# Onboarding Checklist source: https://developer.mastercard.com/user-account-management-service/documentation/tutorials-and-guides/onboarding-checklist/index.md ## Overview {#overview} This checklist describes every stage required to take a User Account Management integration from Sandbox to Production. For each stage it lists who owns it, what must be true before you start (entry criteria), what must be true before you move on (exit criteria), and the expected turnaround time. If a stage takes longer than its SLA, follow the [escalation path](https://developer.mastercard.com/user-account-management-service/documentation/tutorials-and-guides/onboarding-checklist/index.md#escalation). ## Stages {#stages} | # | Stage | Owner | Entry criteria | Exit criteria | SLA | |---|---------------------------|-----------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------| | 1 | Sandbox setup | Customer | Mastercard Developers account created. | Project created with User Account Management. Sandbox OAuth and encryption keys downloaded. First Sandbox call succeeds ([Quick Start Guide](https://developer.mastercard.com/user-account-management-service/documentation/quick-start-guide/index.md)). | Immediate (self-service) | | 2 | Sandbox validation | Customer | Stage 1 complete. | All positive and negative scenarios on the [Testing](https://developer.mastercard.com/user-account-management-service/documentation/testing/index.md) page pass for the endpoints you will use. | Customer-driven | | 3 | Commercial agreement | Customer and Mastercard representative | Use cases and endpoints in scope are agreed. | Agreement for Mastercard Loyalty Management signed by both parties. Company ICA and program identifiers confirmed. | Agreed with your Mastercard representative | | 4 | Production access request | Customer, then Mastercard API Support | Stages 2 and 3 complete. | **Request Production Access** submitted from the project ([Move Project to Production](https://developer.mastercard.com/user-account-management-service/tutorial/production-access/index.md)). Approval email received and Production status is `Ready`. | 3--5 working days from submission | | 5 | Program configuration | Mastercard Product Delivery or CIS Implementation Manager | Production access approved. Production Client ID (first 48 characters of the consumer key) sent to your Implementation Manager. | Client ID mapped to your program and company ICA. Program, product codes, and enrollment rules configured. | 5--7 business days from receipt of the Client ID | | 6 | Production verification | Customer | Stage 5 confirmed by your Implementation Manager. Application switched to the Production base URL and Production keys. | A read-only call such as `GET /users/{id}` returns `200` in Production. No `PROGRAM_MAPPING_ERROR` or `SITE_PROGRAM_MAPPING_ERROR`. | Same day | | 7 | Go-live | Customer and Mastercard representative | Stage 6 complete. | Production traffic enabled. Monitoring and support contacts agreed. | Agreed go-live date | ## Checklist {#checklist} Use this list to confirm you are ready before you move to the next stage. **Sandbox** * [ ] Project created and User Account Management selected * [ ] Sandbox signing key (`.p12`), key alias, and keystore password stored securely * [ ] Client encryption certificate and Mastercard encryption key downloaded * [ ] First Sandbox call succeeds * [ ] All relevant [Testing](https://developer.mastercard.com/user-account-management-service/documentation/testing/index.md) scenarios pass, including JWE-encrypted endpoints **Production** * [ ] Commercial agreement signed * [ ] Company ICA, program identifiers, and product codes confirmed with your Mastercard representative * [ ] Production access requested and approved * [ ] Production Client ID sent to your Implementation Manager * [ ] Program configuration confirmed * [ ] Application configured with the Production base URL `https://api.mastercard.com/loyalty/mrs` and Production keys * [ ] First Production call succeeds ## Escalation {#escalation} If a stage exceeds its SLA, or if you are blocked by a configuration error, escalate in this order: | Level | When | Contact | Channel | |-------|------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------| | 1 | Any blocker, or SLA exceeded by 1 business day | Mastercard Developers Support | Submit a request through [Get Help](https://developer.mastercard.com/user-account-management-service/documentation/support/index.md#get-help) | | 2 | No response from Level 1 within 2 business days, or the issue is program configuration (stages 3, 5) | Your Mastercard account representative, Product Delivery Manager, or CIS Implementation Manager | Email, quoting the Level 1 support ticket number | | 3 | No resolution from Level 2 within 3 business days, or the go-live date is at risk | Your Mastercard regional manager | Email via your account representative, quoting the ticket number | Tip: If you do not have a Mastercard representative, use [Get Help](https://developer.mastercard.com/user-account-management-service/documentation/support/index.md#get-help) and state that you need an account representative assigned. ### What to include {#what-to-include} Include the following in every escalation so that it can be addressed without follow-up questions: * Project name and environment (Sandbox or Production) * Client ID (first 48 characters of the consumer key, up to the `!`) * Company ICA and program identifier * Stage that is blocked and the date the stage started * Endpoint, HTTP method, timestamp (UTC), HTTP status, and `ReasonCode` of a failing call * Any `Correlation-Id` header returned by the gateway Warning: Never send private keys, keystore passwords, full card numbers (BAN), or other cardholder data in a support request or email.