# Push Multiple Accounts
source: https://developer.mastercard.com/mdes-token-connect/documentation/testing/push-multiple-accounts-test-case/index.md

The following table summarizes the test scenarios covered in this document.

|                                                                                    Scenarios                                                                                     | HTTP Status |                              Description                              |
|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-------------|-----------------------------------------------------------------------|
| [Scenario 1](https://developer.mastercard.com/mdes-token-connect/documentation/testing/push-multiple-accounts-test-case/index.md#scenario-1--successful-multi-card-push)         | `200`       | Successfully push two Mastercard credit cards to a Token Requestor    |
| [Scenario 2](https://developer.mastercard.com/mdes-token-connect/documentation/testing/push-multiple-accounts-test-case/index.md#scenario-2--push-with-signature-data)           | `200`       | Successfully push cards with signature data and callback URL          |
| [Scenario 3](https://developer.mastercard.com/mdes-token-connect/documentation/testing/push-multiple-accounts-test-case/index.md#scenario-3--issuer-initiated-digitization-data) | `200`       | Successfully push cards requesting Issuer Initiated Digitization Data |
| [Scenario 4](https://developer.mastercard.com/mdes-token-connect/documentation/testing/push-multiple-accounts-test-case/index.md#scenario-4--missing-requestid-field)            | `200`       | Missing required field 'requestId'                                    |
| [Scenario 5](https://developer.mastercard.com/mdes-token-connect/documentation/testing/push-multiple-accounts-test-case/index.md#scenario-5--missing-pushfundingaccounts-field)  | `200`       | Missing required field 'pushFundingAccounts'                          |
| [Scenario 6](https://developer.mastercard.com/mdes-token-connect/documentation/testing/push-multiple-accounts-test-case/index.md#scenario-6--missing-tokenrequestorid-field)     | `200`       | Missing required field 'tokenRequestorId'                             |
| [Scenario 7](https://developer.mastercard.com/mdes-token-connect/documentation/testing/push-multiple-accounts-test-case/index.md#scenario-7--invalid-tokenrequestorid-length)    | `200`       | Invalid value for 'tokenRequestorId' (wrong digit length)             |
| [Scenario 8](https://developer.mastercard.com/mdes-token-connect/documentation/testing/push-multiple-accounts-test-case/index.md#scenario-8--partial-push-mixed-outcome)         | `200`       | Partial push --- one account succeeds, one account fails              |

*** ** * ** ***

## Scenario 1 -- Successful Multi-Card Push {#scenario-1--successful-multi-card-push}

**Assumptions**
> * The issuer has a valid Mastercard OAuth 1.0a access token for this environment.
> * Token Requestor `51110030273` (e.g., Test Token Requestor) is active and enabled for the issuer's account ranges.
> * Both card account numbers (`5413339000001513` and `5413339000001521`) belong to the issuer's enabled account ranges and have not expired.
> * The encrypted payload is constructed using the MDES production public key and Mastercard payload encryption library.
> * `maj` path parameter is set to `1/0`.

**When**
> The issuer pushes two Mastercard credit cards to Test Token Requestor in a single request, sending the encrypted card data along with the target Token Requestor.

Sample Request

```json
POST https://sandbox.api.mastercard.com/mdes/mtf/connect/1/0/pushMultipleAccounts

{
  "requestId": "REQ-20240512-001",
  "tokenRequestorId": "51110030273",
  "pushFundingAccounts": {
    "encryptedPayload": {
      "publicKeyFingerprint": "243e6992ea467f1cbb9973facfcc3bf17b5cd007",
      "encryptedKey": "d5112fa08e554e3dbc455d06285...52e826dd10311cf0d63bbfb231a1a63ecc13",
      "oaepHashingAlgorithm": "SHA512",
      "iv": "1b9396c98ab2bfd195de661d70905a45",
      "encryptedData": [
        {
          "pushAccountId": "CA-132d72d4fcb2f4136a0532d3093ff1ab",
          "fundingAccountData": {
            "cardAccountData": {
              "accountNumber": "5413339000001513",
              "expiryMonth": "09",
              "expiryYear": "27"
            },
            "dataValidUntilTimestamp": "2026-05-12T15:00:00.000Z"
          }
        },
        {
          "pushAccountId": "CA-9e3f1a2b4c5d6e7f8a9b0c1d2e3f4a5b",
          "fundingAccountData": {
            "cardAccountData": {
              "accountNumber": "5413339000001521",
              "expiryMonth": "11",
              "expiryYear": "28"
            },
            "dataValidUntilTimestamp": "2026-05-12T15:00:00.000Z"
          }
        }
      ]
    }
  }
}
```

**Then**
> MDES returns HTTP 200 with a `responseId` matching the `requestId`, a `pushAccountReceipt` for each pushed card (prefixed `MCC-` for Mastercard Credit), and the available push methods (e.g., ANDROID, IOS, WEB) supported by Test Token Requestor.

**Expected HTTP Status Code:** `200`

Sample Response

```json
{
  "responseId": "REQ-20240512-001",
  "pushAccountReceipts": [
    {
      "pushAccountId": "CA-132d72d4fcb2f4136a0532d3093ff1ab",
      "pushAccountReceipt": "MCC-C307F0AE-298E-48EB-AA43-A7C40B32DDDE"
    },
    {
      "pushAccountId": "CA-9e3f1a2b4c5d6e7f8a9b0c1d2e3f4a5b",
      "pushAccountReceipt": "MCC-A1B2C3D4-E5F6-7890-ABCD-EF1234567890"
    }
  ],
  "availablePushMethods": [
    {
      "type": "ANDROID",
      "uri": "https://pay.google.com/pushtoken?receipt={pushAccountReceipt}"
    },
    {
      "type": "IOS",
      "uri": "https://pay.google.com/pushtoken/ios?receipt={pushAccountReceipt}"
    },
    {
      "type": "WEB",
      "uri": "https://pay.google.com/pushtoken/web?receipt={pushAccountReceipt}"
    }
  ],
  "tokenRequestorSignatureSupport": false
}
```

*** ** * ** ***

## Scenario 2 -- Push With Signature Data {#scenario-2--push-with-signature-data}

**Assumptions**
> * The issuer has a valid Mastercard OAuth 1.0a access token.
> * Token Requestor `51110030273` supports signature verification (`tokenRequestorSignatureSupport = true`).
> * The issuer provides a callback URL for the Token Requestor to return the cardholder after provisioning.
> * The `signatureData` object is used so MDES can embed the push receipt and issuer callback info into a JWS-signed payload.
> * `maj` path parameter is `1/0`.

**When**
> The issuer pushes a single Mastercard debit card to a Token Requestor, including signature data with a callback URL and locale so that, after provisioning, the Token Requestor can redirect the cardholder back to the issuer app. The issuer also includes the cardholder's authentication code to confirm same-user presence.

Sample Request

```json
POST https://sandbox.api.mastercard.com/mdes/mtf/connect/1/0/pushMultipleAccounts

{
  "requestId": "REQ-20240512-002",
  "tokenRequestorId": "51110030273",
  "authenticationCode": "847291",
  "pushFundingAccounts": {
    "encryptedPayload": {
      "publicKeyFingerprint": "243e6992ea467f1cbb9973facfcc3bf17b5cd007",
      "encryptedKey": "d5112fa08e554e3dbc455d06285...52e826dd10311cf0d63bbfb231a1a63ecc13",
      "oaepHashingAlgorithm": "SHA512",
      "iv": "3c8475fa12de334b96dc550631804b56",
      "encryptedData": [
        {
          "pushAccountId": "CA-debit-a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6",
          "fundingAccountData": {
            "cardAccountData": {
              "accountNumber": "5204740000001002",
              "expiryMonth": "06",
              "expiryYear": "26"
            },
            "accountHolderData": {
              "accountHolderName": "Smith/Jane",
              "accountHolderEmailAddress": "jane.smith@example.com"
            },
            "dataValidUntilTimestamp": "2026-05-12T15:30:00.000Z"
          }
        }
      ]
    }
  },
  "signatureData": {
    "callbackURL": "https://issuerbank.com/mobileapp/pushcomplete",
    "completeIssuerAppActivation": true,
    "completeWebsiteActivation": false,
    "accountHolderDataSupplied": true,
    "locale": "en_US",
    "tokenRequestorSessionId": "dbc55444-496a-4896-b41c-5d5e2dd431e2"
  }
}
```

**Then**
> MDES returns HTTP 200 with a `pushAccountReceipt` prefixed `DMC-` (Mastercard Debit) and a `signature` field containing the JWS-signed payload that the Token Requestor can use to validate the request has not been tampered with during redirection.

**Expected HTTP Status Code:** `200`

Sample Response

```json
{
  "responseId": "REQ-20240512-002",
  "pushAccountReceipts": [
    {
      "pushAccountId": "CA-debit-a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6",
      "pushAccountReceipt": "DMC-F4E3D2C1-B0A9-4837-9F2E-1B2C3D4E5F6A"
    }
  ],
  "availablePushMethods": [
    {
      "type": "ANDROID",
      "uri": "https://pay.google.com/pushtoken?receipt={pushAccountReceipt}"
    }
  ],
  "tokenRequestorSignatureSupport": true,
  "signature": "ew0KImFsZyI6ICJSUzI1NiIsDQoNCiJraWQiOiAiYXNkZmctcXdlcnR5LXp4Y3ZiIg0KfQ.ew0KDQrCoCJwdXNoQWNjb3VudFJlY2VpcHQiOiAiRE1DLUYyRTFEMEMxLUIwQTktNDgzNy05RjJFLTFCMkMzRDRFNUY2QSIsDQoiaXNzdWVyQ2FsbEJhY2siOiAiaHR0cHM6Ly9pc3N1ZXJiYW5rLmNvbS9tb2JpbGVhcHAvcHVzaGNvbXBsZXRlIg0KfQ.dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk"
}
```

*** ** * ** ***

## Scenario 3 -- Issuer Initiated Digitization Data {#scenario-3--issuer-initiated-digitization-data}

**Assumptions**
> * The issuer has a valid Mastercard OAuth 1.0a access token.
> * Token Requestor `51110030273` has `supportIssuerInitiatedDigitizationData = true`.
> * The issuer wants to receive the Base64-encoded `issuerInitiatedDigitizationData` in the response to pass proprietary funding account info directly to the Token Requestor.
> * `maj` path parameter is `1/0`.

**When**
> The issuer pushes one card and explicitly sets `requestIssuerInitiatedDigitizationData = true` to request that MDES include Issuer Initiated Digitization Data in each receipt entry of the response.

Sample Request

```json
POST https://sandbox.api.mastercard.com/mdes/mtf/connect/1/0/pushMultipleAccounts

{
  "requestId": "REQ-20240512-003",
  "tokenRequestorId": "51110030273",
  "requestIssuerInitiatedDigitizationData": true,
  "pushFundingAccounts": {
    "encryptedPayload": {
      "publicKeyFingerprint": "243e6992ea467f1cbb9973facfcc3bf17b5cd007",
      "encryptedKey": "d5112fa08e554e3dbc455d06285...52e826dd10311cf0d63bbfb231a1a63ecc13",
      "oaepHashingAlgorithm": "SHA512",
      "iv": "5a7b9c1d2e3f4a5b6c7d8e9f0a1b2c3d",
      "encryptedData": [
        {
          "pushAccountId": "CA-idd-001-abc123def456ghi789",
          "fundingAccountData": {
            "cardAccountData": {
              "accountNumber": "5413339000002404",
              "expiryMonth": "03",
              "expiryYear": "29"
            },
            "dataValidUntilTimestamp": "2026-05-12T16:00:00.000Z"
          }
        }
      ]
    }
  }
}
```

**Then**
> MDES returns HTTP 200 with a `pushAccountReceipt` and includes the `issuerInitiatedDigitizationData` field (Base64-encoded funding account info) in the receipt entry, which the issuer can forward to the Token Requestor for direct provisioning.

**Expected HTTP Status Code:** `200`

Sample Response

```json
{
  "responseId": "REQ-20240512-003",
  "pushAccountReceipts": [
    {
      "pushAccountId": "CA-idd-001-abc123def456ghi789",
      "pushAccountReceipt": "MCC-E7F8A9B0-C1D2-3456-7890-ABCDEF123456",
      "issuerInitiatedDigitizationData": "eyJmdW5kaW5nQWNjb3VudEluZm8iOnsicHVzaEFjY291bnRSZWNlaXB0IjoiTUNDLUU3RjhBOUIwLUMxRDItMzQ1Ni03ODkwLUFCQ0RFRjEyMzQ1NiJ9fQ=="
    }
  ],
  "availablePushMethods": [
    {
      "type": "WEB",
      "uri": "https://pay.google.com/pushtoken/web?receipt={pushAccountReceipt}"
    }
  ],
  "tokenRequestorSignatureSupport": false
}
```

*** ** * ** ***

## Scenario 4 -- Missing requestId Field {#scenario-4--missing-requestid-field}

**Assumptions**
> * The caller has a valid OAuth token.
> * All other required fields are present and valid.
> * `requestId` is omitted entirely from the request body.

**When**
> The issuer submits a push request without including the mandatory `requestId` field, which MDES uses to correlate the request with the response and for idempotency tracking.

Sample Request

```json
POST https://sandbox.api.mastercard.com/mdes/mtf/connect/1/0/pushMultipleAccounts

{
  "tokenRequestorId": "51110030273",
  "pushFundingAccounts": {
    "encryptedPayload": {
      "publicKeyFingerprint": "243e6992ea467f1cbb9973facfcc3bf17b5cd007",
      "encryptedKey": "d5112fa08e554e3dbc455d06285...52e826dd10311cf0d63bbfb231a1a63ecc13",
      "oaepHashingAlgorithm": "SHA512",
      "iv": "1b9396c98ab2bfd195de661d70905a45",
      "encryptedData": [
        {
          "pushAccountId": "CA-132d72d4fcb2f4136a0532d3093ff1ab",
          "fundingAccountData": {
            "cardAccountData": {
              "accountNumber": "5413339000001513",
              "expiryMonth": "09",
              "expiryYear": "27"
            }
          }
        }
      ]
    }
  }
}
```

**Then**
> MDES returns an error response indicating that `requestId` is a required field. No push receipts are generated.

**Expected HTTP Status Code:** `200`

Sample Response

```json
{
  "errors": [
    {
      "source": "INPUT",
      "reasonCode": "MISSING_REQUIRED_FIELD",
      "description": "Missing required field - requestId"
    }
  ]
}
```

*** ** * ** ***

## Scenario 5 -- Missing pushFundingAccounts Field {#scenario-5--missing-pushfundingaccounts-field}

**Assumptions**
> * The caller has a valid OAuth token.
> * `requestId` and `tokenRequestorId` are present and valid.
> * The `pushFundingAccounts` object (which contains the encrypted card data) is omitted.

**When**
> The issuer sends a push request with no card data --- the `pushFundingAccounts` field containing the encrypted payload is absent from the request body.

Sample Request

```json
POST https://sandbox.api.mastercard.com/mdes/mtf/connect/1/0/pushMultipleAccounts

{
  "requestId": "REQ-20240512-006",
  "tokenRequestorId": "51110030273"
}
```

**Then**
> MDES returns an error indicating that the encrypted funding accounts payload is required. No push operations are performed.

**Expected HTTP Status Code:** `200`

Sample Response

```json
{
  "errors": [
    {
      "source": "INPUT",
      "reasonCode": "MISSING_REQUIRED_FIELD",
      "description": "Missing required field - pushFundingAccounts",
      "recoverable": false
    }
  ]
}
```

*** ** * ** ***

## Scenario 6 -- Missing tokenRequestorId Field {#scenario-6--missing-tokenrequestorid-field}

**Assumptions**
> * The caller has a valid OAuth token.
> * `requestId` and `pushFundingAccounts` are present and valid.
> * `tokenRequestorId` is omitted --- MDES cannot determine which Token Requestor to push the card(s) to.

**When**
> The issuer submits a push request with card data but without specifying which Token Requestor should receive the cards.

Sample Request

```json
POST https://sandbox.api.mastercard.com/mdes/mtf/connect/1/0/pushMultipleAccounts

{
  "requestId": "REQ-20240512-007",
  "pushFundingAccounts": {
    "encryptedPayload": {
      "publicKeyFingerprint": "243e6992ea467f1cbb9973facfcc3bf17b5cd007",
      "encryptedKey": "d5112fa08e554e3dbc455d06285...52e826dd10311cf0d63bbfb231a1a63ecc13",
      "oaepHashingAlgorithm": "SHA512",
      "iv": "1b9396c98ab2bfd195de661d70905a45",
      "encryptedData": [
        {
          "pushAccountId": "CA-132d72d4fcb2f4136a0532d3093ff1ab",
          "fundingAccountData": {
            "cardAccountData": {
              "accountNumber": "5413339000001513",
              "expiryMonth": "09",
              "expiryYear": "27"
            }
          }
        }
      ]
    }
  }
}
```

**Then**
> MDES returns an error indicating that `tokenRequestorId` is missing. No push operation is initiated.

**Expected HTTP Status Code:** `200`

Sample Response

```json
{
  "errors": [
    {
      "source": "INPUT",
      "reasonCode": "MISSING_REQUIRED_FIELD",
      "description": "Missing required field - tokenRequestorId"
    }
  ]
}
```

*** ** * ** ***

## Scenario 7 -- Invalid tokenRequestorId Length {#scenario-7--invalid-tokenrequestorid-length}

**Assumptions**
> * The caller has a valid OAuth token.
> * All other fields are valid.
> * `tokenRequestorId` must be exactly 11 digits. The value supplied is either shorter or longer, making it unresolvable to a known Token Requestor in MDES.

**When**
> The issuer supplies a `tokenRequestorId` of only 9 digits (`501100302`) instead of the required 11-digit identifier.

Sample Request

```json
POST https://sandbox.api.mastercard.com/mdes/mtf/connect/1/0/pushMultipleAccounts

{
  "requestId": "REQ-20240512-010",
  "tokenRequestorId": "501100302",
  "pushFundingAccounts": {
    "encryptedPayload": {
      "publicKeyFingerprint": "243e6992ea467f1cbb9973facfcc3bf17b5cd007",
      "encryptedKey": "d5112fa08e554e3dbc455d06285...52e826dd10311cf0d63bbfb231a1a63ecc13",
      "oaepHashingAlgorithm": "SHA512",
      "iv": "1b9396c98ab2bfd195de661d70905a45",
      "encryptedData": [
        {
          "pushAccountId": "CA-132d72d4fcb2f4136a0532d3093ff1ab",
          "fundingAccountData": {
            "cardAccountData": {
              "accountNumber": "5413339000001513",
              "expiryMonth": "09",
              "expiryYear": "27"
            }
          }
        }
      ]
    }
  }
}
```

**Then**
> MDES returns an error indicating the `tokenRequestorId` has an invalid length. The push is rejected.

**Expected HTTP Status Code:** `200`

Sample Response

```json
{
  "responseId": "REQ-20240512-010",
  "errors": [
    {
      "source": "INPUT",
      "reasonCode": "INVALID_FIELD_LENGTH",
      "description": "Invalid Field Length - tokenRequestorId"
    }
  ]
}
```

*** ** * ** ***

## Scenario 8 -- Partial Push Mixed Outcome {#scenario-8--partial-push-mixed-outcome}

**Assumptions**
> * The caller has a valid OAuth token.
> * The request contains two card entries in the encrypted payload.
> * The first card (`5413339000001513`) belongs to an account range enabled for Token Requestor `51110030273`.
> * The second card (`4111111111111111`) does NOT belong to any account range enabled for this Token Requestor, causing MDES to return a per-item error for that entry.
> * MDES processes each account independently --- a failure on one entry does not block others.

**When**
> The issuer pushes two cards in the same request. One card is eligible for the Token Requestor and one is not, simulating a mixed-outcome batch push.

Sample Request

```json
POST https://sandbox.api.mastercard.com/mdes/mtf/connect/1/0/pushMultipleAccounts

{
  "requestId": "REQ-20240512-015",
  "tokenRequestorId": "51110030273",
  "pushFundingAccounts": {
    "encryptedPayload": {
      "publicKeyFingerprint": "243e6992ea467f1cbb9973facfcc3bf17b5cd007",
      "encryptedKey": "d5112fa08e554e3dbc455d06285...52e826dd10311cf0d63bbfb231a1a63ecc13",
      "oaepHashingAlgorithm": "SHA512",
      "iv": "1b9396c98ab2bfd195de661d70905a45",
      "encryptedData": [
        {
          "pushAccountId": "CA-eligible-001",
          "fundingAccountData": {
            "cardAccountData": {
              "accountNumber": "5413339000001513",
              "expiryMonth": "09",
              "expiryYear": "27"
            }
          }
        },
        {
          "pushAccountId": "CA-ineligible-002",
          "fundingAccountData": {
            "cardAccountData": {
              "accountNumber": "4111111111111111",
              "expiryMonth": "06",
              "expiryYear": "26"
            }
          }
        }
      ]
    }
  }
}
```

**Then**
> MDES returns HTTP 200. The `pushAccountReceipts` array contains a successful receipt for the eligible card and an error entry for the ineligible card. The issuer must inspect each item's `errors` field to identify which accounts were successfully pushed and which were not.

**Expected HTTP Status Code:** `200`

Sample Response

```json
{
  "responseId": "REQ-20240512-015",
  "pushAccountReceipts": [
    {
      "pushAccountId": "CA-eligible-001",
      "pushAccountReceipt": "MCC-D4E5F6A7-B8C9-0123-DEFA-B01234567890"
    },
    {
      "pushAccountId": "CA-ineligible-002",
      "errors": [
        {
          "source": "MDES",
          "reasonCode": "ACCOUNT_INELIGIBLE",
          "description": "The card account or financial account is not eligible"
        }
      ]
    }
  ],
  "availablePushMethods": [
    {
      "type": "ANDROID",
      "uri": "https://pay.google.com/pushtoken?receipt={pushAccountReceipt}"
    },
    {
      "type": "WEB",
      "uri": "https://pay.google.com/pushtoken/web?receipt={pushAccountReceipt}"
    }
  ],
  "tokenRequestorSignatureSupport": false
}
```