# Quick Start: Test Loyalty Transactions in Sandbox
source: https://developer.mastercard.com/transactions-service/documentation/quick-start-guide/index.md

## Quick Start Guide {#quick-start-guide}

Test the Mastercard loyalty transaction API in Sandbox before connecting it to a cardholder rewards account page. The request retrieves transaction history and points earned; it does not create rewards, move money, or register webhooks.

Retrieve a rewards account's transaction history with `POST /transactions/searches`. This guide uses Postman and OAuth 1.0a for a complete first-call path.

## Prerequisites {#prerequisites}

* A [Mastercard Developers account](https://developer.mastercard.com/dashboard) with permission to create or configure a project.
* Postman and OpenSSL installed locally. You do not need Java for this path.
* Network access to `https://sandbox.api.mastercard.com`.
* Before sending: Sandbox credentials and confirmation from Product Delivery or your CIS Implementation Manager that the Sandbox Client ID is enabled.
* A Sandbox account RANAC available to your program. The request below uses the OpenAPI example; it is not a guarantee that this account is provisioned for your project. Ask your Mastercard representative for an available test account if needed.

Allow approximately five minutes for the request and validation steps once credentials, enablement, and Postman authentication are ready. Account creation, key setup, and any enablement wait are separate prerequisites; this is not a five-minute approval promise.

## Create Access and Credentials {#create-access-and-credentials}

1. Sign in to the [Developer Dashboard](https://developer.mastercard.com/dashboard), select **Create New Project**, and enter a project name.
2. Select **Loyalty Transactions** and choose **OAuth 1.0a** . The [Sandbox access tutorial](https://developer.mastercard.com/transactions-service/documentation/tutorials-and-guides/sandbox-access-tutorial/index.md) also covers adding Mastercard Loyalty Management to an existing project.
3. Set a key alias and keystore password, confirm the project, and download the Sandbox PKCS#12 (`.p12`) key package. Store the key and password securely outside source control.
4. Open **Sandbox Keys** and copy the full **Consumer Key** for request signing, including the portion after `!`. Send only the Client ID portion before `!` to your Product Delivery or CIS Implementation Manager for enablement, as described in [Share Your Sandbox Client ID](https://developer.mastercard.com/transactions-service/documentation/tutorials-and-guides/sandbox-access-tutorial/index.md#share-your-sandbox-client-id). Wait for confirmation before testing.
5. Confirm the Sandbox account identifier you will use. `userId` must be a RANAC and `userIdType` must be `RANAC`; do not send a card number. See [API Basics](https://developer.mastercard.com/transactions-service/documentation/api-basics/index.md#encryption) for sensitive-payload encryption requirements and [Encryption Configuration](https://developer.mastercard.com/transactions-service/documentation/api-basics-options/e2e-encryption-config/index.md) if your integration requires JWE.

## Configure Postman Authentication {#configure-postman-authentication}

1. Download the [OpenAPI specification](https://static.developer.mastercard.com/content/transactions-service/swagger/mrs-transactions-service-swagger.yaml). In Postman, select **Import** , choose the downloaded file, and create a collection. You can also use the [published collection](https://developer.mastercard.com/transactions-service/documentation/postman-collection/index.md).
2. Create a local Sandbox environment and select it. Set `baseUrl` to `https://sandbox.api.mastercard.com/loyalty/mrs` and `consumerKey` to the full Sandbox Consumer Key. Use local, unshared secret values or Postman Vault references; do not publish or export credentials with the collection.
3. Extract the signing key from your downloaded `.p12` package. Run this in a private local directory and enter passwords only into OpenSSL's prompts:

```sh
umask 077
openssl pkcs12 -in '/path/to/sandbox-signing-key.p12' -nocerts -out signing-key.encrypted.pem
openssl rsa -in signing-key.encrypted.pem -out signing-key.pem
```

4. Store the full PEM contents of `signing-key.pem` as the private local value of `privateKey`. This file contains an unencrypted private key: restrict access, never commit or share it, and remove the extracted file when no longer needed.
5. On the collection's **Authorization** tab, configure the following settings. They follow the official [Mastercard Postman tutorial](https://developer.mastercard.com/platform/tutorial/use-postman-for-mastercard-apis/).

|      Setting      |            Value             |
|-------------------|------------------------------|
| Type              | OAuth 1.0                    |
| Add auth data to  | Request Headers              |
| Signature Method  | RSA-SHA256                   |
| Consumer Key      | `{{consumerKey}}`            |
| Private Key       | `{{privateKey}}`             |
| Include body hash | Enabled in Advanced settings |

Leave timestamp and nonce generation to Postman. Use **Inherit auth from parent** on the request; do not paste a previously generated Authorization header.

## Sandbox First Call {#sandbox-first-call}

1. Open the imported `POST /transactions/searches` request. Set its full URL to `https://sandbox.api.mastercard.com/loyalty/mrs/transactions/searches?offset=0&limit=25`. The [environment table](https://developer.mastercard.com/transactions-service/documentation/api-basics/index.md#environments) lists the base URLs.
2. Set `Content-Type: application/json` and `Accept: application/json`. Select **Body** , **raw** , **JSON**, and paste:

```json
{
  "userId": "268810378058708149455458707247",
  "userIdType": "RANAC"
}
```

3. Replace `userId` with your available Sandbox RANAC if the schema example is not available to your project. Dates are optional; omit them for the first call to avoid filtering out available activity. Later, add `fromDate` and `toDate` in `YYYY-MM-DD` format as described in the [API Reference](https://developer.mastercard.com/transactions-service/documentation/api-reference/index.md).
4. Confirm the Sandbox environment is selected and the request inherits the collection's authentication. Click **Send**. Postman signs the final URL and body for this request.
5. Expect HTTP `200 OK` and a JSON transaction-details object. The response can include `accountId`, `customerId`, pagination fields (`offset`, `limit`, `total`, `count`), and a `transactions` array with dates, amounts, and points earned.

This illustrative response uses schema fields and example values; it is not a captured Sandbox response or a fixed fixture:

```json
{
  "offset": 0,
  "limit": 25,
  "total": 1,
  "count": 1,
  "accountId": "268810378058708149455458707247",
  "customerId": "345610378058708149455458702790",
  "transactions": [
    {
      "date": "2021-08-03",
      "description": "SAMSUNGMOBILES",
      "basePointsEarned": 5.51,
      "transactionAmount": 3000,
      "transactionCurrencyCode": "840"
    }
  ]
}
```

6. Add this script to the request's **Scripts \> Post-response** tab (called **Tests** in older Postman versions) and send again:

```javascript
pm.test("Transaction search returns HTTP 200", () => {
  pm.response.to.have.status(200);
});
pm.test("Response is a transaction-details object", () => {
  const body = pm.response.json();
  pm.expect(body).to.be.an("object");
  pm.expect(body).not.to.have.property("Errors");
  if (body.transactions !== undefined) {
    pm.expect(body.transactions).to.be.an("array");
    if (body.count !== undefined) {
      pm.expect(body.count).to.equal(body.transactions.length);
    }
  }
  if (body.accountId !== undefined) {
    const request = JSON.parse(pm.variables.replaceIn(pm.request.body.raw));
    pm.expect(body.accountId).to.equal(request.userId);
  }
});
```

The schema does not mark response properties as required, so the checks validate fields when present. An empty `transactions` array can be a successful search with no matching activity; it does not demonstrate populated test-data coverage. For a populated-data test, use an account with known transactions and compare returned activity with that account's expected data.

## Resolve a Failed Call {#resolve-a-failed-call}

|            Result             |                                                                                                Next action                                                                                                 |
|-------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| HTTP 400                      | Read `Errors.Error`, correct the named missing or invalid field, and send again so Postman creates a fresh signature.                                                                                      |
| HTTP 401 or 403               | Check the selected environment, full Consumer Key, private key, body hash, and Client ID enablement. Inspect `ReasonCode`: `ACCOUNT_NOT_FOUND` requires an available account, not a new signature alone.   |
| HTTP 404                      | Check that the URL contains `/loyalty/mrs/transactions/searches` once and the method is POST.                                                                                                              |
| HTTP 5xx or non-JSON response | Record the status and sanitized error details. Follow the retry and support guidance in [Code and Formats](https://developer.mastercard.com/transactions-service/documentation/code-and-formats/index.md). |

Use [Code and Formats](https://developer.mastercard.com/transactions-service/documentation/code-and-formats/index.md) for code-specific corrections. Do not share private keys, passwords, tokens, or authentication headers in support requests.

## Next Steps {#next-steps}

To connect the response to your application, follow [Display a rewards activity feed](https://developer.mastercard.com/transactions-service/documentation/use-cases/transaction-details-service/index.md#display-a-rewards-activity-feed). For customer service and program testing, use [Investigate missing cardholder rewards points](https://developer.mastercard.com/transactions-service/documentation/use-cases/transaction-details-service/index.md#investigate-missing-cardholder-rewards-points) and [Verify base and bonus rewards credits](https://developer.mastercard.com/transactions-service/documentation/use-cases/transaction-details-service/index.md#verify-base-and-bonus-rewards-credits).

Run the [missing-field negative test](https://developer.mastercard.com/transactions-service/documentation/tutorials-and-guides/api-testing-tutorial/index.md#test-a-missing-required-field), then follow [Integration and Testing](https://developer.mastercard.com/transactions-service/documentation/tutorials-and-guides/api-testing-tutorial/index.md) for a generated Java client. Read the [Transaction Details use case](https://developer.mastercard.com/transactions-service/documentation/use-cases/transaction-details-service/index.md) for the business flow. After validating Sandbox behavior, follow [Move Project to Production](https://developer.mastercard.com/transactions-service/documentation/tutorials-and-guides/production-access-tutorial/index.md).