{
  "info": {
    "name": "KYC Match v0.2 - Authorization Code - Client Secret",
    "_postman_id": "kycmatch-v02-de-staging-authcode",
    "description": "KYC Match v0.2 (kyc-match/v0.2/match) using the Authorization Code grant. This grant requires an interactive browser step outside Postman (opening the authorize URL, logging in/consenting, capturing the redirected code) - request 1 builds the authorize URL, request 2 exchanges the manually-pasted code for a token, request 3 calls KYC Match. Client authentication is PRIVATE_KEY_JWT only (RS256-signed client_assertion) - never client_secret. See the base_url variable description for the default environment and how to switch country/environment.\n\nScope is the exact string used by CheckKycMatchEndpoint in SEPAPIs.cs: \"dpv:FraudPreventionAndDetection kyc-match:match\". This app only prefixes scopes with \"openid\" when its UsesOpenIdScope setting is active for a given credential profile/environment (see SEPAPIs.cs ResolveScope calls) - that is environment-specific, not fixed for KYC Match, so this collection ships the base scope as-is. If your real OAuth server requires an \"openid\" scope for CIBA or Authorization Code token issuance, prepend it yourself in the `scope` variable (e.g. \"openid dpv:FraudPreventionAndDetection kyc-match:match\").\n\nNot currently listed for any country in the product catalog. (Source: this app's live product-catalog grant-type configuration, staging environment - see the /documentation/postman-collections page for the current matrix.)\n\nIMPORTANT: only one version of this API family can be ordered onto a single TMF Application - if your client_id/private_key were provisioned for KYC Match v0.3 instead of this one (e.g. you ordered Sim Swap v1 but not v2, or vice versa), authentication will fail here with a 401 UNAUTHENTICATED/InvalidClaim error even though your credentials are otherwise valid and correctly entered. You need a client_id/private_key from an Application that specifically ordered THIS version to use this collection.\n\nThis is the Client Secret authentication counterpart. It ships with empty client_id and client_secret variables. CIBA uses HTTP Basic at /bc-authorize and /token. JWT Bearer still signs only its required subscriber grant assertion locally and authenticates the client with HTTP Basic, matching SEPAPIs.cs.",
    "schema": "https://schema.getpostman.com/json/collection/v2.1.0/collection.json"
  },
  "variable": [
    {
      "key": "base_url",
      "value": "https://stg.api.telekom.com",
      "type": "string",
      "description": "Single variable driving every request in this collection. Default is Germany STAGING (https://stg.api.telekom.com). Change ONLY this variable to switch environment/country:\n- Germany production: https://api.telekom.com\n- Austria staging: https://at.stg.api.telekom.com | production: https://at.api.telekom.com\n- Poland staging: https://pl.stg.api.telekom.com | production: https://pl.api.telekom.com\n- Greece staging: https://gr.stg.api.telekom.com | production: https://gr.api.telekom.com\nSee the /documentation/endpoints page in the MBAPI app for the full country/environment reference table. Every request and script in this collection builds the full endpoint path directly from base_url (e.g. {{base_url}}/token) rather than through a separate derived variable, because Postman does not resolve nested variable references (a variable whose value itself contains {{...}}) when read inside pre-request/test scripts via pm.collectionVariables.get() - only base_url itself needs to be correct. "
    },
    {
      "key": "scope",
      "value": "dpv:FraudPreventionAndDetection kyc-match:match",
      "type": "string",
      "description": "Scope is the exact string used by CheckKycMatchEndpoint in SEPAPIs.cs: \"dpv:FraudPreventionAndDetection kyc-match:match\". This app only prefixes scopes with \"openid\" when its UsesOpenIdScope setting is active for a given credential profile/environment (see SEPAPIs.cs ResolveScope calls) - that is environment-specific, not fixed for KYC Match, so this collection ships the base scope as-is. If your real OAuth server requires an \"openid\" scope for CIBA or Authorization Code token issuance, prepend it yourself in the `scope` variable (e.g. \"openid dpv:FraudPreventionAndDetection kyc-match:match\")."
    },
    {
      "key": "phone_number",
      "value": "+491702049821",
      "type": "string",
      "description": "Standard test MSISDN for this API from this app's live DE staging standard configuration (SepStandardApiConfigurations table, per-API/country/environment) - not a generic sample number."
    },
    {
      "key": "client_id",
      "value": "",
      "type": "string",
      "description": "Your registered OAuth client ID (PRIVATE_KEY_JWT client authentication). Required - never ships with a real value."
    },
    {
      "key": "client_secret",
      "value": "",
      "type": "string",
      "description": "REQUIRED. Your registered OAuth client secret for this API/application. Fill this in locally; this downloadable collection intentionally ships without a secret."
    },
    {
      "key": "access_token",
      "value": "",
      "type": "string",
      "description": "Auto-populated by the token request's test script once a token is obtained."
    },
    {
      "key": "redirect_uri",
      "value": "https://yourapp.com/callback",
      "type": "string",
      "description": "Your registered OAuth redirect URI. Change to match your client registration."
    },
    {
      "key": "state",
      "value": "",
      "type": "string",
      "description": "Auto-populated random state value (CSRF protection) by request 1's pre-request script."
    },
    {
      "key": "nonce",
      "value": "",
      "type": "string",
      "description": "Auto-populated random nonce value by request 1's pre-request script."
    },
    {
      "key": "auth_code",
      "value": "",
      "type": "string",
      "description": "Paste the authorization code you receive from the browser redirect after completing request 1 in this variable, then run request 2."
    }
  ],
  "item": [
    {
      "name": "1. Build Authorize URL (open in browser)",
      "event": [
        {
          "listen": "prerequest",
          "script": {
            "type": "text/javascript",
            "exec": [
              "if (!pm.collectionVariables.get('state')) {",
              "    pm.collectionVariables.set('state', pm.variables.replaceIn('{{$guid}}'));",
              "}",
              "if (!pm.collectionVariables.get('nonce')) {",
              "    pm.collectionVariables.set('nonce', pm.variables.replaceIn('{{$guid}}'));",
              "}"
            ]
          }
        }
      ],
      "request": {
        "method": "GET",
        "header": [],
        "url": {
          "raw": "{{base_url}}/authorize?response_type=code&client_id={{client_id}}&redirect_uri={{redirect_uri}}&scope={{scope}}&state={{state}}&nonce={{nonce}}",
          "host": [
            "{{base_url}}/authorize"
          ],
          "query": [
            {
              "key": "response_type",
              "value": "code"
            },
            {
              "key": "client_id",
              "value": "{{client_id}}"
            },
            {
              "key": "redirect_uri",
              "value": "{{redirect_uri}}"
            },
            {
              "key": "scope",
              "value": "{{scope}}"
            },
            {
              "key": "state",
              "value": "{{state}}"
            },
            {
              "key": "nonce",
              "value": "{{nonce}}"
            }
          ]
        },
        "description": "MANUAL STEP REQUIRED: Authorization Code is an interactive browser flow and cannot be completed inside Postman. Click 'Code' / copy the generated request URL (Postman's preview, or the Send button then check the browser-blocked redirect), open it in a real browser, log in and consent, then copy the `code` query parameter from the redirect back to redirect_uri and paste it into the `auth_code` collection variable. Then run request 2."
      },
      "response": []
    },
    {
      "name": "2. Exchange auth_code for Token",
      "event": [
        {
          "listen": "test",
          "script": {
            "type": "text/javascript",
            "exec": [
              "const jsonData = pm.response.json();",
              "if (jsonData.access_token) {",
              "    pm.collectionVariables.set('access_token', jsonData.access_token);",
              "    console.log('access_token captured.');",
              "} else {",
              "    console.error('No access_token in response:', pm.response.text());",
              "}",
              "pm.test('Token response has access_token', function () {",
              "    pm.expect(jsonData.access_token).to.be.a('string').and.not.empty;",
              "});"
            ]
          }
        }
      ],
      "request": {
        "method": "POST",
        "header": [
          {
            "key": "Content-Type",
            "value": "application/x-www-form-urlencoded"
          }
        ],
        "body": {
          "mode": "urlencoded",
          "urlencoded": [
            {
              "key": "grant_type",
              "value": "authorization_code",
              "type": "text"
            },
            {
              "key": "code",
              "value": "{{auth_code}}",
              "type": "text",
              "description": "Paste the code you received from the browser redirect after completing request 1."
            },
            {
              "key": "redirect_uri",
              "value": "{{redirect_uri}}",
              "type": "text"
            }
          ]
        },
        "url": {
          "raw": "{{base_url}}/token",
          "host": [
            "{{base_url}}/token"
          ]
        },
        "description": "Exchanges the manually-pasted auth_code for an access_token, authenticating the client with PRIVATE_KEY_JWT (client_assertion), never client_secret.\n\nClient authentication is HTTP Basic using {{client_id}} and {{client_secret}}; no client_assertion is sent.",
        "auth": {
          "type": "basic",
          "basic": [
            {
              "key": "username",
              "value": "{{client_id}}",
              "type": "string"
            },
            {
              "key": "password",
              "value": "{{client_secret}}",
              "type": "string"
            }
          ]
        }
      },
      "response": []
    },
    {
      "name": "POST KYC Match v0.2",
      "event": [
        {
          "listen": "prerequest",
          "script": {
            "type": "text/javascript",
            "exec": [
              "// No signing needed here - just reuses {{access_token}} captured by the token request(s) above."
            ]
          }
        }
      ],
      "request": {
        "method": "POST",
        "header": [
          {
            "key": "Authorization",
            "value": "Bearer {{access_token}}"
          },
          {
            "key": "Content-Type",
            "value": "application/json"
          },
          {
            "key": "x-correlator",
            "value": "{{$guid}}",
            "description": "Unique correlation ID for tracing this request through the API gateway/backend."
          }
        ],
        "body": {
          "mode": "raw",
          "raw": "{\n  \"phoneNumber\": \"{{phone_number}}\",\n  \"givenName\": \"Max\",\n  \"familyName\": \"Mustermann\",\n  \"address\": \"Musterstraße 1\",\n  \"streetName\": \"Musterstraße\",\n  \"streetNumber\": \"1\",\n  \"postalCode\": \"10115\",\n  \"locality\": \"Berlin\",\n  \"country\": \"DE\",\n  \"birthdate\": \"1980-01-01\",\n  \"email\": \"max.mustermann@example.de\"\n}",
          "options": {
            "raw": {
              "language": "json"
            }
          }
        },
        "url": {
          "raw": "{{base_url}}/kyc-match/v0.2/match",
          "host": [
            "{{base_url}}/kyc-match/v0.2/match"
          ]
        },
        "description": "Calls the KYC Match v0.2 resource (kyc-match/v0.2/match) with sample subscriber data (see the phone_number variable for the live DE staging standard-config MSISDN). Field names copied verbatim from CheckKycMatchEndpoint in SEPAPIs.cs."
      },
      "response": []
    },
    {
      "name": "GET KYC Match Health v0.2",
      "request": {
        "method": "GET",
        "header": [
          {
            "key": "Authorization",
            "value": "Bearer {{access_token}}"
          },
          {
            "key": "x-correlator",
            "value": "{{$guid}}",
            "description": "Unique correlation ID for tracing this request through the API gateway/backend."
          }
        ],
        "url": {
          "raw": "{{base_url}}/kyc-match/v0.2/health",
          "host": [
            "{{base_url}}/kyc-match/v0.2/health"
          ]
        },
        "description": "Health check for the KYC Match v0.2 service. Run after obtaining access_token from any of the token requests in this collection."
      },
      "response": []
    }
  ]
}