Fraud and Loss Database Reference Implementation

This reference implementation showcases the Fraud and Loss Database (FLD) APIs from: Mastercard Developers.

---

Frameworks / Libraries used

• Apache Maven
• OpenAPI Generator
• Mastercard OAuth1 Signer library

---

Prerequisite

• JDK 8+
• Set up the JAVA_HOME environment variable to match the location of your Java installation.
• Set up the MAVEN_HOME environment variable to match the location of your Maven bin folder.

---

Setup

1. Create an account on Mastercard Developers.
2. Create a new project here.
3. Add the Fraud And Loss Database API to your project and click continue.
4. Give your project a name and optionally invite other team members, then click continue.
5. Download the Sandbox Signing Key zip and unzip it. This should result in a .p12 file.
6. Finish creating the project.
7. Navigate to your projects page, found here and select your project.
8. Here, under your sandbox keys, you should be able to see a consumer key, default keystore alias and default keystore password.
9. Copy the downloaded .p12 and .pem files to src/main/resources folder in your code.
10. Open src/main/resources/application.properties and configure:
    • mastercard.fld.api.url - URL of the API.
    • mastercard.fld.client.p12.path - Path to keystore (.p12) file, just change the name as per the downloaded file in step 5.
    • mastercard.fld.client.ref.app.consumer.key - Copy the Consumer key from "Sandbox/Production Keys" section on your project page
    • mastercard.fld.client.ref.app.keystore.alias - Alias of your key. Default key alias for the sandbox is keyalias.
    • mastercard.fld.client.ref.app.keystore.password - Password of your Keystore. Default keystore password for sandbox project is keystorepassword.
    • mastercard.fld.client.ref.app.encryption.file - Path to encryption key (.pem) file, just change the name as per the downloaded file in step 9, e.g. src/main/resources/<fileName>.pem.
    • mastercard.fld.client.ref.app.encryption.key - Copy the encryption key from "Sandbox/Production Keys" section on your project page
11. Run mvn clean install from the root of the project directory.
12. You should now be able to run all the provided API calls that are organized under src/main/java/com/mastercard/fld/api.

---

Configuring Payload Encryption

The Mastercard Encryption Library provides interceptor class you can use when configuring your API client. This interceptor will encrypt the payload before sending the request.

Encryption Config

FieldLevelEncryptionConfig config = FieldLevelEncryptionConfigBuilder
                    .aFieldLevelEncryptionConfig()
                    .withEncryptionCertificate(cert)
                    .withEncryptionPath("$", "$")
                    .withEncryptedValueFieldName("encryptedData")
                    .withEncryptedKeyFieldName("encryptedKey")
                    .withOaepPaddingDigestAlgorithmFieldName("oaepHashingAlgorithm")
                    .withOaepPaddingDigestAlgorithm("SHA-256")
                    .withEncryptionKeyFingerprintFieldName("publicKeyFingerprint")
                    .withIvFieldName("iv")
                    .withFieldValueEncoding(FieldLevelEncryptionConfig.FieldValueEncoding.HEX)
                    .build();

See also:

• Securing Sensitive Data Using Payload Encryption.

---

Tutorial

Several tutorials have been provided under src/test/java/com/mastercard/fld/api that will show the different FLD flows. These examples will cover FDA, FDC, FDD & FDE.

---

Documentation for API Endpoints

*NOTE: Make sure you use the latest Fraud and Loss Database API specification.

Class	Method	HTTP request
ConfirmFraudManageApi	fraudChangeMastercardWithHttpInfo(body)	PUT /confirmed-frauds/mastercard-frauds
ConfirmFraudManageApi	fraudStateWithHttpInfo(body)	PUT /confirmed-frauds/fraud-states
ConfirmFraudSubmissionApi	createCaseFilingWithHttpInfo(body)	POST /confirmed-frauds/mastercard-frauds

---

How to generate the client library

Go to the link here to read up on how to generate the client library with the openapi-generator.

---

Contact us

Please email API Support with any questions or feedback you may have.

---

License and Copyright

Copyright 2021 Mastercard

Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at:

   http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.