ-20240512-011",
  "errors": [
    {
      "source": "INPUT",
      "reasonCode": "INVALID_FIELD_VALUE",
      "description": "Invalid Field Value - pushAccountReceiptsValidityPeriod must be greater than 4 and no more than 15 minutes",
      "recoverable": false
    }
  ]
}
```

*** ** * ** ***

## Scenario 12 -- Validity Period Above Maximum {#scenario-12--validity-period-above-maximum}

**Assumptions**
> * The caller has a valid OAuth token.
> * All other required fields are valid.
> * The `pushAccountReceiptsValidityPeriod` constraint states the value must be **≤ 15 minutes** . A value of `16` or more is invalid.

**When**
> The issuer sets `pushAccountReceiptsValidityPeriod` to `20` minutes, which exceeds the maximum allowed validity period.

Sample Request

```json
POST /mdes/connect/1/0/pushMultipleAccounts

{
  "requestId": "REQ-20240512-012",
  "tokenRequestorId": "50110030273",
  "pushAccountReceiptsValidityPeriod": 20,
  "pushFundingAccounts": {
    "encryptedPayload": {
      "publicKeyFingerprint": "243e6992ea467f1cbb9973facfcc3bf17b5cd007",
      "encryptedKey": "d5112fa08e554e3dbc455d06285...52e826dd10311cf0d63bbfb231a1a63ecc13",
      "oaepHashingAlgorithm": "SHA512",
      "iv": "1b9396c98ab2bfd195de661d70905a45",
      "encryptedData": [
        {
          "pushAccountId": "CA-validity-test-002",
          "fundingAccountData": {
            "cardAccountData": {
              "accountNumber": "5413339000001513",
              "expiryMonth": "09",
              "expiryYear": "27"
            }
          }
        }
      ]
    }
  }
}
```

**Then**
> MDES returns an error indicating that the validity period exceeds the maximum of 15 minutes. No push receipts are generated.

Sample Response

```json
{
  "responseId": "REQ-20240512-012",
  "errors": [
    {
      "source": "INPUT",
      "reasonCode": "INVALID_FIELD_VALUE",
      "description": "Invalid Field Value - pushAccountReceiptsValidityPeriod must be greater than 4 and no more than 15 minutes",
      "recoverable": false
    }
  ]
}
```

*** ** * ** ***

## Scenario 13 -- Authentication Code Exceeds Maximum {#scenario-13--authentication-code-exceeds-maximum}

**Assumptions**
> * The caller has a valid OAuth token.
> * All other required fields are valid.
> * The `authenticationCode` field has a maximum length of 32 characters. The value supplied is 33 characters long.

**When**
> The issuer sends a push request where the authentication code the cardholder entered is 33 characters --- one character beyond the allowed maximum.

Sample Request

```json
POST /mdes/connect/1/0/pushMultipleAccounts

{
  "requestId": "REQ-20240512-013",
  "tokenRequestorId": "50110030273",
  "authenticationCode": "A1B2C3D4E5F6G7H8I9J0K1L2M3N4O5P6Q",
  "pushFundingAccounts": {
    "encryptedPayload": {
      "publicKeyFingerprint": "243e6992ea467f1cbb9973facfcc3bf17b5cd007",
      "encryptedKey": "d5112fa08e554e3dbc455d06285...52e826dd10311cf0d63bbfb231a1a63ecc13",
      "oaepHashingAlgorithm": "SHA512",
      "iv": "1b9396c98ab2bfd195de661d70905a45",
      "encryptedData": [
        {
          "pushAccountId": "CA-auth-code-test-001",
          "fundingAccountData": {
            "cardAccountData": {
              "accountNumber": "5413339000001513",
              "expiryMonth": "09",
              "expiryYear": "27"
            }
          }
        }
      ]
    }
  }
}
```

**Then**
> MDES returns an error indicating that the `authenticationCode` exceeds the allowed maximum length of 32 characters.

Sample Response

```json
{
  "responseId": "REQ-20240512-013",
  "errors": [
    {
      "source": "INPUT",
      "reasonCode": "INVALID_FIELD_LENGTH",
      "description": "Invalid Field Length - authenticationCode must not exceed 32 characters",
      "recoverable": false
    }
  ]
}
```

*** ** * ** ***

## Scenario 14 -- Minimal Valid Request {#scenario-14--minimal-valid-request}

**Assumptions**
> * The caller has a valid OAuth token.
> * Only the three required top-level fields are provided: `requestId`, `tokenRequestorId`, and `pushFundingAccounts`.
> * Optional fields (`signatureData`, `requestIssuerInitiatedDigitizationData`, `pushAccountReceiptsValidityPeriod`, `authenticationCode`) are all absent.
> * MDES applies defaults: `requestIssuerInitiatedDigitizationData = false`, `pushAccountReceiptsValidityPeriod = 15` minutes.

**When**
> The issuer sends the most minimal valid push request --- only the mandatory fields --- to verify that MDES applies correct defaults and returns a successful response without `issuerInitiatedDigitizationData` or a JWS `signature`.

Sample Request

```json
POST /mdes/connect/1/0/pushMultipleAccounts

{
  "requestId": "REQ-20240512-014",
  "tokenRequestorId": "50110030273",
  "pushFundingAccounts": {
    "encryptedPayload": {
      "publicKeyFingerprint": "243e6992ea467f1cbb9973facfcc3bf17b5cd007",
      "encryptedKey": "d5112fa08e554e3dbc455d06285...52e826dd10311cf0d63bbfb231a1a63ecc13",
      "oaepHashingAlgorithm": "SHA512",
      "iv": "1b9396c98ab2bfd195de661d70905a45",
      "encryptedData": [
        {
          "pushAccountId": "CA-minimal-001",
          "fundingAccountData": {
            "cardAccountData": {
              "accountNumber": "5413339000001513",
              "expiryMonth": "09",
              "expiryYear": "27"
            }
          }
        }
      ]
    }
  }
}
```

**Then**
> MDES returns HTTP 200 with a push receipt for the single card. The response does not contain `issuerInitiatedDigitizationData`, `signature`, or `tokenRequestorSignatureSupport = true` since no signature was requested. The receipt expires in 15 minutes (default).

Sample Response

```json
{
  "responseId": "REQ-20240512-014",
  "pushAccountReceipts": [
    {
      "pushAccountId": "CA-minimal-001",
      "pushAccountReceipt": "MCC-B3C4D5E6-F7A8-9012-BCDE-F01234567890"
    }
  ],
  "availablePushMethods": [
    {
      "type": "WEB",
      "uri": "https://pay.google.com/pushtoken/web?receipt={pushAccountReceipt}"
    }
  ],
  "tokenRequestorSignatureSupport": false
}
```

*** ** * ** ***

## Scenario 15 -- Partial Push Mixed Outcome {#scenario-15--partial-push-mixed-outcome}

**Assumptions**
> * The caller has a valid OAuth token.
> * The request contains two card entries in the encrypted payload.
> * The first card (`5413339000001513`) belongs to an account range enabled for Token Requestor `50110030273`.
> * The second card (`4111111111111111`) does NOT belong to any account range enabled for this Token Requestor, causing MDES to return a per-item error for that entry.
> * MDES processes each account independently --- a failure on one entry does not block others.

**When**
> The issuer pushes two cards in the same request. One card is eligible for the Token Requestor and one is not, simulating a mixed-outcome batch push.

Sample Request

```json
POST /mdes/connect/1/0/pushMultipleAccounts

{
  "requestId": "REQ-20240512-015",
  "tokenRequestorId": "50110030273",
  "pushFundingAccounts": {
    "encryptedPayload": {
      "publicKeyFingerprint": "243e6992ea467f1cbb9973facfcc3bf17b5cd007",
      "encryptedKey": "d5112fa08e554e3dbc455d06285...52e826dd10311cf0d63bbfb231a1a63ecc13",
      "oaepHashingAlgorithm": "SHA512",
      "iv": "1b9396c98ab2bfd195de661d70905a45",
      "encryptedData": [
        {
          "pushAccountId": "CA-eligible-001",
          "fundingAccountData": {
            "cardAccountData": {
              "accountNumber": "5413339000001513",
              "expiryMonth": "09",
              "expiryYear": "27"
            }
          }
        },
        {
          "pushAccountId": "CA-ineligible-002",
          "fundingAccountData": {
            "cardAccountData": {
              "accountNumber": "4111111111111111",
              "expiryMonth": "06",
              "expiryYear": "26"
            }
          }
        }
      ]
    }
  }
}
```

**Then**
> MDES returns HTTP 200. The `pushAccountReceipts` array contains a successful receipt for the eligible card and an error entry for the ineligible card. The issuer must inspect each item's `errors` field to identify which accounts were successfully pushed and which were not.

Sample Response

```json
{
  "responseId": "REQ-20240512-015",
  "pushAccountReceipts": [
    {
      "pushAccountId": "CA-eligible-001",
      "pushAccountReceipt": "MCC-D4E5F6A7-B8C9-0123-DEFA-B01234567890"
    },
    {
      "pushAccountId": "CA-ineligible-002",
      "errors": [
        {
          "source": "MDES",
          "reasonCode": "ACCOUNT_NOT_ELIGIBLE",
          "description": "The funding account does not belong to an account range enabled for the requested Token Requestor",
          "recoverable": false
        }
      ]
    }
  ],
  "availablePushMethods": [
    {
      "type": "ANDROID",
      "uri": "https://pay.google.com/pushtoken?receipt={pushAccountReceipt}"
    },
    {
      "type": "WEB",
      "uri": "https://pay.google.com/pushtoken/web?receipt={pushAccountReceipt}"
    }
  ],
  "tokenRequestorSignatureSupport": false
}
```