> ## Documentation Index
> Fetch the complete documentation index at: https://docs.payra.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Testing

> The cards and bank accounts a sandbox workspace accepts, and how to make each failure happen.

A sandbox workspace runs on a test processor: no money moves, and what it approves or refuses is that
processor's choice, not Payra's. The sets below are for Payra's default card and bank processor, which is
what a new sandbox workspace gets; if yours was set up on another one, ask Payra for its set.

## Cards

| Card | Expiration | Security code | Result |
| - | - | - | - |
| `4111 1111 1111 1111` | `03/2030` | `737` | Approved |

The expiration date and the security code are part of the test card: another date or another code is refused
as `card_declined`. The **name on the card picks the refusal**. Keep the approved card above and change the name;
it must still be two words, since a one-word name is refused before the charge (see below).

| Name on the card | `decline_code` | `decline_reason` | What the payer would see |
| - | - | - | - |
| `DECLINED Test` | `card_declined` | none | The card was declined. |
| `NOT_ENOUGH_BALANCE Test` | `insufficient_funds` | none | The card has insufficient funds. |
| `CARD_EXPIRED Test` | `invalid_payment_method` | `expired_card` | The card has expired. |
| `CVC_DECLINED Test` | `invalid_payment_method` | `incorrect_cvc` | The card's security code is incorrect. |
| `BLOCK_CARD Test` | `card_declined` | `card_blocked` | The card was declined. |
| `NOT_3D_AUTHENTICATED Test` | `authentication_failed` | none | The cardholder could not be authenticated. |

A refusal reads exactly like a real one: `POST /payments` answers `402 card_declined` with the
`decline_code`, the `decline_reason` when there is one, and the failed `payment`, which reads back with the same
values under `failure` (see [Declines](https://docs.payra.com/payments.md#declines)). A one-time payment method is spent by the attempt, so
collect the card again with a new session before retrying.

### Cardholder name

The card needs a first and a last name. A single word is refused before anything is sent:
[Payra Elements](https://docs.payra.com/elements.md) answers `validation_error` `cardholder_name_incomplete` on `billingDetails.name`, and
`POST /payment-method-sessions/{id}/confirm` answers `400 parameter_invalid` on `cardholder_name`. The session stays
open either way, so the customer can fix the name and submit again.

### 3-D Secure

With [3-D Secure](https://docs.payra.com/payments.md#3-d-secure) turned on for your workspace, card `4917 6100 0000 0000`, expiration
`03/30`, security code `737` brings up a challenge after `POST /payments` with a `return_url`: the password
`password` passes it and the payment turns `succeeded`; any other value refuses it and the payment turns `failed`
with `failure.code: "authentication_failed"`. A challenge left unfinished fails the same way after 15 minutes.

## US bank accounts (ACH)

| Routing number | Account number | Result |
| - | - | - |
| `021000021` | any 7 to 17 digits | Accepted; the payment stays `processing` and settles on the sandbox processor's own schedule (later the same day), when `payment.succeeded` is sent |

A sandbox debit never fails at submission with these values. To try the return path (`payment.returned`), ask
Payra: the sandbox processor returns only on accounts set up for it.

## Canadian bank accounts (EFT)

| Institution number | Transit number | Account number | Result |
| - | - | - | - |
| `001` | `00114` | any 7 to 12 digits | Accepted; `processing` until the sandbox processor settles it, which can take longer than a US debit |

Other transit numbers are refused by the sandbox processor.

## What a sandbox cannot show you

* **Live refusals in other words.** A live card can be refused for reasons the sandbox never produces (a bank's
  fraud rule, a restricted card). They all arrive in the same fixed vocabulary, so branch on `decline_code` /
  `failure.code` and show your own sentence, never on the message text.
* **Settlement timing.** Live bank debits settle on the processor's batch schedule, and a return or a chargeback can
  arrive days after `succeeded`, as `payment.returned`.
* **Processor setup.** A currency or method your sandbox accepted may answer `400 payment_provider_not_configured` on
  live until Payra enables it on your live workspace. See [Environments](https://docs.payra.com/environments.md).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.