Query on Access Restrictions for Visa Connect API /connect/v1/cardServices/new Endpoint

[shindevishnu31]

"Is the /connect/v1/cardServices/new endpoint on the Visa Connect API restricted for sandbox access, or is it available for open use with sandbox credentials? If restricted, what are the prerequisites or permissions needed to access this endpoint?"

[jenn_kh]

Hi @shindevishnu31, Thank you for reaching out. One of our agents will get back to you soon. Until then, if any community member has information that may be helpful, please reply in this thread. 

[shindevishnu31]

Yes about this particular query I got the answer that this endpoint is not restricted on sandbox server. But next query that arises is that it is giving forbidden(403) error when I am trying to access. I have configured 2 way SSL authentication and message level encryption in it. So not getting why it is giving 403 error.

[API_Products]

Hey @shindevishnu31,

Based on the review of the developer.visa.com platform pages, here are the steps and clarifications to address the query about access restrictions and the 403 Forbidden error when attempting to call the `{{baseUrl}}/connect/v1/cardServices/new` endpoint on the Visa Connect API:

1. Access Restrictions:
- The `/connect/v1/cardServices/new` endpoint on the Visa Connect API is not restricted for sandbox access. It is available for open use with sandbox credentials.

2. 403 Forbidden Error:
- The 403 Forbidden error indicates that the server understood the request but refuses to authorize it. This can be due to several reasons.

3. Common Causes of 403 Error:
- Incorrect Credentials: Ensure that the sandbox credentials (API key and shared secret) are correct and have the necessary permissions.
- Two-Way SSL Authentication: Verify that the two-way SSL authentication is correctly configured. This includes:
- Using the correct client certificate and private key.
- Ensuring that the client certificate is valid and not expired.
- Ensuring that the Visa server's SSL certificate is trusted by your system.
- Message Level Encryption: Ensure that the message level encryption is correctly implemented. This includes:
- Encrypting the message payload according to the API specifications.
- Using the correct public key provided by Visa for encryption.
- API Key and Token: Ensure that the API key and token are correctly included in the request headers.

4. Example of Correct SSL Configuration:
- Here is an example of how you might configure the two-way SSL authentication in a request:

```python
# START 
import requests

url = "https://sandbox.api.visa.com/connect/v1/cardServices/new"
headers = {
"Authorization": "Bearer {your_access_token}",
"Content-Type": "application/json",
"Accept": "application/json"
}
payload = {
"cardNumber": "4111111111111111",
"expirationDate": "12/2023",
"cardholderName": "John Doe",
"billingAddress": {
"street": "123 Main St",
"city": "San Francisco",
"state": "CA",
"postalCode": "94105",
"country": "USA"
}
}

response = requests.post(
url,
json=payload,
headers=headers,
cert=('path_to_client_cert.pem', 'path_to_client_key.pem')
)

print(response.status_code)
print(response.text)
# END 
```