# Onboard Risk Check API - Cyber Only onboarding
source: https://developer.mastercard.com/onboard-risk-check/documentation/tutorials-and-guides/example-tutorial/index.md

## What you will learn {#what-you-will-learn}

* Create a new Maven (Java) project.
* Add required resources.
* Add required dependencies.
* Generate the API client.
* Make an API call.

## What you will need {#what-you-will-need}

To complete this tutorial, you can use:

* Maven 3+
* JDK 17+
* IntelliJ IDEA 2017+ (any other IDE can be used).
* OpenAPI spec of Onboard Risk Check - Cyber Only API [orc-api-schema.yaml](https://static.developer.mastercard.com/content/onboard-risk-check/swagger/orc-api-schema.yaml) (12KB).
* A developer account on [Mastercard Developers](https://developer.mastercard.com/account/log-in) and Onboard Risk Check API project.

Tip: For instructions on how to create a developer account and API project, please refer to the [Quick Start Guide](https://developer.mastercard.com/platform/documentation/getting-started-with-mastercard-apis/quick-start-guide/).   

Click **Next** to begin.

### Step 1 - Step one: Create a new Maven project {#step-1---step-one-create-a-new-maven-project}

To begin ORC API onboarding, you must first create a new Maven project.

1. In IntelliJ IDEA, create a new Maven project that sets up your directory structure automatically.
   ![](https://static.developer.mastercard.com/content/onboard-risk-check/uploads/step1-1.png)

2. Enter "cyber-secure-orc-tutorial" in the **Name** and **ArtifactId** fields.
   ![](https://static.developer.mastercard.com/content/onboard-risk-check/uploads/step1-2.png)

### Step 2 - Step two: Add resources {#step-2---step-two-add-resources}

Before you can add dependencies, you must add resources.

1. Download the OpenAPI specification file for the Onboard Risk Check API
   [orc-api-schema.yaml](https://static.developer.mastercard.com/content/onboard-risk-check/swagger/orc-api-schema.yaml) (12KB), and add it to the resources folder of your Maven project.


   <br />

2. Add the Sandbox Signing Key generated for your Cyber Secure ORC project to the resources folder of your Maven project. The steps to create the project and generate the Sandbox Signing Key are described in the [Quick Start Guide](https://developer.mastercard.com/platform/documentation/getting-started-with-mastercard-apis/quick-start-guide/). For detailed information about the Signing Keys, refer to [Getting keys for your application](https://developer.mastercard.com/platform/documentation/security-and-authentication/using-oauth-1a-to-access-mastercard-apis/#getting-keys-for-your-application).


   <br />

Your Maven project directory should look as follows (the .iml file is used by IntelliJ IDEA).
![](https://static.developer.mastercard.com/content/onboard-risk-check/uploads/step2a.png)

### Step 3 - Step three: Add dependencies {#step-3---step-three-add-dependencies}

Before you can generate the API client, you must update the pom.xml file.


<br />

1. Add the following plugin to the pom.xml file in your Maven project to add the OpenAPI Generator. The OpenAPI Generator creates API client libraries from [OpenAPI Specifications](https://github.com/OAI/OpenAPI-Specification) (formerly known as Swagger Files). OpenAPI Generator provides multiple generators and library templates to support multiple languages and frameworks. In this tutorial we are using the Java generator and the default okhttp-gson library template.

   ```java

      <?xml version="1.0" encoding="UTF-8"?>
   <project xmlns="http://maven.apache.org/POM/4.0.0"
            xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
            xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
       <modelVersion>4.0.0</modelVersion>

       <groupId>com.mastercard.api.orc</groupId>
       <artifactId>cyber-secure-orc-tutorial</artifactId>
       <version>1.0-SNAPSHOT</version>

   <build>
           <plugins>
               <plugin>
                   <groupId>org.openapitools</groupId>
                   <artifactId>openapi-generator-maven-plugin</artifactId>
                   <version>6.6.0</version>
                   <executions>
                       <execution>
                           <id>Cyber Secure ORC API REST Client</id>
                           <goals>
                               <goal>generate</goal>
                           </goals>
                           <configuration>
                               <inputSpec>${project.basedir}/src/main/resources/orc-api-schema.yaml</inputSpec>
                               <generatorName>java</generatorName>

                               <!-- No "library" element here means the plugin will use the default library template ("okhttp-gson") -->
                               <configOptions>
                                   <sourceFolder>src/gen/java/main</sourceFolder>
                               </configOptions>

                               <!-- Normally the artifact version would match the ORC API Documentation Version -->
                               <apiPackage>com.mastercard.api.orc</apiPackage>
                               <groupId>com.mastercard.api.orc</groupId>
                               <artifactId>cyber-secure-orc-tutorial</artifactId>
                               <modelPackage>com.mastercard.api.orc.model</modelPackage>
                           </configuration>
                       </execution>
                   </executions>
               </plugin>
           </plugins>
       </build>
   ```

   <br />

2. Add the following dependencies for the API client library generation and the Mastercard OAuth1 Signer library to your pom.xml file. Mastercard APIs use [OAuth 1.0a](https://developer.mastercard.com/platform/documentation/authentication/using-oauth-1a-to-access-mastercard-apis/) authentication. OAuth1 Signer libraries are developed and maintained by the Mastercard API team and hosted on [GitHub](https://github.com/Mastercard). They include code helpers targeting the HTTP clients used by the different OpenAPI Generator library templates. More information on how to use OAuth 1.0a to access Mastercard APIs, refer to [Using OAuth 1.0a to Access Mastercard APIs](https://developer.mastercard.com/platform/documentation/security-and-authentication/using-oauth-1a-to-access-mastercard-apis/).

   ```java

       <properties>
           <maven.compiler.source>17</maven.compiler.source>
           <maven.compiler.target>17</maven.compiler.target>
           <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
           <java.version>17</java.version>
           <maven.compiler.source>${java.version}</maven.compiler.source>
           <maven.compiler.target>${java.version}</maven.compiler.target>
           <inquiries-data-model.version>2.0.21-RELEASE</inquiries-data-model.version>
           <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
           <org.mapstruct.version>1.5.2.Final</org.mapstruct.version>
           <junit-vintage-engine.version>5.9.1</junit-vintage-engine.version>
           <spring-security-config-version>5.6.0</spring-security-config-version>
           <org.apache.common-version>1.9.0</org.apache.common-version>
           <cyber-secure-common-member-sdk.version>5.0.2-RELEASE</cyber-secure-common-member-sdk.version>
           <cyber-secure-caas-sdk.version>4.0.0-RELEASE</cyber-secure-caas-sdk.version>

           <!-- Dependencies used by the generated sources -->
           <gson-fire-version>1.8.5</gson-fire-version>
           <swagger-core-version>1.6.8</swagger-core-version>
           <okhttp3-version>4.10.0</okhttp3-version>
           <gson-version>2.10.1</gson-version>
           <threetenbp-version>1.6.5</threetenbp-version>
           <junit-version>4.13.2</junit-version>
           <oltu-version>1.0.2</oltu-version>
           <oauth1-signer-version>1.5.2</oauth1-signer-version>
           <findbugs-version>3.0.2</findbugs-version>
           <nullable-version>0.2.6</nullable-version>
           <javax-rs-version>2.1.1</javax-rs-version>
           <junit-jupiter-version>5.9.2</junit-jupiter-version>
       </properties>
       <dependencies>
           <dependency>
               <groupId>io.swagger</groupId>
               <artifactId>swagger-annotations</artifactId>
               <version>${swagger-core-version}</version>
           </dependency>
           <dependency>
               <groupId>com.squareup.okhttp3</groupId>
               <artifactId>okhttp</artifactId>
               <version>${okhttp3-version}</version>
           </dependency>
           <dependency>
               <groupId>com.squareup.okhttp3</groupId>
               <artifactId>logging-interceptor</artifactId>
               <version>${okhttp3-version}</version>
           </dependency>
           <dependency>
               <groupId>com.google.code.gson</groupId>
               <artifactId>gson</artifactId>
               <version>${gson-version}</version>
           </dependency>
           <dependency>
               <groupId>io.gsonfire</groupId>
               <artifactId>gson-fire</artifactId>
               <version>${gson-fire-version}</version>
           </dependency>
           <dependency>
               <groupId>org.apache.oltu.oauth2</groupId>
               <artifactId>org.apache.oltu.oauth2.client</artifactId>
               <version>${oltu-version}</version>
           </dependency>
           <dependency>
               <groupId>org.threeten</groupId>
               <artifactId>threetenbp</artifactId>
               <version>${threetenbp-version}</version>
           </dependency>
           <dependency>
               <groupId>com.mastercard.developer</groupId>
               <artifactId>oauth1-signer</artifactId>
               <version>${oauth1-signer-version}</version>
               <!--See: https://github.com/Mastercard/oauth1-signer-java/releases -->
           </dependency>
           <dependency>
               <groupId>junit</groupId>
               <artifactId>junit</artifactId>
               <version>${junit-version}</version>
           </dependency>
           <dependency>
               <groupId>com.google.code.findbugs</groupId>
               <artifactId>jsr305</artifactId>
               <version>${findbugs-version}</version>
           </dependency>
           <dependency>
               <groupId>org.openapitools</groupId>
               <artifactId>jackson-databind-nullable</artifactId>
               <version>${nullable-version}</version>
           </dependency>
           <dependency>
               <groupId>javax.ws.rs</groupId>
               <artifactId>javax.ws.rs-api</artifactId>
               <version>${javax-rs-version}</version>
           </dependency>
           <dependency>
               <groupId>org.junit.jupiter</groupId>
               <artifactId>junit-jupiter-api</artifactId>
               <version>${junit-jupiter-version}</version>
               <scope>compile</scope>
           </dependency>
           <dependency>
               <groupId>javax.annotation</groupId>
               <artifactId>javax.annotation-api</artifactId>
               <version>1.3.2</version>
           </dependency>
       </dependencies>

   </project>
   ```

   <br />

   There are two options when using the OpenAPI Generator to generate the API client library:

* Generate and use the source files on the fly.
* Generate and deploy the source files to a Maven repository.

<br />

This tutorial explains how to generate the API client library on the fly, so the dependencies that are needed to generate the library are included. To deploy the source files to a Maven repository, you only need to include the dependency for that repository.

### Step 4 - Step four: Generate the API client {#step-4---step-four-generate-the-api-client}

Once you have added the dependencies, you can generate the sources.

1. In IntelliJ IDEA, navigate to **View** \> **Tool Windows** \> **Maven** to open the Maven window.
   ![](https://static.developer.mastercard.com/content/onboard-risk-check/uploads/step4.png)

2. Click the icons for **Reimport All Maven Projects and Generate Sources** and **Update Folders for All Projects** .
   ![](https://static.developer.mastercard.com/content/onboard-risk-check/uploads/step4b.png)

The sources will be generated in the target folder inside the Maven project structure. This project can be built and used as a standalone dependency in any project you need to develop.
![](https://static.developer.mastercard.com/content/onboard-risk-check/uploads/step4c.png)

### Step 5 - Step five: Make an API call {#step-5---step-five-make-an-api-call}

The final step in the process is to make an API call using the generated API client.

## 1. Main class {#1-main-class}

Create a Java file called Main.java in the `com.mastercard.api.orc` package.


<br />

## 2. Prepare the API key details {#2-prepare-the-api-key-details}

Add the following code to the `main()` method of the class. This will make your OAuth credentials available to the program and will create the PrivateKey used for signing the requests.


```java
    String consumerKey = "#YOUR 97 CHARACTER CONSUMER KEY HERE#";
    String signingKeyFilePath = "#PATH TO YOUR P12 FILE HERE#";
    String signingKeyAlias = "#YOUR KEY ALIAS HERE#";
    String signingKeyPass = "#YOUR KEY PASSWORD HERE#";

    // Load the signing key
    PrivateKey signingKey = AuthenticationUtils.loadSigningKey(signingKeyFilePath, signingKeyAlias, signingKeyPass);
```

<br />

<br />

## 3. Configure APIClient {#3-configure-apiclient}

Add the following code to instantiate an ApiClient and configure it to sign requests with your authentication credentials.
The `OkHttpOAuth1Interceptor` used to sign the requests is provided by the Mastercard OAuth1 Signer library. This tutorial also uses `client.setDebugging(true)` to view detailed request information when the application is run.


```java
        // Set the ApiClient
        ApiClient client = new ApiClient();
        OkHttpClient.Builder httpClientBuilder = client.getHttpClient().newBuilder();

        // Configure the Mastercard service URL
        client.setBasePath("https://sandbox.api.mastercard.com/cybersecure");

        // Add the interceptor code responsible for signing HTTP requests
        httpClientBuilder.addInterceptor(new OkHttpOAuth1Interceptor(consumerKey, signingKey));
        client.setHttpClient(httpClientBuilder.build());
        
        //Debugging is enabled for testing
        client.setDebugging(true);
```

<br />

<br />

## 4. Inquiry request {#4-inquiry-request}

Create an inquiry request and call the API to retrieve the IRN.


```java

        // Create the inquiry request object that contains the details about the merchant
        MerchantInquiry merchantInquiry = new MerchantInquiry();
        merchantInquiry.setMerchantUrl("www.bait.com");
        merchantInquiry.setMerchantName("THE BAIT SHOP");
        merchantInquiry.setRequestingIca("1996");

        // Call the API
        CyberInquiryApi api = new CyberInquiryApi(client);
        InquiryReference inquiryReference = api.initiateCyberInquiry(merchantInquiry);

        // Use this IRN to track the request. You will need this in GET endpoint
        System.out.println("\n------------------------------------------------");
        System.out.println("Inquiry Reference Number: " + inquiryReference.getInquiryReferenceNumber());
        System.out.println("------------------------------------------------");
```

<br />

<br />

## 5. Inquiry results {#5-inquiry-results}

Retrieve the results of an inquiry using an IRN.


```java

        // Inquiry Reference Number will be returned on successful response
        String inquiryReferenceNumber = inquiryReference.getInquiryReferenceNumber();

        // Call the API
        Inquiry inquiryResults = api.retrieveCyberInquiry(inquiryReferenceNumber);

        // inquiryResults will contain the ratings reports
        List<AnalyzedMerchant> merchants = inquiryResults.getAnalyzedMerchants();

        for (AnalyzedMerchant merchant : merchants) {
            System.out.println("\n------------------------------------------------");
            System.out.println(merchant.getMerchantName() + " - " + merchant.getMerchantUrl());
            System.out.println("------------------------------------------------");

            List<Rating> ratings = merchant.getRatings();
            for (Rating rating : ratings) {
                System.out.println(rating.getName() + ": "
                        + rating.getRatingNumeric() + " | "
                        + rating.getRating());
            }
        }
```

<br />

<br />

## 6. Complete final Main class {#6-complete-final-main-class}

This is an example of how to create a new inquiry using the POST endpoint to retrieve the results using the GET endpoint.


```java

package com.mastercard.api.orc;


import com.mastercard.api.orc.api.CyberInquiryApi;
import com.mastercard.api.orc.model.*;
import com.mastercard.developer.interceptors.OkHttpOAuth1Interceptor;
import com.mastercard.developer.utils.AuthenticationUtils;
import okhttp3.OkHttpClient;

import java.security.PrivateKey;
import java.util.List;

public class Main {

    public static void main(String[] args) throws Exception {

        String consumerKey = "#YOUR 97 CHARACTER CONSUMER KEY HERE#";
        String signingKeyFilePath = "#PATH TO YOUR P12 FILE HERE#";
        String signingKeyAlias = "#YOUR KEY ALIAS HERE#";
        String signingKeyPass = "#YOUR KEY PASSWORD HERE#";

        // Load the signing key
        PrivateKey signingKey = AuthenticationUtils.loadSigningKey(signingKeyFilePath, signingKeyAlias, signingKeyPass);

        // Set the ApiClient
        ApiClient client = new ApiClient();
        OkHttpClient.Builder httpClientBuilder = client.getHttpClient().newBuilder();

        // Configure the Mastercard service URL
        client.setBasePath("https://sandbox.api.mastercard.com/cybersecure");

        // Add the interceptor code responsible for signing HTTP requests
        httpClientBuilder.addInterceptor(new OkHttpOAuth1Interceptor(consumerKey, signingKey));
        client.setHttpClient(httpClientBuilder.build());

        //Debugging is enabled for testing
        client.setDebugging(true);

        try {

            // Create the inquiry request object that contains the details about the merchant
            MerchantInquiry merchantInquiry = new MerchantInquiry();
            merchantInquiry.setMerchantUrl("www.bait.com");
            merchantInquiry.setMerchantName("THE BAIT SHOP");
            merchantInquiry.setRequestingIca("1996");

            // Call the API
            CyberInquiryApi api = new CyberInquiryApi(client);
            InquiryReference inquiryReference = api.initiateCyberInquiry(merchantInquiry);

            // Use this IRN to track the request. You will need this in GET endpoint
            System.out.println("\n------------------------------------------------");
            System.out.println("Inquiry Reference Number: " + inquiryReference.getInquiryReferenceNumber());
            System.out.println("------------------------------------------------");

            // Inquiry Reference Number will be returned on successful response
            String inquiryReferenceNumber = inquiryReference.getInquiryReferenceNumber();

            // Call the API
            Inquiry inquiryResults = api.retrieveCyberInquiry(inquiryReferenceNumber);

            // inquiryResults will contain the ratings reports
            List<AnalyzedMerchant> merchants = inquiryResults.getAnalyzedMerchants();

            for (AnalyzedMerchant merchant : merchants) {
                System.out.println("\n------------------------------------------------");
                System.out.println(merchant.getMerchantName() + " - " + merchant.getMerchantUrl());
                System.out.println("------------------------------------------------");

                List<Rating> ratings = merchant.getRatings();
                for (Rating rating : ratings) {
                    System.out.println(rating.getName() + ": "
                            + rating.getRatingNumeric() + " | "
                            + rating.getRating());
                }

            }

        }
        catch (Exception e) {
            e.printStackTrace();
        }

    }

}
```

<br />

<br />

## 7. Run the application {#7-run-the-application}

Navigate to **Main.java file** \>**Run 'Main.main()'** to run the application. The screenshot below shows the expected 200 OK response.

![](https://static.developer.mastercard.com/content/onboard-risk-check/uploads/step5-2.png)