# Testing source: https://developer.mastercard.com/user-account-management-service/documentation/testing/index.md ## Overview {#overview} Use this page to verify your User Account Management integration in the Sandbox environment before you request Production access. For each endpoint, it lists the test data to send, the expected result for positive and negative paths, how to validate the response, and where to look when a call fails. Note: Complete the [Quick Start Guide](https://developer.mastercard.com/user-account-management-service/documentation/quick-start-guide/index.md) first. You need Sandbox OAuth keys and, for encrypted endpoints, your client encryption certificate and Mastercard encryption key. ## Before you test {#before-you-test} | Item | Value | |--------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | Base URL | `https://sandbox.api.mastercard.com/loyalty/mrs` | | Authentication | OAuth 1.0a signature using your **Sandbox** signing key and consumer key. See [API Basics](https://developer.mastercard.com/user-account-management-service/documentation/api-basics/index.md#client-authentication). | | Payload encryption | Required for endpoints marked **JWE** below. Encrypt the full request body (`$`) and decrypt the response with your Mastercard encryption key. See [API Basics](https://developer.mastercard.com/user-account-management-service/documentation/api-basics/index.md#transport-encryption). | | Test data | The Sandbox returns mocked data. Use the identifier values from the scenarios below, which match the examples in the [API Reference](https://developer.mastercard.com/user-account-management-service/documentation/api-reference/index.md). | | Tools | [Insomnia Collection](https://developer.mastercard.com/user-account-management-service/documentation/developer-tools/insomnia-collection/index.md), [Reference Application](https://developer.mastercard.com/user-account-management-service/documentation/developer-tools/reference-app/index.md), or a client generated with the [Integration and Testing tutorial](https://developer.mastercard.com/user-account-management-service/documentation/tutorials-and-guides/api-testing-tutorial/index.md). | ## Endpoints under test {#endpoints-under-test} | Endpoint | Operation | Encryption | Use case | |--------------------------------------------------------------|-------------------------------|--------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------| | `POST /users` | Enroll user and first account | JWE | [Enroll User](https://developer.mastercard.com/user-account-management-service/documentation/use-cases/user-management/index.md#enroll-user) | | `PUT /users` | Update user | None | [Update User](https://developer.mastercard.com/user-account-management-service/documentation/use-cases/user-management/index.md#update-user) | | `GET /users/{id}` | Retrieve user | None (JWE response when `include_verification_details=true`) | [Retrieve User](https://developer.mastercard.com/user-account-management-service/documentation/use-cases/user-management/index.md#retrieve-user) | | `POST /users/{id}/verifications` | Verify user | JWE | [Verify User](https://developer.mastercard.com/user-account-management-service/documentation/use-cases/user-management/index.md#verify-user) | | `POST /accounts` | Enroll additional account | JWE | [Enroll Account](https://developer.mastercard.com/user-account-management-service/documentation/use-cases/account-management/index.md#enroll-account) | | `PUT /accounts` | Update account | None | [Update Account](https://developer.mastercard.com/user-account-management-service/documentation/use-cases/account-management/index.md#update-account) | | `GET /accounts/{id}` | Retrieve account | None | [Retrieve Account](https://developer.mastercard.com/user-account-management-service/documentation/use-cases/account-management/index.md#retrieve-account) | | `PUT /account-groups` | Group accounts (householding) | None | [Account Groups](https://developer.mastercard.com/user-account-management-service/documentation/use-cases/account-management/index.md#group-accounts) | | `POST /users/references/searches` | Lookup identifiers | JWE | [Lookup Identifiers](https://developer.mastercard.com/user-account-management-service/documentation/use-cases/lookup-identifiers/index.md) | | `POST /lost-stolen-cards` | Replace lost or stolen card | JWE | [Lost Stolen Card](https://developer.mastercard.com/user-account-management-service/documentation/use-cases/lost-stolen-card/index.md) | | `POST /accounts/pan-blocks` | Block PAN auto-enrollment | JWE | [PAN Block](https://developer.mastercard.com/user-account-management-service/documentation/use-cases/pan-block/index.md) | | `POST /cls/accounts/activations` | Add CLS offer activation | None | [CLS Offer Activations](https://developer.mastercard.com/user-account-management-service/documentation/use-cases/cls-offer-activation/index.md) | | `GET /cls/accounts/{account_id}/activations` | Retrieve CLS activations | None | [CLS Offer Activations](https://developer.mastercard.com/user-account-management-service/documentation/use-cases/cls-offer-activation/index.md) | | `PUT /cls/accounts/{account_id}/activations/{activation_id}` | Update CLS activation | None | [CLS Offer Activations](https://developer.mastercard.com/user-account-management-service/documentation/use-cases/cls-offer-activation/index.md) | ## Test scenarios {#test-scenarios} Each scenario lists the input to change and the expected outcome. Negative scenarios return the standard error structure described in [Code and Formats](https://developer.mastercard.com/user-account-management-service/documentation/code-and-formats/index.md#error-structure). ### User management {#user-management} | # | Scenario | Request | Expected result | |----|----------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------| | U1 | Retrieve user (positive) | `GET /users/268810378058708149455458707247?user_id_type=RANCU` | `200 OK` with `userId`, `userIdType`, name, and address fields. | | U2 | Retrieve user with verification details (positive) | U1 plus `include_verification_details=true&language=en_US` | `200 OK`, JWE-encrypted response containing `verificationDetails[]`. Decrypt with your Mastercard encryption key. | | U3 | Retrieve user, wrong identifier type (negative) | U1 with `user_id_type=BCN` | `400`, `INVALID_INPUT`: supported value for user_id_type is RANAC or RANCU. | | U4 | Enroll user (positive) | `POST /users` with `companyIca`, `userId` (BCN), `userIdType=BCN`, and an `account` object (`accountIdType=BAN`, `status=NEW`, `productCode`, `programIdentifier`). Encrypted. | `201 Created` with `userId`/`accountId` as RANCU/RANAC and a `Location` header. | | U5 | Enroll user, body not encrypted (negative) | U4 sent as plain JSON | `400`, `ENCRYPTION_ERROR`. | | U6 | Enroll user, invalid account status (negative) | U4 with `account.status=CANCELLED` | `400`, `INVALID_INPUT`: supported value for accountStatus are NEW and GOOD_STANDING. | | U7 | Update user (positive) | `PUT /users` with `userId`, `userIdType=RANCU`, and `emailAddress` | `200 OK`, empty body. | | U8 | Verify user (positive) | `POST /users/{id}/verifications?user_id_type=RANCU` with `userVerificationDetails: [{ "code": "VALID_CUST_POSTAL_CODE", "answer": "638001" }]`. Encrypted. | `200 OK`, `message`: Successfully verified user. | | U9 | Verify user, invalid birth date format (negative) | U8 with `code=VALID_CUST_BIRTHDATE`, `answer=10-03-1975` | `400`, `INVALID_INPUT`: Birthdate is expected in 'yyyy-MM-dd' format. | ### Account management {#account-management} | # | Scenario | Request | Expected result | |----|------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------| | A1 | Retrieve account (positive) | `GET /accounts/268810378058708149455458707247?account_id_type=RANAC` | `200 OK` with `accounts[]`, `offset`, `limit`, `total`, `count`. | | A2 | Retrieve account, invalid limit (negative) | A1 with `limit=30` | `400`, `INVALID_INPUT`: limit must not be greater than 25. | | A3 | Enroll account (positive) | `POST /accounts` for an existing user (`userIdType=BCN` or `RANCU`) with `accountIdType=BAN`, `status=NEW`, `productCode`, `programIdentifier`, `companyIca`. Encrypted. | `201 Created` with `accountId` (RANAC). | | A4 | Enroll account, Luhn check failure (negative) | A3 with an `accountId` that fails the Luhn check | `400`, `LUHN_CHECK_ERROR`. | | A5 | Update account (positive) | `PUT /accounts` with `accountId`, `accountIdType=RANAC`, `status=GOOD_STANDING`, `accruePoints=true` | `200 OK`, empty body. | | A6 | Update account, product transfer without product code (negative) | A5 with `productTransfer=true` and no `bankProductCode` | `400`, `INVALID_INPUT`: bankProductCode cannot be null or empty if productTransfer is true. | | A7 | Group accounts (positive) | `PUT /account-groups` with `actionCode=MA`, `sourceId` (RANAC), `sourceIdType=RANAC`, `targetId` (household ID), `targetIdType=HHID` | `200 OK`, empty body. | | A8 | Group accounts, invalid action code (negative) | A7 with `actionCode=XX` | `400`, `INVALID_INPUT`: Invalid actionCode. Permitted values are MA, MH, DA, DH. | ### Identifiers, lost or stolen cards, and PAN blocks {#identifiers-lost-or-stolen-cards-and-pan-blocks} | # | Scenario | Request | Expected result | |----|------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------| | L1 | Lookup identifiers (positive) | `POST /users/references/searches` with `userId=5444163200000015000`, `userIdType=BAN`, `includeSensitiveIdentifiers=false`. Encrypted. | `200 OK` with `userReferences[]` containing `customerId` (RANCU) and `accountDetails[]` (RANAC, first and last four digits). | | L2 | Lookup identifiers, unsupported type (negative) | L1 with `userIdType=EMAIL` | `400`, `INVALID_INPUT`: supported value for userIdType is RANAC, RANCU, BAN, BCN or MBL. | | S1 | Replace lost or stolen card (positive) | `POST /lost-stolen-cards` with `oldAccountId` (RANAC), `actionCode=A`, `newAccountNumber`, `status=GOOD_STANDING`. Encrypted. | `200 OK`, `message`: Successfully processed Lost Stolen request. | | S2 | Replace lost or stolen card, missing new number (negative) | S1 without `newAccountNumber` | `400`, `INVALID_INPUT`: newAccountNumber cannot be null or empty when actionCode is either A or B. | | P1 | Block PAN auto-enrollment (positive) | `POST /accounts/pan-blocks` with `accountId` (BAN), `accountIdType=BAN`, future `beginDate`/`endDate`, `programs: ["PGM41632"]`. Encrypted. | `200 OK`, `message`: Successfully blocked PAN auto enrollment. | | P2 | Block PAN, dates out of order (negative) | P1 with `beginDate` after `endDate` | `400`, `INVALID_INPUT`: beginDate should be less than or equal to endDate. | ### CLS offer activations {#cls-offer-activations} | # | Scenario | Request | Expected result | |----|----------------------------------------------|---------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------| | C1 | Add activation (positive) | `POST /cls/accounts/activations` with `userId` (RANAC), `userIdType=RANAC`, `transactionFilterCode`, `activationStatus=A` | `200 OK` with `activationId`. | | C2 | Add activation, invalid status (negative) | C1 with `activationStatus=X` | `400`, `INVALID_INPUT`: supported value for activationStatus is A or I. | | C3 | Retrieve activations (positive) | `GET /cls/accounts/{account_id}/activations?activation_status=ACTIVE` | `200 OK` with `accountActivations[]`. | | C4 | Update activation (positive) | `PUT /cls/accounts/{account_id}/activations/{activation_id}` with `activationStatus=I` | `200 OK`, empty body. | | C5 | Update activation, missing status (negative) | C4 with no `activationStatus` | `400`, `INVALID_INPUT`: activationStatus cannot be null or empty. | ## Recommended end-to-end flow {#recommended-end-to-end-flow} Run these calls in order to exercise the full lifecycle of a cardholder: 1. **Enroll** a user and first account: `POST /users` (U4). Save the returned RANCU and RANAC. 2. **Retrieve** the user: `GET /users/{RANCU}?user_id_type=RANCU` (U1). 3. **Enroll** a second account for the same user: `POST /accounts` (A3). 4. **Retrieve** the accounts: `GET /accounts/{RANAC}?account_id_type=RANAC` (A1). 5. **Activate** a CLS offer for the account: `POST /cls/accounts/activations` (C1), then retrieve it (C3). 6. **Replace** a lost card: `POST /lost-stolen-cards` (S1). 7. **Swap** identifiers when you need the real values: `POST /users/references/searches` (L1). ## Validating results {#validating-results} For every call, check: * **HTTP status** : `200` for reads and updates, `201` for `POST /users` and `POST /accounts`. * **Response body** : required identifiers are present (`userId`/`userIdType`, `accountId`/`accountIdType`, `activationId`). * **Encryption** : for JWE endpoints, the response body contains `encryptedPayload`. After decryption it matches the schema in the [API Reference](https://developer.mastercard.com/user-account-management-service/documentation/api-reference/index.md). * **Errors** : a negative scenario returns `Errors.Error[]` with the expected `ReasonCode`. `Recoverable=false` means you must change the request before retrying. ## Troubleshooting {#troubleshooting} | Symptom | Likely cause | What to do | |----------------------------------------------------------------|-------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | `401` from the gateway, `Source=Gateway` | OAuth signature invalid, wrong consumer key, or Sandbox key used against Production | Re-check the consumer key and signing key for the environment you are calling. See [Gateway Error Codes](https://developer.mastercard.com/platform/documentation/security-and-authentication/gateway-error-codes/). | | `401`, `PROGRAM_MAPPING_ERROR` or `SITE_PROGRAM_MAPPING_ERROR` | Client ID not mapped to a program | Production only: contact your Mastercard representative. See [Onboarding Checklist](https://developer.mastercard.com/user-account-management-service/documentation/tutorials-and-guides/onboarding-checklist/index.md#escalation). | | `400`, `ENCRYPTION_ERROR` | Body sent in plain text to a JWE endpoint | Enable the JWE interceptor for that request. | | `400`, `DECRYPTION_ERROR` | Wrong client encryption certificate or fingerprint | Download the current client encryption certificate from your project and update the fingerprint. | | `400`, `INVALID_INPUT` | Field value or identifier type not supported | Read `Description`, then check the field in the [API Reference](https://developer.mastercard.com/user-account-management-service/documentation/api-reference/index.md). | | Timeout from the gateway | Call took longer than 15 seconds | Retry. If it persists, raise a request through [Get Help](https://developer.mastercard.com/user-account-management-service/documentation/support/index.md#get-help). | For the full list of reason codes and resolutions, see [Code and Formats](https://developer.mastercard.com/user-account-management-service/documentation/code-and-formats/index.md). ## Sandbox and Production differences {#sandbox-and-production-differences} | Aspect | Sandbox | Production | |--------------------------------------------------------------------------------------------------------------|--------------------------------------------------|------------------------------------------------------------------------------------| | Base URL | `https://sandbox.api.mastercard.com/loyalty/mrs` | `https://api.mastercard.com/loyalty/mrs` | | Keys | Sandbox signing key and encryption keys | Separate Production signing key and encryption keys | | Availability | Immediately after project creation | After Production access is approved and your Client ID is mapped to your program | | Data | Mocked responses | Live program, user, and account data | | Program configuration errors (`PROGRAM_MAPPING_ERROR`, `INVALID_PROGRAM_IDENTIFIER`, `INVALID_PRODUCT_CODE`) | Not expected | Returned when program setup is incomplete. Contact your Mastercard representative. | ## Next steps {#next-steps} When all the scenarios above pass, follow the [Onboarding Checklist](https://developer.mastercard.com/user-account-management-service/documentation/tutorials-and-guides/onboarding-checklist/index.md) to move to Production.