# User Account Administration API OAuth 2.0 authentication and first call
source: https://developer.mastercard.com/presentment/documentation/tutorials-and-guides/user-account-admin-api-authentication-and-first-call-tutorial/index.md
## Introduction {#introduction}
This tutorial describes how to install and configure the Mastercard Insomnia plugin, set up OAuth 2.0 authentication, and send your first successful User Account Administration API request.
## Tutorial prerequisites {#tutorial-prerequisites}
To complete this tutorial, you will need:
* Insomnia installed on your local machine.
* Mastercard Insomnia plugin installed in Insomnia.
* Access to the User Account Administration API Reference, including the OpenAPI specification file.
* A Mastercard Developers Portal account with access to User Account Administration.
* OAuth 2.0 credentials from the Mastercard Developers Portal:
* Client ID
* Key ID (kid)
* OAuth scopes
* Authentication key provided as a `.p12` keystore file, including its alias and password
* Access to a Sandbox or Production environment, depending on where you are testing.
## Install and configure Insomnia {#install-and-configure-insomnia}
### Steps {#steps}
1. Install Insomnia from [here](https://github.com/Mastercard/insomnia-plugin-mastercard/blob/main/README.md#installation-).
2. Configure your Insomnia automatically [here](https://github.com/Mastercard/insomnia-plugin-mastercard/blob/main/README.md#configuration-).
### Environment configuration notes {#environment-configuration-notes}
* Use the correct values according to the environment.
* Keep only one authentication mode configured at a time (OAuth 2.0 or OAuth 1.0).
OAuth 2.0 token endpoint URL
* Sandbox
* Production
```Sandbox
https://sandbox.api.mastercard.com/oauth/token
```
```Production
https://api.mastercard.com/oauth/token
```
Authorization server issuer URL
* Sandbox
* Production
```Sandbox
https://sandbox.api.mastercard.com
```
```Production
https://api.mastercard.com
```
## Update Required Values {#update-required-values}
### Prerequisites {#prerequisites}
For this step, you will need the following information from the Mastercard Developers portal:
* Client ID
* Key ID (kid)
* Scopes
* Authentication Key (`.p12` keystore file with its alias and password)
### Steps {#steps-1}
1. Update the following values in your environment.
| Value | Description |
|------------------|--------------------------------------------------------------------------------------------------------------------------------------------------|
| clientId | OAuth 2.0 client identifier. |
| kid | Key ID of the client authentication key. |
| keystoreP12Path | Absolute path to the P12 keystore file. |
| keyAlias | Key alias within the P12 keystore. |
| keystorePassword | Password for the P12 keystore. |
| tokenEndpoint | OAuth 2.0 token endpoint URL. - Sandbox: - Production: |
| issuer | Authorization server issuer URL. - Sandbox: - Production: |
| scopes | Array of OAuth scopes to request. |
## Configure and send an API request {#configure-and-send-an-api-request}
### Pick a test endpoint {#pick-a-test-endpoint}
1. Select a simple read endpoint from the [User Account Administration API Reference](https://developer.mastercard.com/presentment/documentation/api-reference/user-account-admin/) page.
#### Example from User Account Administration API: {#example-from-user-account-administration-api}
* POST /eligibilities/searches
* Set the base url/domain for Sandbox:
* Set the base url/domain for Production:
2. Copy the respective payload from the [User Account Administration API Reference](https://developer.mastercard.com/presentment/documentation/api-reference/user-account-admin/) page.
#### Sample request URL: {#sample-request-url}
### Build the request in Insomnia {#build-the-request-in-insomnia}
1. Create a new GET request with your endpoint URL.
2. Do not manually add the Authorization header.
3. Add the required X-FID header.
4. Add the X-Public-Key-Fingerprint from your project's **Mastercard Encryption Key** fingerprint.
5. Create the encryption configuration.
#### Encrypting and decrypting entire payloads {#encrypting-and-decrypting-entire-payloads}
Note: This config encrypts all requests including the GET requests in Insomnia. Ignore the GET calls in the real implementation.
* Add the encryptionConfig inside the Mastercard object:
```json
"mastercard":{
//.....//
"encryptionConfig":{
"paths":[
{
"path":"/*", // Keep as is or Update your resource path
"toEncrypt":[
{
"element":"path.to.element.to.be.encrypted", // Update to $
"obj":"path.to.encrypted.output.element" // Update to $
}
],
"toDecrypt":[
{
"element":"path.to.element.to.be.decrypted", // Update to $
"obj":"path.to.decryption.output" // Update to $
}
]
}
],
"mode":"JWE",
"encryptedValueFieldName":"encryptedData",
"encryptionCertificate":"/path/to/encryption-certificate.pem", // Update pem file
"keyStore":"/path/to/decryption-keystore.p12", // Update p12 file
"keyStoreAlias":"decryption-keyalias", // Update keyalias
"keyStorePassword":"decryption-keystorepassword" // Update keystorepassword
}
}
```
Note: Refer to this [page](https://github.com/Mastercard/insomnia-plugin-mastercard/blob/main/workspace/mastercard-apis-with-jwe-encryption-insomnia-workspace.json#L171C13-L196) for additional details.
### Send API request {#send-api-request}
1. Send the request.
2. Verify in the console that the request is encrypted and sent as encryptedData.
## Validate response {#validate-response}
Confirm that the request was successful by verifying:
* HTTP 200 response or expected business status
* Response payload from the API
* The plugin applies Authorization headers
* No scope or permission errors occurred
Tip: The following information explains how the Mastercard Insomnia plugin handles authentication and what a successful API response indicates.
* The Mastercard Insomnia plugin obtains an OAuth 2.0 access token using client credentials, private key JWT, and DPoP flow.
* The plugin automatically injects Authorization and related headers.
* The API returns a successful response for authorized scope.