Test cards

Sandbox card testing uses four PANs — one per network — entered on the hosted payment page. The PAN chooses which network processes the transaction. The amount chooses whether it approves or declines.

The four canonical cards

All expire 12/28. Use the CVV on the same row: each network has its own approving value.

Run an approval end to end

1. Create the session

curl -X POST https://api.sandbox.cresoracommerce.ai/api/v1/hpp/sessions \
  -H "Authorization: Bearer $CRESORA_API_KEY" \
  -H "Idempotency-Key: $(uuidgen)" \
  -H "Content-Type: application/json" \
  -d '{"merchant_id": "<uuid>", "amount": "10.00", "currency": "USD"}'

The response carries the page to open:

{
  "hpp_url": "<open this URL in a browser>"
}

2. Enter the values on the page

Open hpp_url, then type PAN 4012000098765439, expiry 12/28, CVV 999. Submit.

3. Read the outcome

Poll the session's status or handle the completion webhook for your subscription. An approval looks like this:

{
  "state": "CAPTURED"
}

Run a decline end to end

Change one thing: the amount. Repeat the steps above with an amount of 0.20, a fresh Idempotency-Key, and the same card. The result is still HTTP 200:

{
  "state": "FAILED",
  "decline_code": "<code returned for this scenario>"
}

Card amount triggers

Discriminating on the outcome

Two fields carry the result — a decline is HTTP 200 with state: FAILED plus a decline_code; an approval is state: CAPTURED. A decline is a business outcome, so the transport is a normal 200. Branch on state; report or route on decline_code.

Next: AVS and CVV for address and security-code results, and certification scenarios for the list you must cover before going live.