Payload review and production cutover

Part of the Certification guide. Mark your scope on that page before you run these cases. Base payloads and test cards are on the Reference page.

14. Payload quality review

Applies to: CORE. The Solutions engineer reviews 5 CIT requests and 5 MIT requests received by the sandbox during Sections 3 to 7, selected by orderId. You do not need to send request logs. Each check is pass or fail.

Reference: /evaluate request parameters (field table with optimization ranks), Payload examples.

14.1 Field checks

ID	Check	Applies to	Pass condition
PAYLOAD-01	Amount unit	CORE	`transaction.amount` is in cents
PAYLOAD-02	Decline context	CORE	`isDeclined` is `true`; `responseCode` and `responseDescription` carry the raw processor values, not normalized text; `responseCodeSource` and `cardNotPresent` are set
PAYLOAD-03	Verification results	CORE	`avsResultCode` and `cvvResultCode` are populated from the original decline when the processor returned them
PAYLOAD-04	Card metadata	CORE	`cardBrand`, `cardType`, `cardCountry`, `cardBinNumber`, `cardLast4Digits`, expiry, and `holderName` are present and consistent with the card
PAYLOAD-05	CVV on CIT	CIT-PURCHASE, CIT-AUTHORIZE	`verificationValue` is present whenever the merchant captured it at checkout
PAYLOAD-06	Customer IP on CIT	CIT-PURCHASE, CIT-AUTHORIZE	`customerIp` is the cardholder client IP, not a server or proxy IP
PAYLOAD-07	No CVV or IP on MIT	MIT-ASYNC-PURCHASE, MIT-ASYNC-AUTHORIZE, SYNC-MIT	`verificationValue` and `customerIp` are absent
PAYLOAD-08	Subscription object	MIT-ASYNC-PURCHASE, MIT-ASYNC-AUTHORIZE, SYNC-MIT	`subscription.subscriptionId`, `price`, `currency`, `interval`, and `schemeTransactionId` from the original CIT are present
PAYLOAD-09	MIT flags	MIT-ASYNC-PURCHASE, MIT-ASYNC-AUTHORIZE, SYNC-MIT	`isMIT` and `isRecurring` are `true`
PAYLOAD-10	Attempt count	CORE	`attemptCount` is the merchant attempt number for the order, starting at 1, and increases by 1 on each later attempt for the same `orderId`
PAYLOAD-11	Site ID	CORE	`siteId` matches the descriptor the merchant order belongs to
PAYLOAD-12	Device details	CIT-PURCHASE, CIT-AUTHORIZE	When `deviceDetails` is present, all 5 child fields are present
PAYLOAD-13	Merchant object	CORE	`merchant.id`, `merchant.mcc`, and `merchant.country` are present
PAYLOAD-14	Processor name	CORE	`transaction.processorName` is present
PAYLOAD-15	Timestamps	CORE	`transaction.timestampUtc` is in UTC and `timezoneUtcOffset` is set
PAYLOAD-16	3DS passthrough	CIT-PURCHASE, CIT-AUTHORIZE	When 3DS ran on the original authorization, `cavvResultCode` and the `threeDSecure` object are present

14.2 Routing rules

Applies to: CORE. These rules determine which transactions reach /evaluate. Confirm each one in writing; the Solutions engineer also checks the received requests against them.

ID	Rule	Pass condition
ROUTING-01	Declined transactions only, with no decline-code filtering	An approved transaction is never sent to `/evaluate`. All decline codes are sent; FlexFactor declines the categories it will not rescue at no cost to the merchant
ROUTING-02	Eligible transactions only	A declined transaction is sent only when the card is Visa or Mastercard, the currency is USD, and the transaction is card-not-present (no mobile wallet and no card-present)
ROUTING-03	FlexFactor first among rescue steps	When other retry or cascade mechanisms exist, FlexFactor is called before them
ROUTING-04	One submission per decline	A declined transaction is submitted one time. A new decline in a later billing cycle carries a new `orderId` and a new `idempotencyKey`
ROUTING-05	Site per descriptor	Each merchant brand or descriptor maps to a distinct `siteId`; an omitted `siteId` lands the order on the default Site

15. Production cutover checks

Applies to: CORE. Complete after certification and before the first production transaction.

Reference: Workflows §6.

ID	Check	Pass condition
PROD-01	Credentials swapped	Production MID, `appKey`, `appSecret`, Site ID, and Tokenization Key replace every sandbox value
PROD-02	Base URL	`https://api.flexfactor.io/v1/`
PROD-03	Webhook endpoint	Registered in the production portal and subscribed to the same events as the sandbox
PROD-04	Production source IPs	`18.233.184.33` and `52.4.241.101` allowed
PROD-05	Site IDs per descriptor	One production Site ID per merchant descriptor is provisioned and mapped
PROD-06	First production transaction	One approved production rescue is confirmed with the Solutions engineer within 1 business day (FlexFactor calendar, US) of cutover