Token validation Failed for VPP API

[kranti-rzp]

Hi,
I am able to complete the two way-ssl authentication for the hello world API. 
However when trying out the refund API(https://sandbox.api.visa.com/acs/v1/payments/refunds), I am getting the following error:

{"responseStatus": {
   "status": 401,
   "code": "9210",
   "severity": "ERROR",
   "message": "Token validation failed",
   "info": ""
}}

I am encrypting the body with the server_encryption public key, downloaded from the key tab. 
Request

POST <a href="https://sandbox.api.visa.com/acs/v1/payments/refunds" target="_blank">https://sandbox.api.visa.com/acs/v1/payments/refunds</a> HTTP/1.1
Accept-Encoding: gzip,deflate
Content-Type: application/json
Authorization: Basic RFdJTENLOTFCRTU3SFFKWTQ3TUoyMURvZDJYQXJKUk9ESHJXQ1lvQ0ZlY3VEUnZPczpjNHBBNDJndWxuQkhqZ3R3NENrOFhFMW9OMHY=
Accept: application/json
keyId: 8121367b-cf74-410a-9325-ae979d778dd8
Content-Length: 911
Host: sandbox.api.visa.com
Connection: Keep-Alive
User-Agent: Apache-HttpClient/4.1.1 (java 1.5)

{"encData":"eyJlbmMiOiJBMTI4R0NNIiwiaWF0IjoxNTYzMTY4MjcyMTU0LCJhbGciOiJSU0EtT0FFUC0yNTYiLCJraWQiOiI3MzdjYjE2Ni00ZWQ1LTRhMzktODljMy1lZDY0NDM1NDc4YWMifQ.fUbu4rH4Z8bfqkXJelxB3h-1gsHZpCouhMzMqnNT9UxUMQK9416tPh7_AN6UlPB0ElW5WBIUPoWXPEy33mqrJJWJVlL9JVoSpHxey03-T8swq3EsPpYeWVIVzjdJCXsm0nmvz6Sxjk1Gpl98UAcZWCji1Id_0twEgn-SdRFO_odkVAyNP2sa8cjOIXoiTUCwSEW7CDvkSE3tYgokYCtIbwW7EqAxBJ8WFaa792WFoDRg0Ww07BcM1xk2F-Iauq4ezSsbnvB6Mfs1qAz6j8oDLBwCGzzBUZYSsa7jMA7_xsfZLMhdWTIa9PwmirwVmXkQfVambDD1C_e64zKz5C5RsQ.jVA3jZBy3sjOjJar.4xXsS7WoMjB5IBbN7cT5pk7VqL1IEsfRGpoMf2ixNGKU2wKueiCVBuKQ33ABO1rHKYz4WhT3RBQJ0T9_sJydfFdjj2WxhIjFNm6HgF_qwhPepY1uvmsBtOWUbtVj8cS_H2zCJ3aLi-CPwXhXB_GJqVBKGridUkK006XAlXzzJujYbTHq2PahqsME5kA0-kjgJu2mUgYc3ZR-hahoPS8jfU0oFtO0U54x9CNLMPfH-0Yr2A270_JU3L5LxXrCZUl9DUcM_KjflOyDwnov0xR4PFWiYOz1wzs3xbiCZ0o8cRcdbQQ7zi8yKhdJCd-wQdAh2UboMviObUiZYCt-mR6oFpoKL0IeeKJcEf3bOMmYKzchXfsXZ8myr0o.7vY6URXhzdte1Gzo-3bX5Q"}

Please help me resolve this issue. 

[DianaTran-Yee]

Hey @kranti-rzp,

To further investigate, please provide the following information:

1. End Point
2. Request Header
3. Request Body
4. Response Header (include the x-correlation-id)
5. Response Body

Using SoapUI, you can find the x-correlation-id in the Raw Tab of the response header.

[kranti-rzp]

Hey Diana,

I am facing the issue across APIs in VPP.

The end points being:

https://sandbox.api.visa.com/acs/v1/authorizations

https://sandbox.api.visa.com/acs/v1/payments/refunds

For the Authorization API, the curl request is:

curl -X POST \
https://sandbox.api.visa.com/acs/v1/payments/authorizations \
-H 'Accept: application/json' \
-H 'Authorization: Basic NVIwVjEzQlExRUkwWVFRWE5KQ0IyMUN3eUhjU0g4MmJmUktneHROZTZVRkhGLXV0ODowcGtMc3VrQXdY' \
-H 'Cache-Control: no-cache' \
-H 'Connection: keep-alive' \
-H 'Content-Type: application/json' \
-H 'Host: sandbox.api.visa.com' \
-H 'Postman-Token: 72b3907b-2663-4bc6-be31-6e289bbb72f1,c37de1f1-1a46-4e3e-82cb-792c361f98a3' \
-H 'User-Agent: PostmanRuntime/7.15.0' \
-H 'accept-encoding: gzip, deflate' \
-H 'cache-control: no-cache' \
-H 'content-length: 1064' \
-H 'keyId: bdee29f0-32e9-44f7-a36d-a3308a6cb0ca' \
-d '{"encData":"eyJlbmMiOiJBMTI4R0NNIiwiaWF0IjoxNTYzMTg0MjIxMTY2LCJhbGciOiJSU0EtT0FFUC0yNTYiLCJraWQiOiJiZGVlMjlmMC0zMmU5LTQ0ZjctYTM2ZC1hMzMwOGE2Y2IwY2EifQ.uDW_8vKqHm7lFuZw-o-FG6zJ5rh4E0UzFyLXZXUn3MG4tmGTRlcKEb0DtScQY9xdVHyR5U9y1eJT0Z8hTf7i5GhD9P98iwt0K5QfyOZhK_Ghd-OhKCbH26vYhT52hAPZqwer9KpsjCqRqkYC950BqHvoDIpkkZJpyBu0nU_shjJ-x3wuI9KcsFUtLMb4JxcJAgkTay4hsvLoNqVCb8ybcqVFGsrZWnQEujR-CVSGG4Idpk-0NZDv4c_9GkiFNKQOeEHWu5Yx4O_ZVuw3MXkIFb8_RDvSPbv9JWgSBrg32HQIsTrQfGPy6UyEC7ub3T_-aJTogsPfzEQ7s7cq4MjCSQ.gxC3qNqWZA3-41BJ.HDQfIpYHAWZbHG-dN8HhubOtUYN8OnOYSQgevsroiyW6BSVxLabgxBFSNGWug-ttN-4ZJSM28jgEbn_DKgAbyIPsm0Ydfde4Rkx11dLksB5r0La_SPLd1DlXcmqgZxjZoEwHoPVNwV-y_A-7mHtbWReVNfi8-TGkK4okec4K7XghWp2PPHMz66UcafH8mVcaRvCv6Q-Fr9PcTK6F44yepMmm71UDoGlRYAUHQVE8hpytaQOiY0yZu1xWe0waY4UgXS7WPRVC121EJJQbPUc6mmaxSeR4gtlzAY5vIER8EvRNFMxhNiOC_E-oc-4ATZ2P5H8DZj46_HTxBtuuQLNlFsRla3rTxbh9ltbO3crBY--OtCLC3YY94O78A5EMeB-VQ4_x0fJs_T2t9E32LNGSxuQPmF9T6S3qcmmajWEpw77f4wNrkbCBz0LyLUtMIV9kfA0w8b6usRGiEC0Q_toqR0m1feYkivZClDAnZIWAlSVHuD_ZAB34CPNhaTatjfxGPsXnA2zlbzfbR8VJ.7Y52x8jzlR_yAXXYH0fiNQ"}'

Tried this in Postman, and have also added the certificates. Two way SSL handshake is successful, have been able to get response in the Hello World application.

However, the encrypted data seems to have some issue.

[kranti-rzp]

Hi Diana,

I tried it over SoapUI.

X-CORRELATION-ID: 1563254410_042_96_l73c033_VDP_ARM

Response body:

{"responseStatus": {
"status": 401,
"code": "9210",
"severity": "ERROR",
"message": "Token validation failed",
"info": ""
}}

[kranti-rzp · Accepted solution]

Hi,
I was able to resolve this issue. I was not passing the "keyId" in the header of the JWE object. 
Also the encrypted data has a short life span, so it needs to be immediately tested out after its creation.

This issue can now be closed.

[DianaTran-Yee]

Hey @kranti-rzp,

Thanks for letting us know how you resolved the issue and thanks for confirming that we can close this issue out as resolved! It's great to hear your making progress and of your successful test results!