Authorization Decision API - Retrieve a list of decision records for a sponsor Forbidden

[JavierSivack]

Hi, 

I'm trying to test my implementation of Authorization Decision API - Retrieve a list of decision records for a sponsor, and it is responding me with a Forbidden message. 

Here is my Postman log:

GET /vctc/validation/v1/decisions/history?apiKey=MY_KEY&limit=1&page=1 HTTP/1.1
x-pay-token: xv2:1632311435:a25724145f57db51a0efe7758ec6637abed3fc8e6dcb4acb76bdb62d13ce47b4
Accept: application/json
Sponsor-ID: f4e2b4ea-1a21-11ec-9621-0242ac130002
User-Agent: PostmanRuntime/7.28.4
Postman-Token: 33e78ee2-59f2-40dd-a8b6-dcd46bdabdc8
Host: sandbox.api.visa.com
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
 
HTTP/1.1 403 Forbidden
Server: nginx
Date: Wed, 22 Sep 2021 11:50:38 GMT
Content-Type: application/json;charset=UTF-8
Content-Length: 103
Connection: keep-alive
X-SERVED-BY: l73c012
X-CORRELATION-ID: 1632311438_002_1427549517_l73c012_VDP_WS
X-Backside-Transport: FAIL FAIL,FAIL FAIL
Cache-Control: no-cache, no-store, must-revalidate
Expires: -1
Pragma: no-cache
X-Global-Transaction-ID: 458484be614b188e055a1b8d
X-APP-STATUS: 403
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
 
{"metainfo":{"Description":"Forbidden","Code":403},"error":"Forbidden Operation to requested resource"}

Thanks,

Javier

[jenn_kh]

Thank you for reaching out, @JavierSivack! An agent is looking for a solution for you and will get back with you shortly! If any community members know of a solution, please feel free to respond here.

Best Regards,

Jenn

[SLi]

Hi @JavierSivack,

Can you please share what you are sending in the header parameters: App-Group-ID, App-ID, Sponsor-ID? Thanks.

[JavierSivack]

Hi,

At the Postman Log is the Sponsor-ID header and value. 

It is the same I'm using on Retrieve the details of a specific decision record, and this API is responding fine. 

Thanks.

Javier

[SLi]

Hi @JavierSivack,

Our tech team is investigating this issue and I'll share an update as soon as I have one. Thanks.

[SLi · Accepted solution]

Hi @JavierSivack,

Thank you for your patience. Our tech team let me know that Sponsor-ID is injected in the header by VDP during runtime call, so there's no need for you to send the Sponsor-ID in the header. Please try that and let me know how it goes. In case of error, please share details and x-correlation ID.  Thanks.

[JavierSivack]

Hello Stacy.

Ok, with out the sponsor Id it works, the response is  "status": "NO_RECORDS", so I assume it's ok.

The only thing is that in the API References it mark the Sponsor-ID header as required.

Thanks.

[SLi]

Hi @JavierSivack,

Good point, I'll ask product team to fix the documentation.