# Visa AR Manager

## Authentication Methods

Visa AR Manager APIs use different authentication requirements for different endpoints, providing flexibility while maintaining security standards appropriate for each operation type.

- **Multi-Layered Security Model**– Visa AR Manager APIs implement a layered security approach that includes:
  - **Transport Security** – All communications use HTTPS encryption.
  - **Client Credentials** – Required only for specific Payment Suite operations ( `/varm/v1/payment` and `/varm/v1/paymentinfo`).
  - **Application Identification** – Visa Developer Center (VDC) external application ID for provisioning.
  - **Onboarding Suite APIs** – No authentication headers required for all onboarding endpoints ( `/varm/v1/onboarding/supplier`, `/varm/v1/onboardingstatus`, `/varm/v1/participationagreement`, `/varm/v1/onboarding/customer`, and `/varm/v1/relationshipinfo`).
  - **Payment Suite API Exception** – The deposit confirmation endpoint ( `/varm/v1/deposit`) requires no authentication headers despite being classified as a Payment Suite API.
- **Authentication Flow**– The authentication process follows these principles:
  - Credentials are validated on each request (stateless authentication).
  - Multiple authentication factors may be required simultaneously.
  - Authentication failures result in appropriate HTTP error responses.
  - Successful authentication enables access to authorized operations.
- **Security Considerations**– Important security aspects of the authentication system:
  - All credentials must be transmitted over HTTPS.
  - Credentials should be stored securely and rotated regularly.
  - Authentication failures should be monitored and logged.

### Security Considerations

Visa AR Manager APIs implement multiple security layers, and proper implementation of security best practices is essential for protecting sensitive payment data and maintaining compliance with industry standards.

- **Transport Security**– All API communications must use secure transport protocols:
  - **HTTPS Only** – All API endpoints require HTTPS connections.
  - **TLS Version** – Use current TLS versions (1.2 or higher).
  - **Certificate Validation** – Verify SSL/TLS certificates to prevent man-in-the-middle attacks.
  - **Secure Ciphers** – Use strong encryption ciphers for data transmission.
- **Authentication Best Practices**– Implement robust authentication practices:
  - **Client Credentials** – Use client credentials only for specific Payment Suite operations ( `/varm/v1/payment` and `/varm/v1/paymentinfo`). Most API operations, including all Onboarding Suite APIs and deposit confirmation, require no authentication headers.
  - **Stateless Authentication** – Validate credentials on each request.
  - **Authentication Monitoring** – Monitor and log authentication attempts and failures.
  - **Failure Handling** – Implement appropriate responses to authentication failures.
- **Visa AR Manager-Specific Security and Data Protection**– Utilize Visa AR Manager's built-in security in handling sensitive payment data:
  - **Visa Infrastructure Security** – Utilizes Visa's enterprise-grade security infrastructure and compliance standards.
  - **Automated Security Updates** – Benefits from Visa's continuous security monitoring and updates without additional implementation effort.
  - **PCI Compliance** – Follows Payment Card Industry (PCI) Data Security Standards.
  - **Secure Transmission** – Ensures all sensitive data is encrypted in transit.