Step 3C: Set the JWS Body Claims {#restgs-jwt-message-set-jws-body}
===================================================================

After you set the JWS header values, you must create the JWS body by setting these body claim values. After the body claims are created, use Base64URL to encode it. The encoded body claim value is the second segment of the JWS token.

|   JWS Body Claim Field    |                                                                                                                                Description                                                                                                                                 | Data Type |                                   Field Value Format                                    |
|---------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-----------|-----------------------------------------------------------------------------------------|
| **digest**                | A Base64-encoded hash of the message payload. Do not include the **digest** field if the request message is empty, such as during a GET or DELETE request.                                                                                                                 | String    | Base64-encoded string: uppercase, lowercase, digits, `+`, `/`, and optional `=` padding |
| **digestAlgorithm**       | The algorithm used to hash the message payload. The message payload should be hashed using the SHA-256 algorithm. Do not include the **digestAlgorithm** field if the **digest** field is not included.                                                                    | String    | Lowercase                                                                               |
| **exp**                   | The time at which the JWS token expires. > IMPORTANT > Field values cannot exceed two minutes after the message issue date, which is the **iat** field value. This field is an HTTP-date value as defined in RFC7231. For example, 01/01/2020 at 00:02:00 is `1577836920`. | String    | Numeric                                                                                 |
| **iat**                   | The date and time at which the message is issued. This field uses a *NumericDate* value as defined in RFC 7519, which is the number of seconds since `1970‑01‑01T00:00:00Z` (Unix epoch). For example, 01/01/2020 at 00:00:00 is `1577836800`.                             | String    | Numeric                                                                                 |
| **iss**                   | The issuer identifier for the JWS token. Set to the merchant ID that created the P12 certificate. This value is used to validate the issuer.                                                                                                                               | String    | Lowercase                                                                               |
| **jti**                   | The unique token ID. This value is used for replay prevention. Format the value using UUID version 4. For example: `6643fb9a-8093-47c6-95d3-8d69785b5e62`                                                                                                                  | String    | Lowercase alphanumeric                                                                  |
| **request-host**          | The endpoint hostname for the HTTP request, excluding the protocol and path. For example, to send a message to the https://api.cybersource.com`/pts/v2/payments` endpoint, set this field to `api.cybersource.com`.                                                        | String    | Lowercase alphanumeric with periods                                                     |
| **request-method**        | The HTTP request method. For example, `post`, `get`, `put`, `patch`, or `delete`.                                                                                                                                                                                          | String    | Lowercase                                                                               |
| **request-resource-path** | The endpoint path for the HTTP request, excluding the domain. For example, to send a message to the https://api.cybersource.com`/pts/v2/payments` endpoint, set this field to `/pts/v2/payments`.                                                                          | String    | Lowercase alphanumeric                                                                  |
| **v-c-jwt-version**       | The Visa JWT scheme version number. Set to `2`.                                                                                                                                                                                                                            | String    | Numeric                                                                                 |
| **v-c-merchant-id**       | Your `Cybersource` transacting merchant ID (MID). If you are a portfolio or merchant account user, set this to the transacting merchant ID you send requests on behalf of.                                                                                                 | String    | Lowercase alphanumeric                                                                  |
| **v-c-response-mle-kid**  | The message-level encryption response key ID, also known as the *REST--API Response MLE* key.                                                                                                                                                                              | String    | Lowercase alphanumeric                                                                  |
[JWS Body Claims]

The value of the digest JWS claim is a hashed version of the HTTP message body that you must calculate. `Cybersource` uses this hash value to validate the integrity of your message body.  
Follow these steps to calculate the digest hash:

1. Generate the SHA-256 hash of the JSON payload (message body).
2. Encode the hashed string to Base64.
3. Add the message body hash to the **digest** JWS body claims.
4. Add the algorithm used to hash the digest in the **digestAlgorithm** JWS body claims.  
   Example: Creating a Message Hash Using the Command Line `shasum` Tool

```keyword
cat <<'EOF' | tr -d '\n' | shasum -a 256
{
  "clientReferenceInformation": {
    "code": "TC50171_3"
  },
  "paymentInformation": {
    "card": {
      "number": "4111111111111111",
      "expirationMonth": "12",
      "expirationYear": "2031"
    }
  },
  "orderInformation": {
    "amountDetails": {
      "totalAmount": "102.21",
      "currency": "USD"
    },
    "billTo": {
      "firstName": "John",
      "lastName": "Doe",
      "address1": "1MarketSt",
      "locality": "sanfrancisco",
      "administrativeArea": "CA",
      "postalCode": "94105",
      "country": "US",
      "email": "test@cybs.com",
      "phoneNumber": "4158880000"
    }
  }
}
EOF
```

Example: Creating a Message Hash Using the Command Line `base64` Tool

```
echo -n "6ae5459bc8a7d6a4b203e8a734d6a616725134088e13261f5bbcefc1424fc956" | base64
```

Example: Creating a Message Hash Using C#

```
public static string GenerateDigest()
{
    var digest = "";
    var bodyText = "{ your JSON payload }";

    using (var sha256hash = SHA256.Create())
    {
        byte[] payloadBytes = sha256hash.ComputeHash(Encoding.UTF8.GetBytes(bodyText));
        digest = Convert.ToBase64String(payloadBytes);
    }

    return digest;
}
```

Example: Creating a Message Using Java

```
public static String GenerateDigest() throws NoSuchAlgorithmException {
    String bodyText = "{ your JSON payload }";

    MessageDigest md = MessageDigest.getInstance("SHA-256");
    md.update(bodyText.getBytes(StandardCharsets.UTF_8));
    byte[] digest = md.digest();

    return Base64.getEncoder().encodeToString(digest);
}
```