# API Basics
source: https://developer.mastercard.com/small-business-credit-analytics/documentation/api-basics/index.md

## API Security {#api-security}

### Client Authentication {#client-authentication}

Mastercard uses OAuth 1.0a for authenticating your application. You can manage your authentication keys from your [Developer Dashboard](https://developer.mastercard.com/dashboard) after you created a project using Small Business Credit Analytics.
Tip: Do you want to learn more about the authentication scheme Mastercard uses? For that, read our [Using OAuth 1.0a to Access Mastercard APIs](https://developer.mastercard.com/platform/documentation/security-and-authentication/using-oauth-1a-to-access-mastercard-apis/) guide.

### Transport Encryption {#transport-encryption}

All requests to the Small Business Credit Analytics API must be made over HTTPS. Mastercard enforces TLS 1.2 or higher for all API traffic, ensuring data is encrypted in transit between your application and Mastercard servers.

### Payload Encryption {#payload-encryption}

The Small Business Credit Analytics API does not use payload (field-level) encryption. Request and response bodies are protected in transit by TLS 1.2 or higher, so no additional JWE or Mastercard payload encryption setup is required to call the API.

## How to Consume the SBCA API? {#how-to-consume-the-sbca-api}

Note: There are multiple ways of integrating with Small Business Credit Analytics:

1. Using a generated API client (recommended)
2. Using a method of your choice

### Generating your own Small Business Credit Analytics API client {#generating-your-own-small-business-credit-analytics-api-client}

Create customizable API clients from the Small Business Credit Analytics API specification and let Mastercard open-source client libraries handle the authentication for you. This approach offers the more flexibility and is strongly recommended.

For this, please follow our [Generating and Configuring a Mastercard API Client](https://developer.mastercard.com/platform/documentation/security-and-authentication/generating-and-configuring-a-mastercard-api-client/) tutorial with:

* The following API specification: [swagger.yaml](https://static.developer.mastercard.com/content/small-business-credit-analytics/swagger/swagger.yaml) (35KB)

### Using a method of your choice {#using-a-method-of-your-choice}

Small Business Credit Analytics exposes a REST API: you are free to use the REST/HTTP client of your choice and can still leverage the Mastercard open-source [client libraries](https://developer.mastercard.com/platform/documentation/security-and-authentication/using-oauth-1a-to-access-mastercard-apis/#client-libraries) for signing your requests.

For that, please refer to the Small Business Credit Analytics [REST API Reference](https://developer.mastercard.com/small-business-credit-analytics/documentation/api-reference/index.md).

You can also use API development tools like Insomnia or Postman to test the API in Sandbox. Refer to the [Postman Collection](https://developer.mastercard.com/small-business-credit-analytics/documentation/postman-collection/index.md) page to find the tutorial and collection file for Postman or refer to the tutorial for [Insomnia](https://developer.mastercard.com/platform/tutorial/use-insomnia-rest-client-for-mastercard-apis/) to get started with using the SBCA API.

## Environments {#environments}

The table below describes the two different environments that are available.

| **Environment** |                                  **Base URL**                                  |                                                                                                                                                                             **Description**                                                                                                                                                                             |
|-----------------|--------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Sandbox         | `https://sandbox.api.mastercard.com/small-business/credit-analytics/locations` | Early access environment containing limited-capability mock API's, intended to help assist with the initial integration for new clients. The sandbox returns mock responses for a defined request. The samples can be used as a reference for sending requests and receiving responses. The Sandbox would only validate the length and data type of request parameters. |
| Production      | `https://api.mastercard.com/small-business/credit-analytics/locations`         | Full production environment containing the latest production API release. Once all testing has complete and you are ready to go live, you should request access to live production environment.                                                                                                                                                                         |

Note: OAuth 1.0a authentication work the same way in Sandbox and Production. The main changes are the Production key set, the Production approval state, and the Production base URL.

## Next Steps {#next-steps}

* [Quick Start Guide](https://developer.mastercard.com/small-business-credit-analytics/documentation/quick-start-guide/index.md) --- make your first sandbox call
* [API Reference](https://developer.mastercard.com/small-business-credit-analytics/documentation/api-reference/index.md) --- full endpoint details
* [Postman Collection](https://developer.mastercard.com/small-business-credit-analytics/documentation/postman-collection/index.md) --- test without writing code
* [Testing](https://developer.mastercard.com/small-business-credit-analytics/documentation/testing/index.md) --- sandbox test cases and scenarios
* [Use Cases](https://developer.mastercard.com/small-business-credit-analytics/documentation/use-cases/index.md) --- business scenario walkthroughs