X-Pay Token Issue - 401 Token Validation Failed When Calling Visa vdp/helloworld API

[Harris]

Requet

GET https://sandbox.api.visa.com/vdp/helloworld?apikey=YHTAJGU4LF6K3T4RNLJI21-voLG2WO-3lludlAJRtNNz0U38o HTTP/1.1
Accept-Encoding: gzip,deflate
x-pay-token: xv2:1738835743:9919e79424e1911256accd806e1ef3c4c94d5bd015fbe6c23efdc116eb1d6d27
Host: sandbox.api.visa.com
Connection: Keep-Alive
User-Agent: Apache-HttpClient/4.5.5 (Java/17.0.12)

Response

{"responseStatus": {
"status": 401,
"code": "9201",
"severity": "ERROR",
"message": "Token Validation Failed",
"info": ""
}}

Groovy Script

import javax.crypto.Mac;
import javax.crypto.spec.SecretKeySpec;
def hmac(String secretKey, String data) {
Mac mac = Mac.getInstance("HmacSHA256")
SecretKeySpec secretKeySpec = new SecretKeySpec(secretKey.getBytes(), "HmacSHA256")
mac.init(secretKeySpec)
byte[] digest = mac.doFinal(data.getBytes())
return digest
}
def APIKey = 'YHTAJGU4LF6K3T4RNLJI21-voLG2WO-3lludlAJRtNNz0U38o'
def sharedSecret = 'Xx4+H7DKQavhemqNeQVyC0IZad0r8yPEfBoCf-W/'
def URI = "helloworld"
def QS = "apikey="+APIKey
def timeStampUTC = String.valueOf(System.currentTimeMillis().intdiv(1000L))
def payload = ""
def HMACDigest = hmac(sharedSecret, timeStampUTC + URI + QS + payload)
def encodedDigest = HMACDigest.encodeHex().toString()
def XPayToken = "xv2:"+ timeStampUTC + ":" + encodedDigest
testRunner.testCase.setPropertyValue("xpayToken", XPayToken)
log.info(XPayToken)

[DianaVisaPM]

Hey @Harris,

The "Token Validation Failed 401" error typically indicates that there is an issue with the authentication tokens or credentials being used when making requests to the Visa API.

Here are some steps you can take to resolve this error when testing the Visa API in SOAPUI:

1. Verify X-Pay-Token Generation:
- Ensure that the `X-Pay-Token` is correctly generated according to the Visa API documentation. The token should be created using the shared secret and include the correct request parameters. Double-check the following formula:
```plaintext
X-Pay-Token = Base64(HMAC-SHA256(sharedSecret, timestamp + resourcePath + queryString + body))
```
- Ensure that the `timestamp` is in Unix epoch format and is within a valid time window when the request is made.

2. Check API Key:
- Make sure that the `apiKey` parameter in the query string matches the API key provided in your Visa Developer project.

3. Validate Resource Path and Query String:
- Ensure that the `resourcePath` and `queryString` used in generating the `X-Pay-Token` exactly match those in the actual request.

4. Ensure Correct Usage of HMAC-SHA256:
- Confirm that you are using the correct HMAC-SHA256 algorithm to compute the hash with the shared secret.

5. SOAPUI Configuration:
- Verify that SOAPUI is correctly configured to include the required headers. The `X-Pay-Token` should be included in the request headers along with the `Content-Type` and `Accept` headers set to `application/json`.

6. Double-check Timestamp:
- The `timestamp` used in token generation should not be too far in the past or future. A common issue is time synchronization, so ensure that your system clock is accurate.

Here's an example of how the headers might look like in SOAPUI:

```plaintext
POST https://sandbox.api.visa.com/your/resource/path
Headers:
Content-Type: application/json
Accept: application/json
X-Pay-Token: <generated-x-pay-token>
apiKey: <your-api-key>
```

7. Review Detailed Logs:
- Examine the detailed logs in SOAPUI to ensure that the request is correctly formed and that all parameters are as expected.

8. Consult Documentation and Examples:
- Refer to the Visa Developer documentation for any additional requirements or constraints. Reviewing sample requests and responses can also help identify discrepancies.

If you have followed all these steps and are still encountering the error, consider the following additional action:

1. Community Assistance:
- Reach out to the Visa Developer Community forums with specific details of your request and the error received. Community members and Visa support staff can provide targeted assistance.

By systematically verifying each of these areas, you should be able to identify and resolve the issue with your request. If further assistance is needed, providing specific error messages or request logs will help the community and support staff to offer more precise guidance.