Chase Optimization & Protection mock API and live sandbox

Faithful in the direction that matters, permissive at the edges. The prepare-then-perform sequence is a genuine transition on one stored record, so challenge-flow code can assert the initiated state, complete it, and re-read the completed result. The edge: performing against an id that was never initiated doesn't refuse — it answers completed and writes the id into the store. Sequence enforcement is therefore your test suite's job here, not the sandbox's. The authorization call that consumes these results is the Online Payments template's territory.

Anything. The lifecycle PATCH copies your cardTokenStatus string into the stored record verbatim — SUSPENDED works, but so does any invented word, and a request using a different field name writes an empty status while previousCardTokenStatus reads ACTIVE regardless. That makes the route a persistence demo rather than a validator: enum enforcement and illegal-transition rejections are stubs to add in a private WireMock Cloud copy. Note also that acquirer-token creation mints reference ids the token store never registers — only /tokens provisioning produces resolvable records.

The lists and the detail routes answer from different layers: each list is a static brochure fixture, while the detail stores only know ids minted in your own session. Ask for the listed report config and the response is the uniform not-found body; generate a report yourself and its id resolves enriched — status Completed, a dated CSV file name, and a download URL that serves the canned two-row report. One genuine defect sits nearby: updating a report config returns a 500 whose body is a raw templating error, for any id and any payload, so treat that route as unserved in the public sandbox.

No — it manages the subscription records, not the delivery. What it does supply is everything around delivery: the notificationTypes catalog enumerating five event families with their subtypes, a JWKS route (plus its deprecated predecessor, still answering) for signature verification wiring, and subscription CRUD that genuinely persists, updates, and deletes. Two truthful imperfections to expect in the update response: the updated-timestamp doesn't move, and the message still says the subscription was created.