cybersource_rest_client 0.0.83 → 0.0.85

data/lib/AuthenticationSDK/util/Constants.rb

@@ -1,5 +1,4 @@
-  class Constants
-
+class Constants
       GET_REQUEST_TYPE_LOWER = 'get' unless const_defined?(:GET_REQUEST_TYPE_LOWER)
 
       POST_REQUEST_TYPE_LOWER = 'post' unless const_defined?(:POST_REQUEST_TYPE_LOWER)
@@ -42,7 +41,7 @@
 
       SIGNATURE_ALGORITHM = 'HmacSHA256' unless const_defined?(:SIGNATURE_ALGORITHM)
 
-      ALGORITHM = "algorithm=\"" unless const_defined?(:ALGORITHM)
+      ALGORITHM = 'algorithm="' unless const_defined?(:ALGORITHM)
 
       SHA256 = 'SHA-256=' unless const_defined?(:SHA256)
 
@@ -52,11 +51,11 @@
 
       USER_AGENT_VALUE = 'Mozilla/5.0' unless const_defined?(:USER_AGENT_VALUE)
 
-      KEY_ID = "keyid=\"" unless const_defined?(:KEY_ID)
+      KEY_ID = 'keyid="' unless const_defined?(:KEY_ID)
 
-      HEADERS_PARAM = "headers=\"" unless const_defined?(:HEADERS_PARAM)
+      HEADERS_PARAM = 'headers="' unless const_defined?(:HEADERS_PARAM)
 
-      SIGNATURE_PARAM = "signature=\"" unless const_defined?(:SIGNATURE_PARAM)
+      SIGNATURE_PARAM = 'signature="' unless const_defined?(:SIGNATURE_PARAM)
 
       AUTH_TYPE_HTTP = 'HTTP_SIGNATURE' unless const_defined?(:AUTH_TYPE_HTTP)
 
@@ -66,7 +65,16 @@
 
       AUTH_TYPE_JWT = 'JWT' unless const_defined?(:AUTH_TYPE_JWT)
 
-      OLD_RUN_ENVIRONMENT_CONSTANTS = ['CYBERSOURCE.ENVIRONMENT.SANDBOX', 'CYBERSOURCE.ENVIRONMENT.PRODUCTION', 'CYBERSOURCE.IN.ENVIRONMENT.SANDBOX', 'CYBERSOURCE.IN.ENVIRONMENT.PRODUCTION', 'BANKOFAMERICA.ENVIRONMENT.SANDBOX', 'BANKOFAMERICA.ENVIRONMENT.PRODUCTION']
+      JWT_KEY_TYPE_P12 = 'P12' unless const_defined?(:JWT_KEY_TYPE_P12)
+
+      JWT_KEY_TYPE_SHARED_SECRET = 'SHARED_SECRET' unless const_defined?(:JWT_KEY_TYPE_SHARED_SECRET)
+
+      unless const_defined?(:INVALID_JWT_KEY_TYPE)
+        INVALID_JWT_KEY_TYPE = "Invalid jwtKeyType. Must be 'P12' or 'SHARED_SECRET'."
+      end
+
+      OLD_RUN_ENVIRONMENT_CONSTANTS = ['CYBERSOURCE.ENVIRONMENT.SANDBOX', 'CYBERSOURCE.ENVIRONMENT.PRODUCTION',
+                                       'CYBERSOURCE.IN.ENVIRONMENT.SANDBOX', 'CYBERSOURCE.IN.ENVIRONMENT.PRODUCTION', 'BANKOFAMERICA.ENVIRONMENT.SANDBOX', 'BANKOFAMERICA.ENVIRONMENT.PRODUCTION']
 
       # constants for fall back logic
 
@@ -84,7 +92,7 @@
 
       DEFAULT_LOG_LEVEL = 'debug' unless const_defined?(:DEFAULT_LOG_LEVEL)
 
-      LOG_LEVELS = ['UNKNOWN', 'FATAL', 'ERROR', 'WARN', 'INFO', 'DEBUG'] unless const_defined?(:LOG_LEVELS)
+      LOG_LEVELS = %w[UNKNOWN FATAL ERROR WARN INFO DEBUG] unless const_defined?(:LOG_LEVELS)
 
       # Constant for Fall back logic and Exception Handling
 
@@ -98,29 +106,43 @@
 
       INCORRECT_KEY_PASS = 'The keyPass Entered is Incorrect' unless const_defined?(:INCORRECT_KEY_PASS)
 
-      AUTH_TYPE_MANDATORY= 'AuthenticationType is Mandatory' unless const_defined?(:AUTH_TYPE_MANDATORY)
+      AUTH_TYPE_MANDATORY = 'AuthenticationType is Mandatory' unless const_defined?(:AUTH_TYPE_MANDATORY)
 
       MERCHANT_KEY_ID_MANDATORY = 'MerchantKeyId is Mandatory' unless const_defined?(:MERCHANT_KEY_ID_MANDATORY)
 
-      MERCHANT_SECRET_KEY_MANDATORY = 'MerchantSecretKey is Mandatory' unless const_defined?(:MERCHANT_SECRET_KEY_MANDATORY)
+      unless const_defined?(:MERCHANT_SECRET_KEY_MANDATORY)
+        MERCHANT_SECRET_KEY_MANDATORY = 'MerchantSecretKey is Mandatory'
+      end
 
       PORTFOLIO_ID_MANDATORY = 'PortfolioID is Mandatory' unless const_defined?(:PORTFOLIO_ID_MANDATORY)
 
       KEY_PASS_NULL = 'keyPass is empty, Assigining merchantID value' unless const_defined?(:KEY_PASS_NULL)
 
-      REQUEST_JSON_PATH_EMPTY = 'RequestJsonPath not provided. Using Default Value:'unless const_defined?(:REQUEST_JSON_PATH_EMPTY)
+      unless const_defined?(:REQUEST_JSON_PATH_EMPTY)
+        REQUEST_JSON_PATH_EMPTY = 'RequestJsonPath not provided. Using Default Value:'
+      end
 
       REQUEST_TYPE_EMPTY = 'RequestType Property of Merchant Config Not Set' unless const_defined?(:REQUEST_TYPE_EMPTY)
 
-      INVALID_REQUEST_TYPE_METHOD = 'Entered Request Type should be (GET/POST/PUT)' unless const_defined?(:INVALID_REQUEST_TYPE_METHOD)
+      unless const_defined?(:INVALID_REQUEST_TYPE_METHOD)
+        INVALID_REQUEST_TYPE_METHOD = 'Entered Request Type should be (GET/POST/PUT)'
+      end
 
-      INVALID_LOG_DIRECTORY = 'Entered LogDirectory is Missing/Incorrect. Using Default Path: ' unless const_defined?(:INVALID_LOG_DIRECTORY)
+      unless const_defined?(:INVALID_LOG_DIRECTORY)
+        INVALID_LOG_DIRECTORY = 'Entered LogDirectory is Missing/Incorrect. Using Default Path: '
+      end
 
-      INVALID_MAX_LOG_SIZE = 'Entered MaxLogSize is Missing/Incorrect. Using Default Value: ' unless const_defined?(:INVALID_MAX_LOG_SIZE)
+      unless const_defined?(:INVALID_MAX_LOG_SIZE)
+        INVALID_MAX_LOG_SIZE = 'Entered MaxLogSize is Missing/Incorrect. Using Default Value: '
+      end
 
-      INVALID_MAX_LOG_FILES = 'Entered MaxLogFiles is Missing/Incorrect. Using Default Value: ' unless const_defined?(:INVALID_MAX_LOG_FILES)
+      unless const_defined?(:INVALID_MAX_LOG_FILES)
+        INVALID_MAX_LOG_FILES = 'Entered MaxLogFiles is Missing/Incorrect. Using Default Value: '
+      end
 
-      INVALID_LOG_LEVEL = 'Entered LogLevel is Missing/Incorrect. Using Default Value: ' unless const_defined?(:INVALID_LOG_LEVEL)
+      unless const_defined?(:INVALID_LOG_LEVEL)
+        INVALID_LOG_LEVEL = 'Entered LogLevel is Missing/Incorrect. Using Default Value: '
+      end
 
       RUN_ENVIRONMENT_ERROR = 'Entered RunEnvironment is Incorrect.' unless const_defined?(:RUN_ENVIRONMENT_ERROR)
 
@@ -130,23 +152,50 @@
 
       WARNING_PREFIX = 'Warning: ' unless const_defined?(:WARNING_PREFIX)
 
-      HIDDEN_MERCHANT_PROPERTIES = 'merchantID,merchantKeyId,merchantsecretKey,keyAlias,keyPass' unless const_defined?(:HIDDEN_MERCHANT_PROPERTIES)
+      unless const_defined?(:HIDDEN_MERCHANT_PROPERTIES)
+        HIDDEN_MERCHANT_PROPERTIES = 'merchantID,merchantKeyId,merchantsecretKey,keyAlias,keyPass,'\
+          'keyPassword,sslKeyPassword,clientId,clientSecret,accessToken,refreshToken,'\
+          'privateKey,sslClientCert,responseMlePrivateKey,responseMlePrivateKeyPassword,'\
+          'responseMlePrivateKeyFilePassword,responseMlePrivateKeyFilePath,'\
+          'responseMlePrivateKeyFileName,mleForRequestPublicCertPath,pemFileDirectory,'\
+          'clientCertDirectory,keysDirectory,keyFilename'
+      end
+
+      unless const_defined?(:SENSITIVE_PROPERTY_PATTERNS)
+        # Substrings (case-insensitive) used to redact any configuration key whose name
+        # contains them. Provides defense-in-depth against new/unknown sensitive fields.
+        SENSITIVE_PROPERTY_PATTERNS = %w[secret password passwd pass token privatekey private_key apikey api_key credential cert].freeze
+      end
+
+      REDACTED_VALUE = '***REDACTED***' unless const_defined?(:REDACTED_VALUE)
 
       RUN_ENVIRONMENT = 'RunEnvironment is Mandatory' unless const_defined?(:RUN_ENVIRONMENT)
 
-      KEY_DIRECTORY_EMPTY = 'KeysDirectory not provided. Using Default Path:' unless const_defined?(:KEY_DIRECTORY_EMPTY)
+      unless const_defined?(:KEY_DIRECTORY_EMPTY)
+        KEY_DIRECTORY_EMPTY = 'KeysDirectory not provided. Using Default Path:'
+      end
 
-      FILE_NOT_FOUND = 'File not found, Re-Enter path/file name, Entered path/file name :: ' unless const_defined?(:FILE_NOT_FOUND)
+      unless const_defined?(:FILE_NOT_FOUND)
+        FILE_NOT_FOUND = 'File not found, Re-Enter path/file name, Entered path/file name :: '
+      end
 
       AUTH_ERROR = 'Check Authentication Type (HTTP_Signature/JWT) in cybs.yml.' unless const_defined?(:AUTH_ERROR)
 
-      KEY_FILE_NAME_NULL_EMPTY = 'KeyFilename Empty/Null. Assigining merchantID value' unless const_defined?(:KEY_FILE_NAME_NULL_EMPTY)
+      unless const_defined?(:KEY_FILE_NAME_NULL_EMPTY)
+        KEY_FILE_NAME_NULL_EMPTY = 'KeyFilename Empty/Null. Assigining merchantID value'
+      end
 
-      KEY_ALIAS_NULL_EMPTY = 'KeyAlias Empty/Null. Assigining merchantID value' unless const_defined?(:KEY_ALIAS_NULL_EMPTY)
+      unless const_defined?(:KEY_ALIAS_NULL_EMPTY)
+        KEY_ALIAS_NULL_EMPTY = 'KeyAlias Empty/Null. Assigining merchantID value'
+      end
 
-      INCORRECT_KEY_ALIAS = 'The Entered KeyAlias is Incorrect. Assigining merchantID value' unless const_defined?(:INCORRECT_KEY_ALIAS)
+      unless const_defined?(:INCORRECT_KEY_ALIAS)
+        INCORRECT_KEY_ALIAS = 'The Entered KeyAlias is Incorrect. Assigining merchantID value'
+      end
 
-      INCORRECT_KEY_ALIAS_USE_METAKEY = 'The Entered KeyAlias is Incorrect with useMetaKey set to true. Assigining portfolioID value' unless const_defined?(:INCORRECT_KEY_ALIAS_USE_METAKEY)
+      unless const_defined?(:INCORRECT_KEY_ALIAS_USE_METAKEY)
+        INCORRECT_KEY_ALIAS_USE_METAKEY = 'The Entered KeyAlias is Incorrect with useMetaKey set to true. Assigining portfolioID value'
+      end
 
       ENABLE_CLIENT_CERT_EMPTY = 'Enable Clientcert is Empty/Null.' unless const_defined?(:ENABLE_CLIENT_CERT_EMPTY)
 
@@ -172,15 +221,27 @@
 
       CERTIFICATE_EXPIRY_DATE_WARNING_DAYS = 90 unless const_defined?(:CERTIFICATE_EXPIRY_DATE_WARNING_DAYS)
 
-      MLE_CACHE_IDENTIFIER_FOR_CONFIG_CERT = "mleCertFromMerchantConfig"
+      MLE_CACHE_IDENTIFIER_FOR_CONFIG_CERT = 'mleCertFromMerchantConfig'
+
+      MLE_CACHE_IDENTIFIER_FOR_P12_CERT = 'mleCertFromP12'
+
+      DEFAULT_KEY_FILE_PATH = File.join(Dir.pwd, 'resources')
 
-      MLE_CACHE_IDENTIFIER_FOR_P12_CERT = "mleCertFromP12"
+      MLE_CACHE_KEY_IDENTIFIER_FOR_RESPONSE_PRIVATE_KEY = 'mleResponsePrivateKeyFromFile'
 
-      DEFAULT_KEY_FILE_PATH = File.join(Dir.pwd, "resources")
+      PUBLIC_KEY_CACHE_IDENTIFIER = 'FlexV2PublicKeys'
 
-      MLE_CACHE_KEY_IDENTIFIER_FOR_RESPONSE_PRIVATE_KEY = "mleResponsePrivateKeyFromFile"
+      RESPONSE_MLE_P12_PFX_CACHE_IDENTIFIER = '_responseMleP12Pfx'
 
-      PUBLIC_KEY_CACHE_IDENTIFIER = "FlexV2PublicKeys"
-      
-      RESPONSE_MLE_P12_PFX_CACHE_IDENTIFIER = "_responseMleP12Pfx"
-  end
+      # Allowed JWE algorithms for decryption (per CGK specification).
+      # Only strong key-encryption and content-encryption algorithms are permitted.
+      # Weak algorithms such as RSA1_5 (Bleichenbacher-vulnerable) and 'dir' are blocked.
+      unless const_defined?(:ALLOWED_JWE_KEY_ENCRYPTION_ALGORITHMS)
+        ALLOWED_JWE_KEY_ENCRYPTION_ALGORITHMS = %w[RSA-OAEP
+                                                   RSA-OAEP-256].freeze
+      end
+      unless const_defined?(:ALLOWED_JWE_CONTENT_ENCRYPTION_ALGORITHMS)
+        ALLOWED_JWE_CONTENT_ENCRYPTION_ALGORITHMS = %w[A128GCM
+                                                       A256GCM].freeze
+      end
+end

data/lib/AuthenticationSDK/util/MLEUtility.rb

@@ -1,4 +1,5 @@
 require_relative '../logging/log_factory.rb'
+require_relative '../logging/sensitive_logging.rb'
 require 'jose'
 require 'json'
 require_relative './Cache'
@@ -9,6 +10,28 @@ require_relative './AuthJWEUtility'
 public
   class MLEUtility
     @log_obj = nil
+
+    # Fail-safe gate for the decrypted-MLE-response diagnostic log lines.
+    # Default OFF: even at DEBUG, the decrypted/encrypted bodies are NOT emitted.
+    # Operators who need wire-level diagnostics must explicitly opt in by calling
+    # MLEUtility.enable_mle_plaintext_logging! in application bootstrap code; the
+    # toggle is process-local and not driven by config files or env vars so it
+    # cannot be flipped on accidentally by a deployment change.
+    @mle_plaintext_logging_enabled = false
+
+    class << self
+      def mle_plaintext_logging_enabled?
+        @mle_plaintext_logging_enabled == true
+      end
+
+      def enable_mle_plaintext_logging!
+        @mle_plaintext_logging_enabled = true
+      end
+
+      def disable_mle_plaintext_logging!
+        @mle_plaintext_logging_enabled = false
+      end
+    end
     def self.check_is_mle_for_API(merchant_config, inbound_mle_status, operation_ids)
       is_mle_for_api = false
 
@@ -48,6 +71,15 @@ public
         return requestBody
       end
 
+      # Check if using shared secret JWT without explicit MLE certificate path
+      if mleCertificate.nil? &&
+         Constants::AUTH_TYPE_JWT.downcase == merchantConfig.authenticationType.downcase &&
+         merchantConfig.is_shared_secret_key_type?
+        @log_obj.logger.debug("MLE for requests with JWT shared secret authentication requires mleForRequestPublicCertPath to be explicitly provided in merchant configuration.")
+        @log_obj.logger.debug("Please set mleForRequestPublicCertPath to the path of your MLE public certificate file.")
+        raise StandardError.new(Constants::ERROR_PREFIX + "Missing MLE certificate for JWT shared secret authentication. Please provide the MLE public certificate path in the configuration.")
+      end
+
       begin
         serial_number = self.extract_serial_number_from_certificate(mleCertificate)
 
@@ -139,11 +171,28 @@ public
       end
 
       begin
-        @log_obj.logger.info("LOG_NETWORK_RESPONSE_BEFORE_MLE_DECRYPTION: #{responseBody}")
+        # Fail-safe: only emit decrypted-MLE bodies when an operator has explicitly
+        # called MLEUtility.enable_mle_plaintext_logging! AND the logger is at
+        # DEBUG. Even then, route the payload through SensitiveDataFilter so
+        # PCI/PII fields (PAN, CVV, account, expiration, token, ...) are masked
+        # before reaching any appender.
+        plaintext_logging = MLEUtility.mle_plaintext_logging_enabled? && @log_obj.logger.debug?
+
+        if plaintext_logging
+          formatter = SensitiveDataFilter.new
+          @log_obj.logger.debug("LOG_NETWORK_RESPONSE_BEFORE_MLE_DECRYPTION: #{formatter.maskSensitiveDataInJson(responseBody)}")
+        else
+          @log_obj.logger.debug('LOG_NETWORK_RESPONSE_BEFORE_MLE_DECRYPTION: <encrypted payload omitted>')
+        end
 
         decryptedResponse = AuthJWEUtility.decrypt_jwe_using_private_key(mlePrivateKey, jweResponseToken)
 
-        @log_obj.logger.info("LOG_NETWORK_RESPONSE_AFTER_MLE_DECRYPTION: #{decryptedResponse}")
+        if plaintext_logging
+          formatter ||= SensitiveDataFilter.new
+          @log_obj.logger.debug("LOG_NETWORK_RESPONSE_AFTER_MLE_DECRYPTION: #{formatter.maskSensitiveDataInJson(decryptedResponse)}")
+        else
+          @log_obj.logger.debug('LOG_NETWORK_RESPONSE_AFTER_MLE_DECRYPTION: <decrypted payload not logged>')
+        end
 
         return decryptedResponse
       rescue => e

data/lib/cybersource_rest_client/api/{instructions_api.rb → agent_capabilities_api.rb}

@@ -12,7 +12,7 @@ Swagger Codegen version: 2.4.38
 require 'uri'
 require 'AuthenticationSDK/util/MLEUtility'
 module CyberSource
-  class InstructionsApi
+  class AgentCapabilitiesApi
     attr_accessor :api_client
 
     def initialize(api_client = ApiClient.default, config)
@@ -20,7 +20,7 @@ module CyberSource
       @api_client.set_configuration(config)
     end
     # Cancel a purchase intent
-    # Cancels an existing purchase intent identified by the transaction ID.
+    # Cancel an existing purchase intent (instruction) identified by its instructionId. The agent calls this endpoint when the consumer decides to abandon the purchase before payment credentials have been used. Requires device information and assurance data for identity verification. Returns status CANCELLED (HTTP 200) on success, or PENDING (HTTP 202) with pendingEvents if cardholder authentication is required before cancellation can proceed.
     #
     # @param instruction_id 
     # @param agentic_cancel_purchase_intent_request Unique identifier for the purchase intent instruction.
@@ -33,7 +33,7 @@ module CyberSource
     end
 
     # Cancel a purchase intent
-    # Cancels an existing purchase intent identified by the transaction ID.
+    # Cancel an existing purchase intent (instruction) identified by its instructionId. The agent calls this endpoint when the consumer decides to abandon the purchase before payment credentials have been used. Requires device information and assurance data for identity verification. Returns status CANCELLED (HTTP 200) on success, or PENDING (HTTP 202) with pendingEvents if cardholder authentication is required before cancellation can proceed.
     # @param instruction_id 
     # @param agentic_cancel_purchase_intent_request Unique identifier for the purchase intent instruction.
     # @param [Hash] opts the optional parameters
@@ -43,21 +43,21 @@ module CyberSource
       if @api_client.config.debugging
           begin
             raise
-                @api_client.config.logger.debug 'Calling API: InstructionsApi.cancel_purchase_intent ...'
+                @api_client.config.logger.debug 'Calling API: AgentCapabilitiesApi.cancel_purchase_intent ...'
             rescue
                 puts 'Cannot write to log'
             end
       end
       # verify the required parameter 'instruction_id' is set
       if @api_client.config.client_side_validation && instruction_id.nil?
-        fail ArgumentError, "Missing the required parameter 'instruction_id' when calling InstructionsApi.cancel_purchase_intent"
+        fail ArgumentError, "Missing the required parameter 'instruction_id' when calling AgentCapabilitiesApi.cancel_purchase_intent"
       end
       # verify the required parameter 'agentic_cancel_purchase_intent_request' is set
       if @api_client.config.client_side_validation && agentic_cancel_purchase_intent_request.nil?
-        fail ArgumentError, "Missing the required parameter 'agentic_cancel_purchase_intent_request' when calling InstructionsApi.cancel_purchase_intent"
+        fail ArgumentError, "Missing the required parameter 'agentic_cancel_purchase_intent_request' when calling AgentCapabilitiesApi.cancel_purchase_intent"
       end
       # resource path
-      local_var_path = 'acp/v1/instructions/{instructionId}/cancel'.sub('{' + 'instructionId' + '}', instruction_id.to_s)
+      local_var_path = 'icc/v1/instructions/{instructionId}/cancel'.sub('{' + 'instructionId' + '}', instruction_id.to_s)
 
       # query parameters
       query_params = {}
@@ -99,7 +99,7 @@ module CyberSource
       if @api_client.config.debugging
         begin
         raise
-            @api_client.config.logger.debug "API called: InstructionsApi#cancel_purchase_intent\nData: #{data.inspect}\nStatus code: #{status_code}\nHeaders: #{headers}"
+            @api_client.config.logger.debug "API called: AgentCapabilitiesApi#cancel_purchase_intent\nData: #{data.inspect}\nStatus code: #{status_code}\nHeaders: #{headers}"
         rescue
             puts 'Cannot write to log'
         end
@@ -107,7 +107,7 @@ module CyberSource
       return data, status_code, headers
     end
     # Confirm transaction events
-    # Agents send the confirm transaction events to notify the payment processing is done
+    # Confirm transaction events for a completed purchase. The agent calls this endpoint after the payment has been submitted to notify the Intelligent Commerce Connect of the transaction outcome. The request includes processor information (transaction type, status, approval codes), order details (shipping, tracking, product information), and merchant information. Returns HTTP 202 acknowledging receipt of the confirmation.
     #
     # @param instruction_id Unique identifier for the purchase intent instruction.
     # @param agentic_confirm_transaction_events_request 
@@ -120,7 +120,7 @@ module CyberSource
     end
 
     # Confirm transaction events
-    # Agents send the confirm transaction events to notify the payment processing is done
+    # Confirm transaction events for a completed purchase. The agent calls this endpoint after the payment has been submitted to notify the Intelligent Commerce Connect of the transaction outcome. The request includes processor information (transaction type, status, approval codes), order details (shipping, tracking, product information), and merchant information. Returns HTTP 202 acknowledging receipt of the confirmation.
     # @param instruction_id Unique identifier for the purchase intent instruction.
     # @param agentic_confirm_transaction_events_request 
     # @param [Hash] opts the optional parameters
@@ -130,21 +130,21 @@ module CyberSource
       if @api_client.config.debugging
           begin
             raise
-                @api_client.config.logger.debug 'Calling API: InstructionsApi.confirm_transaction_events ...'
+                @api_client.config.logger.debug 'Calling API: AgentCapabilitiesApi.confirm_transaction_events ...'
             rescue
                 puts 'Cannot write to log'
             end
       end
       # verify the required parameter 'instruction_id' is set
       if @api_client.config.client_side_validation && instruction_id.nil?
-        fail ArgumentError, "Missing the required parameter 'instruction_id' when calling InstructionsApi.confirm_transaction_events"
+        fail ArgumentError, "Missing the required parameter 'instruction_id' when calling AgentCapabilitiesApi.confirm_transaction_events"
       end
       # verify the required parameter 'agentic_confirm_transaction_events_request' is set
       if @api_client.config.client_side_validation && agentic_confirm_transaction_events_request.nil?
-        fail ArgumentError, "Missing the required parameter 'agentic_confirm_transaction_events_request' when calling InstructionsApi.confirm_transaction_events"
+        fail ArgumentError, "Missing the required parameter 'agentic_confirm_transaction_events_request' when calling AgentCapabilitiesApi.confirm_transaction_events"
       end
       # resource path
-      local_var_path = 'acp/v1/instructions/{instructionId}/confirmations'.sub('{' + 'instructionId' + '}', instruction_id.to_s)
+      local_var_path = 'icc/v1/instructions/{instructionId}/confirmations'.sub('{' + 'instructionId' + '}', instruction_id.to_s)
 
       # query parameters
       query_params = {}
@@ -186,7 +186,88 @@ module CyberSource
       if @api_client.config.debugging
         begin
         raise
-            @api_client.config.logger.debug "API called: InstructionsApi#confirm_transaction_events\nData: #{data.inspect}\nStatus code: #{status_code}\nHeaders: #{headers}"
+            @api_client.config.logger.debug "API called: AgentCapabilitiesApi#confirm_transaction_events\nData: #{data.inspect}\nStatus code: #{status_code}\nHeaders: #{headers}"
+        rescue
+            puts 'Cannot write to log'
+        end
+      end
+      return data, status_code, headers
+    end
+    # Enroll a card
+    # Enroll a payment card for agentic or e-commerce transactions. This is typically the first step in the Intelligent Commerce payment lifecycle — the agent calls this endpoint to register a consumer's card, creating a tokenized reference that can be used in subsequent purchase instructions and payment credential retrieval. Requires device information, consumer identity, billing details, and payment instrument references. Returns a status of ACTIVE (HTTP 200) if enrollment completes immediately, or PENDING (HTTP 202) with pendingEvents if cardholder authentication is required. Call this endpoint when a consumer wants to add a new payment card or when setting up a card for agentic payment flows.
+    #
+    # @param agentic_card_enrollment_request 
+    # @param [Hash] opts the optional parameters
+    # @return [AgenticCardEnrollmentResponse200]
+    #
+    def enroll_card(agentic_card_enrollment_request, opts = {})
+      data, status_code, headers = enroll_card_with_http_info(agentic_card_enrollment_request, opts)
+      return data, status_code, headers
+    end
+
+    # Enroll a card
+    # Enroll a payment card for agentic or e-commerce transactions. This is typically the first step in the Intelligent Commerce payment lifecycle — the agent calls this endpoint to register a consumer's card, creating a tokenized reference that can be used in subsequent purchase instructions and payment credential retrieval. Requires device information, consumer identity, billing details, and payment instrument references. Returns a status of ACTIVE (HTTP 200) if enrollment completes immediately, or PENDING (HTTP 202) with pendingEvents if cardholder authentication is required. Call this endpoint when a consumer wants to add a new payment card or when setting up a card for agentic payment flows.
+    # @param agentic_card_enrollment_request 
+    # @param [Hash] opts the optional parameters
+    # @return [Array<(AgenticCardEnrollmentResponse200, Fixnum, Hash)>] AgenticCardEnrollmentResponse200 data, response status code and response headers
+    def enroll_card_with_http_info(agentic_card_enrollment_request, opts = {})
+
+      if @api_client.config.debugging
+          begin
+            raise
+                @api_client.config.logger.debug 'Calling API: AgentCapabilitiesApi.enroll_card ...'
+            rescue
+                puts 'Cannot write to log'
+            end
+      end
+      # verify the required parameter 'agentic_card_enrollment_request' is set
+      if @api_client.config.client_side_validation && agentic_card_enrollment_request.nil?
+        fail ArgumentError, "Missing the required parameter 'agentic_card_enrollment_request' when calling AgentCapabilitiesApi.enroll_card"
+      end
+      # resource path
+      local_var_path = 'icc/v1/tokens'
+
+      # query parameters
+      query_params = {}
+
+      # header parameters
+      header_params = {}
+      # HTTP header 'Accept' (if needed)
+      header_params['Accept'] = @api_client.select_header_accept(['application/hal+json;charset=utf-8'])
+      # HTTP header 'Content-Type'
+      header_params['Content-Type'] = @api_client.select_header_content_type(['application/json;charset=utf-8'])
+
+      # form parameters
+      form_params = {}
+
+      # http body (model)
+      post_body = @api_client.object_to_http_body(agentic_card_enrollment_request)
+      sdk_tracker = SdkTracker.new
+      post_body = sdk_tracker.insert_developer_id_tracker(post_body, 'AgenticCardEnrollmentRequest', @api_client.config.host, @api_client.merchantconfig.defaultDeveloperId)
+      inbound_mle_status = "mandatory"
+      if MLEUtility.check_is_mle_for_API(@api_client.merchantconfig, inbound_mle_status, ["enroll_card","enroll_card_with_http_info"])
+        begin
+          post_body = MLEUtility.encrypt_request_payload(@api_client.merchantconfig, post_body)
+        rescue
+          raise
+        end
+      end
+
+      is_response_mle_for_api = MLEUtility.check_is_response_mle_for_api(@api_client.merchantconfig, ["enroll_card","enroll_card_with_http_info"])
+
+      auth_names = []
+      data, status_code, headers = @api_client.call_api(:POST, local_var_path,
+        :header_params => header_params,
+        :query_params => query_params,
+        :form_params => form_params,
+        :body => post_body,
+        :auth_names => auth_names,
+        :return_type => 'AgenticCardEnrollmentResponse200',
+        :isResponseMLEForApi => is_response_mle_for_api)
+      if @api_client.config.debugging
+        begin
+        raise
+            @api_client.config.logger.debug "API called: AgentCapabilitiesApi#enroll_card\nData: #{data.inspect}\nStatus code: #{status_code}\nHeaders: #{headers}"
         rescue
             puts 'Cannot write to log'
         end
@@ -194,7 +275,7 @@ module CyberSource
       return data, status_code, headers
     end
     # Initiate a purchase intent
-    # Creates a new purchase intent with the provided details.
+    # Create a new purchase intent (instruction) for an agentic transaction. The agent calls this endpoint after a card has been enrolled to define what the consumer wants to buy. The request includes payment instrument references, device and assurance data, mandates (spending limits, merchant preferences, and product descriptions), and optional buyer information. Return an instructionId (HTTP 200) if the intent is created immediately, or PENDING (HTTP 202) with pendingEvents if cardholder authentication is required. The instructionId returned is used in all subsequent operations - update, cancel, retrieve credentials, and confirm transaction.
     #
     # @param agentic_create_purchase_intent_request 
     # @param [Hash] opts the optional parameters
@@ -206,7 +287,7 @@ module CyberSource
     end
 
     # Initiate a purchase intent
-    # Creates a new purchase intent with the provided details.
+    # Create a new purchase intent (instruction) for an agentic transaction. The agent calls this endpoint after a card has been enrolled to define what the consumer wants to buy. The request includes payment instrument references, device and assurance data, mandates (spending limits, merchant preferences, and product descriptions), and optional buyer information. Return an instructionId (HTTP 200) if the intent is created immediately, or PENDING (HTTP 202) with pendingEvents if cardholder authentication is required. The instructionId returned is used in all subsequent operations - update, cancel, retrieve credentials, and confirm transaction.
     # @param agentic_create_purchase_intent_request 
     # @param [Hash] opts the optional parameters
     # @return [Array<(AgenticCreatePurchaseIntentResponse200, Fixnum, Hash)>] AgenticCreatePurchaseIntentResponse200 data, response status code and response headers
@@ -215,17 +296,17 @@ module CyberSource
       if @api_client.config.debugging
           begin
             raise
-                @api_client.config.logger.debug 'Calling API: InstructionsApi.initiate_purchase_intent ...'
+                @api_client.config.logger.debug 'Calling API: AgentCapabilitiesApi.initiate_purchase_intent ...'
             rescue
                 puts 'Cannot write to log'
             end
       end
       # verify the required parameter 'agentic_create_purchase_intent_request' is set
       if @api_client.config.client_side_validation && agentic_create_purchase_intent_request.nil?
-        fail ArgumentError, "Missing the required parameter 'agentic_create_purchase_intent_request' when calling InstructionsApi.initiate_purchase_intent"
+        fail ArgumentError, "Missing the required parameter 'agentic_create_purchase_intent_request' when calling AgentCapabilitiesApi.initiate_purchase_intent"
       end
       # resource path
-      local_var_path = 'acp/v1/instructions'
+      local_var_path = 'icc/v1/instructions'
 
       # query parameters
       query_params = {}
@@ -267,7 +348,7 @@ module CyberSource
       if @api_client.config.debugging
         begin
         raise
-            @api_client.config.logger.debug "API called: InstructionsApi#initiate_purchase_intent\nData: #{data.inspect}\nStatus code: #{status_code}\nHeaders: #{headers}"
+            @api_client.config.logger.debug "API called: AgentCapabilitiesApi#initiate_purchase_intent\nData: #{data.inspect}\nStatus code: #{status_code}\nHeaders: #{headers}"
         rescue
             puts 'Cannot write to log'
         end
@@ -275,7 +356,7 @@ module CyberSource
       return data, status_code, headers
     end
     # Retrieve payment credentials
-    # Retrieve a customer's tokenized payment credentials to complete the transaction.
+    # Retrieve tokenized payment credentials for a purchase intent to complete the transaction at a merchant. The agent calls this endpoint after a purchase intent has been created and approved, providing transaction-level details including order information, merchant details, payment options, and production information. Returns COMPLETED (HTTP 200) with a signed payload containing encrypted payment credentials (authorization token and JWS-signed payload), or PENDING (HTTP 202) with pendingEvents if additional cardholder authentication is required. The signed payload is used by the merchant's payment processor to complete the transaction.
     #
     # @param instruction_id Unique identifier for the purchase intent instruction.
     # @param agentic_retrieve_payment_credentials_request 
@@ -288,7 +369,7 @@ module CyberSource
     end
 
     # Retrieve payment credentials
-    # Retrieve a customer&#39;s tokenized payment credentials to complete the transaction.
+    # Retrieve tokenized payment credentials for a purchase intent to complete the transaction at a merchant. The agent calls this endpoint after a purchase intent has been created and approved, providing transaction-level details including order information, merchant details, payment options, and production information. Returns COMPLETED (HTTP 200) with a signed payload containing encrypted payment credentials (authorization token and JWS-signed payload), or PENDING (HTTP 202) with pendingEvents if additional cardholder authentication is required. The signed payload is used by the merchant&#39;s payment processor to complete the transaction.
     # @param instruction_id Unique identifier for the purchase intent instruction.
     # @param agentic_retrieve_payment_credentials_request 
     # @param [Hash] opts the optional parameters
@@ -298,21 +379,21 @@ module CyberSource
       if @api_client.config.debugging
           begin
             raise
-                @api_client.config.logger.debug 'Calling API: InstructionsApi.retrieve_payment_credentials ...'
+                @api_client.config.logger.debug 'Calling API: AgentCapabilitiesApi.retrieve_payment_credentials ...'
             rescue
                 puts 'Cannot write to log'
             end
       end
       # verify the required parameter 'instruction_id' is set
       if @api_client.config.client_side_validation && instruction_id.nil?
-        fail ArgumentError, "Missing the required parameter 'instruction_id' when calling InstructionsApi.retrieve_payment_credentials"
+        fail ArgumentError, "Missing the required parameter 'instruction_id' when calling AgentCapabilitiesApi.retrieve_payment_credentials"
       end
       # verify the required parameter 'agentic_retrieve_payment_credentials_request' is set
       if @api_client.config.client_side_validation && agentic_retrieve_payment_credentials_request.nil?
-        fail ArgumentError, "Missing the required parameter 'agentic_retrieve_payment_credentials_request' when calling InstructionsApi.retrieve_payment_credentials"
+        fail ArgumentError, "Missing the required parameter 'agentic_retrieve_payment_credentials_request' when calling AgentCapabilitiesApi.retrieve_payment_credentials"
       end
       # resource path
-      local_var_path = 'acp/v1/instructions/{instructionId}/credentials'.sub('{' + 'instructionId' + '}', instruction_id.to_s)
+      local_var_path = 'icc/v1/instructions/{instructionId}/credentials'.sub('{' + 'instructionId' + '}', instruction_id.to_s)
 
       # query parameters
       query_params = {}
@@ -354,7 +435,7 @@ module CyberSource
       if @api_client.config.debugging
         begin
         raise
-            @api_client.config.logger.debug "API called: InstructionsApi#retrieve_payment_credentials\nData: #{data.inspect}\nStatus code: #{status_code}\nHeaders: #{headers}"
+            @api_client.config.logger.debug "API called: AgentCapabilitiesApi#retrieve_payment_credentials\nData: #{data.inspect}\nStatus code: #{status_code}\nHeaders: #{headers}"
         rescue
             puts 'Cannot write to log'
         end
@@ -362,7 +443,7 @@ module CyberSource
       return data, status_code, headers
     end
     # Update a purchase intent
-    # Updates an existing purchase intent identified by the transaction ID.
+    # Update an existing purchase intent (instruction) identified by its instructionId. The agent calls this endpoint when the consumer modifies their order — for example, changing the quantity, updating mandates, switching payment instruments, or changing shipping details. The request body has the same structure as the initiate request. Returns the same instructionId (HTTP 200) on success, or PENDING (HTTP 202) with pendingEvents if additional cardholder authentication is required for the updated intent.
     #
     # @param instruction_id Unique identifier for the purchase intent instruction.
     # @param agentic_update_purchase_intent_request 
@@ -375,7 +456,7 @@ module CyberSource
     end
 
     # Update a purchase intent
-    # Updates an existing purchase intent identified by the transaction ID.
+    # Update an existing purchase intent (instruction) identified by its instructionId. The agent calls this endpoint when the consumer modifies their order — for example, changing the quantity, updating mandates, switching payment instruments, or changing shipping details. The request body has the same structure as the initiate request. Returns the same instructionId (HTTP 200) on success, or PENDING (HTTP 202) with pendingEvents if additional cardholder authentication is required for the updated intent.
     # @param instruction_id Unique identifier for the purchase intent instruction.
     # @param agentic_update_purchase_intent_request 
     # @param [Hash] opts the optional parameters
@@ -385,21 +466,21 @@ module CyberSource
       if @api_client.config.debugging
           begin
             raise
-                @api_client.config.logger.debug 'Calling API: InstructionsApi.update_purchase_intent ...'
+                @api_client.config.logger.debug 'Calling API: AgentCapabilitiesApi.update_purchase_intent ...'
             rescue
                 puts 'Cannot write to log'
             end
       end
       # verify the required parameter 'instruction_id' is set
       if @api_client.config.client_side_validation && instruction_id.nil?
-        fail ArgumentError, "Missing the required parameter 'instruction_id' when calling InstructionsApi.update_purchase_intent"
+        fail ArgumentError, "Missing the required parameter 'instruction_id' when calling AgentCapabilitiesApi.update_purchase_intent"
       end
       # verify the required parameter 'agentic_update_purchase_intent_request' is set
       if @api_client.config.client_side_validation && agentic_update_purchase_intent_request.nil?
-        fail ArgumentError, "Missing the required parameter 'agentic_update_purchase_intent_request' when calling InstructionsApi.update_purchase_intent"
+        fail ArgumentError, "Missing the required parameter 'agentic_update_purchase_intent_request' when calling AgentCapabilitiesApi.update_purchase_intent"
       end
       # resource path
-      local_var_path = 'acp/v1/instructions/{instructionId}'.sub('{' + 'instructionId' + '}', instruction_id.to_s)
+      local_var_path = 'icc/v1/instructions/{instructionId}'.sub('{' + 'instructionId' + '}', instruction_id.to_s)
 
       # query parameters
       query_params = {}
@@ -441,7 +522,7 @@ module CyberSource
       if @api_client.config.debugging
         begin
         raise
-            @api_client.config.logger.debug "API called: InstructionsApi#update_purchase_intent\nData: #{data.inspect}\nStatus code: #{status_code}\nHeaders: #{headers}"
+            @api_client.config.logger.debug "API called: AgentCapabilitiesApi#update_purchase_intent\nData: #{data.inspect}\nStatus code: #{status_code}\nHeaders: #{headers}"
         rescue
             puts 'Cannot write to log'
         end

data/lib/cybersource_rest_client/api/batches_api.rb

@@ -239,7 +239,7 @@ module CyberSource
       # header parameters
       header_params = {}
       # HTTP header 'Accept' (if needed)
-      header_params['Accept'] = @api_client.select_header_accept(['application/json;charset=utf-8'])
+      header_params['Accept'] = @api_client.select_header_accept(['application/json', 'application/json;charset=utf-8'])
       # HTTP header 'Content-Type'
       header_params['Content-Type'] = @api_client.select_header_content_type(['application/json;charset=utf-8'])