# Quick Start Guide
source: https://developer.mastercard.com/points-activity-service/documentation/quick-start-guide/index.md

## Quick Start Guide {#quick-start-guide}

This guide takes you from a new Mastercard Developers account to your first successful Loyalty Points Activity Service call in the Sandbox environment. Follow the steps in order.

## Prerequisites {#prerequisites}

Before you start, make sure you have the following:

* A [Mastercard Developers](https://developer.mastercard.com/) account.
* A project created against **Mastercard Loyalty Management**, which grants access to the Loyalty Points Activity Service APIs.
* Your Sandbox keys downloaded from the [Developer Dashboard](https://developer.mastercard.com/dashboard).
* A test `user_id` and `user_id_type` for your Rewards program.
* A REST client such as curl, Postman, or Insomnia.

## Step 1: Get Sandbox access and credentials {#step-1-get-sandbox-access-and-credentials}

1. Sign in to [Mastercard Developers](https://developer.mastercard.com/) and create a project, selecting **Mastercard Loyalty Management**.
2. Download your Sandbox keys from the project dashboard. Mastercard issues separate keys for the Sandbox and Production environments.
3. If you need additional test accounts in your Rewards program, contact your Mastercard account representative or call the enrollment endpoints.

For screenshots of each step, see the [Create a Sandbox Project](https://developer.mastercard.com/points-activity-service/documentation/tutorials-and-guides/sandbox-access-tutorial/index.md) tutorial.

## Step 2: Set up authentication {#step-2-set-up-authentication}

Loyalty Points Activity Service uses OAuth 1.0a. Sign every request with your RSA private key and send an OAuth 1.0a `Authorization` header. The Mastercard client libraries generate this header for you.

|  Protocol  |                                     What you send                                     |                                                                           Reference                                                                            |
|------------|---------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------|
| OAuth 1.0a | An OAuth 1.0a `Authorization` header, with requests signed using your RSA private key | [Using OAuth 1.0a to Access Mastercard APIs](https://developer.mastercard.com/platform/documentation/authentication/using-oauth-1a-to-access-mastercard-apis/) |

For full details, see [API Basics](https://developer.mastercard.com/points-activity-service/documentation/api-basics/index.md#api-security).
Note: Requests that carry sensitive cardholder data, such as `POST /points-details-searches`, must have the payload encrypted using the JWE encryption scheme. The first call in this guide uses non-sensitive identifiers, so it does not require payload encryption.

## Step 3: Select the environment {#step-3-select-the-environment}

Use the Sandbox base URL for this guide:

    https://sandbox.api.mastercard.com/loyalty

For the full environment list and the Production base URL, see [Environments](https://developer.mastercard.com/points-activity-service/documentation/api-basics/index.md#environments) on the API Basics page.

## Step 4: Make your first sandbox call {#step-4-make-your-first-sandbox-call}

Retrieve a points balance with `GET /points-details`. The `user_id` and `user_id_type` query parameters are required. Substitute your own test identifier and your generated authorization header.
* Curl

```curl
curl -X GET \
  "https://sandbox.api.mastercard.com/loyalty/points-details?user_id=400808029010462551980134259624&user_id_type=RANAC" \
  -H "Authorization: <your generated OAuth authorization header>" \
  -H "Accept: application/json"
```

`user_id_type` accepts `RANAC` (Random Account Number) or `RANCU` (Random Customer Number).

## Step 5: Confirm the call succeeded {#step-5-confirm-the-call-succeeded}

A successful call returns `200 OK` and a points details object. The top-level fields hold the totals across the household or households, and `households` contains the breakdown.

```json
{
  "availablePoints": 10,
  "onHoldPoints": 1,
  "previousBalance": 1,
  "pointsEarned": 1,
  "pointsRedeemed": 1,
  "households": []
}
```

Check the following to confirm success:

* The HTTP status is `200`.
* The response body contains `availablePoints`.
* If you receive `400`, a request parameter is missing or invalid. Check the `ReasonCode` and `Description` in the response.
* If you receive `401`, your credentials or authorization header are not valid for this environment.

For error meanings and resolution tips, see [Code and Formats](https://developer.mastercard.com/points-activity-service/documentation/code-and-formats/index.md).

## Next steps {#next-steps}

* Explore the full operation set in the [API Reference](https://developer.mastercard.com/points-activity-service/documentation/api-reference/index.md).
* Map business scenarios to endpoints in [Use Cases](https://developer.mastercard.com/points-activity-service/documentation/use-cases/index.md).
* Build and run an end-to-end client with the [Testing](https://developer.mastercard.com/points-activity-service/documentation/tutorials-and-guides/api-testing-tutorial/index.md) tutorial.
* Move your project to Production with the [Move Project to Production](https://developer.mastercard.com/points-activity-service/documentation/tutorials-and-guides/production-access-tutorial/index.md) tutorial.