# Configure FDA AS2 Connection

Safety supports the FDA Electronic Submissions Gateway (ESG) through AS2 (system-to-system) communication. Safety supports CDER, CBER, and CBER VAERS electronic submissions to the FDA.

Vault's integration with the FDA ESG allows you to set up an <a href="/en/lr/703946/">_AS2 Connection_</a> for users to submit directly from Safety and receive gateway responses.


<div class="note-border alert-info">
  <div class="alert alert-info" role="alert">
    <div><i class="far fa-info-circle"></i></div>
    <div class="alert-text">
      <p><strong>Note</strong>: 
If your Vault currently uses the
<a href="/en/lr/01205/">FDA <em>Gateway Profile</em></a>
to communicate with the FDA, we recommend that you
<a href="#create-as2-connection">create an <em>AS2 Connection</em> to the FDA</a>
as described in this article and then follow the instructions in
<a href="/en/lr/01460/">Replace a Gateway Profile with an AS2 Connection</a></p>
    </div>
  </div>
</div>



## Types of FDA Electronic Submission Endpoints

The following table outlines the different FDA ESG endpoints that Safety supports and the details for each:

<table>
    <thead>
        <tr>
            <th>Endpoint</th>
            <th>Setup</th>
            <th>Document Format</th>
        </tr>
    </thead>
    <tbody>
        <tr>
            <td><strong>CDER</strong> (Drugs)</td>
            <td>
                <ul>
                    <li>Register your account with the FDA</li>
                    <li>Configure Sender User</li>
                    <li>Create an <em>AS2 Connection</em> for the FDA<sup><a href="#footnote-1">1</a></sup></li>
                    <li>Set up the <strong>CDER</strong> <em>Transmission Profile</em></li>
                </ul>
            </td>
            <td>FDA E2B(R2) or FDA FAERS E2B(R3)</td>
        </tr>
        <tr>
            <td><strong>CBER</strong> (Biologics)</td>
            <td>
                <ul>
                    <li>Register your account with the FDA</li>
                    <li>Configure Sender User</li>
                    <li>Create an <em>AS2 Connection</em> for the FDA<sup><a href="#footnote-1">1</a></sup></li>
                    <li>Set up the <strong>CBER</strong> <em>Transmission Profile</em></li>
                </ul>
            </td>
            <td>FDA E2B(R2) or FDA FAERS E2B(R3)</td>
        </tr>
        <tr>
            <td><strong>CBER VAERS</strong> (Vaccines)</td>
            <td>
                <ul>
                    <li>Register your account with the FDA<br>You can use the same account registered with the FDA ESG for CBER submissions</li>
                        <li>Configure Sender User</li>
                        <li>Create an <em>AS2 Connection</em> for the FDA<sup><a href="#footnote-1">1</a></sup></li>
                        <li>Set up the <strong>CBER VAERS</strong> <em>Transmission Profile</em></li>
                    </ul>
                </td>
                <td>FDA VAERS E2B(R3)</td>
            </tr>
            <tr>
            <td><strong>CDER Study</strong> (Drugs)</td>
            <td>
                <ul>
                    <li>Register your account with the FDA</li>
                        <li>Configure Sender User</li>
                        <li>Create an <em>AS2 Connection</em> for the FDA<sup><a href="#footnote-1">1</a></sup></li>
                        <li>Set up the <strong>CDER Study</strong> <em>Transmission Profile</em></li>
                    </ul>
                </td>
                <td>FDA FAERS E2B(R3)</td>
            </tr>
        <tr>
            <td><strong>CBER Study</strong> (Biologics)</td>
            <td>
                <ul>
                    <li>Register your account with the FDA</li>
                        <li>Configure Sender User</li>
                        <li>Create an <em>AS2 Connection</em> for the FDA<sup><a href="#footnote-1">1</a></sup></li>
                        <li>Set up the <strong>CBER Study</strong> <em>Transmission Profile</em></li>
                    </ul>
                </td>
                <td>FDA FAERS E2B(R3)</td>
            </tr>
        <tr>
            <td><strong>CDER IND Exempt</strong> (Drugs)</td>
            <td>
                <ul>
                    <li>Register your account with the FDA</li>
                        <li>Configure Sender User</li>
                        <li>Create an <em>AS2 Connection</em> for the FDA<sup><a href="#footnote-1">1</a></sup></li>
                        <li>Set up the <strong>CDER IND Exempt</strong> <em>Transmission Profile</em></li>
                    </ul>
                </td>
                <td>FDA FAERS E2B(R3)</td>
            </tr>
        <tr>
            <td><strong>FDA eMDR</strong></td>
            <td>
                <ul>
                    <li>Register your account with the FDA</li>
                    <li>Configure Sender User</li>
                    <li>Create an <em>AS2 Connection</em> for the FDA<sup><a href="#footnote-1">1</a></sup></li>
                    <li>Set up the <strong>FDA eMDR</strong> <em>Transmission Profile</em></li>
                </ul>
            </td>
            <td>FDA eMDR</td>
            </tr>
        </tbody>
        <tfoot>
            <tr>
                <td colspan="3">
                    <a id="footnote-1"></a>1. Each of these endpoints can use the same <em>AS2 Connection</em> to the FDA.
                </td>
            </tr>
        </tfoot>
    </table>

## Configure an FDA ESG AS2 Account

Before you can configure the Safety _AS2 Connection_, you must have an active FDA ESG AS2 account. The <a class="external-link " href="https://www.fda.gov/industry/create-esg-account/setting-as2-account-checklist" target="_blank" rel="noopener">FDA Website<i class="fa fa-external-link" aria-hidden="true"></i></a> provides instructions for setting up an AS2 account.

When you configure your FDA ESG account, ensure that the AS2 URL exactly matches the <a href="#as2-vault-url">**AS2 Vault URL** of your _AS2 Connection_</a>.



<div class="note-border alert-info">
  <div class="alert alert-info" role="alert">
    <div><i class="far fa-info-circle"></i></div>
    <div class="alert-text">
      <p><strong>Note</strong>: If your organization is a CRO making submissions on behalf of one or more sponsors, you must complete the registration using a single CRO account. Each sponsor will have their own <em>Transmission Profile</em> linked to the same AS2 gateway.</p>
    </div>
  </div>
</div>



### Public and Private Certificates

As part of the FDA registration process, you must obtain a public and private certificate pair and send the public certificate to the FDA.
Your Admin can <a href="/en/lr/872385/#create-sponsor-cert">create these certificates within Vault</a>.

## <a id="create-as2-connection"></a> Configure a Safety AS2 Connection

1. Navigate to **Admin > Connections**, then select **Create**.
2. For the **Connection Type**, select **AS2**, then select **Continue**.
3. Complete the applicable <a href="#as2-connection-fields">fields</a>.
4. Select **Save**.

### AS2 Connection Fields {#as2-connection-fields}

With the exception of <a href="#transfer-fields">_Transfer Connection_</a> fields and fields populated by Vault, complete all fields in the following sections:

* <a href="#details-fields">AS2 Details Fields</a>
* <a href="#partner-fields">AS2 Partner Details Fields</a>
* <a href="#sponsor-fields">AS2 Sponsor Details Fields</a>

#### AS2 Details Fields {#details-fields}

<table>
    <thead>
        <tr>
            <th>
                Field
            </th>
            <th>
                Description
            </th>
        </tr>
    </thead>
    <tbody>
        <tr>
            <td>
                <em>Name</em>
            </td>
            <td>
                Enter a name for the <em>AS2 Connection</em>.<br>
                This name must be unique in your Vault.
            </td>
        </tr>
        <tr>
            <td>
                <em>API Name</em>
            </td>
            <td>
                Enter an API Name for the <em>AS2 Connection</em>.<br>
                This name must be unique in your Vault.<br>
            </td>
        </tr>
        <tr>
            <td>
                <em>Description</em>
            </td>
            <td>
                Enter a description for the <em>AS2 Connection</em>.
            </td>
        </tr>
        <tr>
            <td>
                <em>Contact Email</em>
            </td>
            <td>
                Enter the Sender's Email.
            </td>
        </tr>
        <tr>
            <td>
                <em>AS2 Vault Gateway State</em><a id="as2-vault-gateway-state"></a>
            </td>
            <td>
                Vault populates this field with the current state of the AS2 Vault Gateway, which consists of one (1) of the following options:
                <ul>
                    <li>
                        <strong>Unregistered</strong>: The <strong>Sync to Gateway</strong> action has not yet been run for this <em>AS2 Connection</em>.
                    </li>
                    <li>
                        <strong>Registered</strong>: The <em>AS2 Connection</em> is synchronized with the Gateway.
                    </li>
                    <li>
                        <strong>Out of Sync</strong>: Changes have been made to the <em>AS2 Connection</em> or its Connection Allowed List since the last time the <strong>Sync to Gateway</strong> action was run. From the <strong>All Actions</strong> menu, select <strong>Sync To Gateway</strong> to resync the <em>AS2 Connection</em> with the Gateway.
                    </li>
                </ul>
            </td>
        </tr>
        <tr>
            <td>
                <em>AS2 Encryption</em>
            </td>
            <td>
                The algorithm Vault uses to encrypt outbound AS2 messages and decrypt inbound messages.<br>Vault supports the following algorithms:
                <ul>
                    <li>Triple DES (3DES)</li>
                    <li>AES-256-GCM</li>
                    <li>AES-256-CBC</li>
                </ul>
                
                        For the FDA, select <strong>AES-256-CBC</strong>.
                    
            </td>
        </tr>
        <tr>
            <td>
                <em>AS2 MDN Setting</em>
            </td>
            <td>
                Whether the Message Delivery Notification (MDN) can be exchanged synchronously (<strong>Sync</strong>) or asynchronously (<strong>Async</strong>).<br>
                
                        For the FDA, select <strong>Sync</strong>.
                    
            </td>
        </tr>
        <tr>
            <td>
                <em>AS2 Signature</em>
            </td>
            <td>
                The method Vault uses to sign outbound AS2 messages. Vault supports the following signing methods:
                <ul>
                    <li>SHA-1</li>
                    <li>SHA-256</li>
                </ul>
                
                        For the FDA, select <strong>SHA-1</strong>.
                    
            </td>
        </tr>
        <tr>
            <td>
                <em>AS2 Additional ACK Stages</em>
            </td>
            <td>
                If required, select one (1) or more of the following options:
                <ul>
                    <li>
                        <strong>HTTP Handshake</strong>: Used primarily for asynchronous requests.
                    </li>
                    <li>
                        <strong>PRE-ACK</strong>: Used mainly for FDA VAERS, but can be used with synchronous or asynchronous requests.
                    </li>
                </ul>
                <div class="note-border alert-info">
  <div class="alert alert-info" role="alert">
    <div><i class="far fa-info-circle"></i></div>
    <div class="alert-text">
      <p><strong>Note</strong>: We do not recommend using any additional ACK stages.</p>
    </div>
  </div>
</div>


            </td>
        </tr>
        <tr>
            <td>
                <em>AS2 Partner Sends ACK on MDN URL</em><a id="partner-ack-on-mdn-url"></a>
            </td>
            <td>
                <p>
                    The default setting for this field is <em>No</em>, as Vault expects an AS2 partner to send the ACK using a different URL than that used to send the MDN.
                </p>
                <p>
                
                        Select <strong>No</strong>.
                
                </p>
                <p>
                    For more information about AS2 gateway communications, see <a href="/en/lr/01266/#what-is-as2-gateway-communication">Send a Gateway Transmission</a>.
                </p>
            </td>
        </tr>
        <tr>
            <td>
                <em>AS2 Compression Settings</em><a id="as2-compression-settings"></a>
            </td>
            <td>
                
                        For the FDA, select <strong>Compress After Sign (Standard)</strong>.
                    
            </td>
        </tr>
    </tbody>
</table>

#### AS2 Partner Details Fields {#partner-fields}

<table>
    <thead>
        <tr>
            <th>
                Field
            </th>
            <th>
                Description
            </th>
        </tr>
    </thead>
    <tbody>
        <tr>
            <td>
                <em>AS2 Partner ID</em>
            </td>
            <td>
                
                        Enter one of the following FDA identification codes:
                        <ul>
                            <li>For a production account, enter <code>ZZFDA</code></li>
                            <li>For a test account, enter <code>ZZFDATST</code></li>
                        </ul>
                    <p>This value cannot include spaces. Instead, use a hyphen (<code>-</code>) or an underscore (<code>_</code>).</p>
                    
            </td>
        </tr>
        <tr>
            <td>
                <em>AS2 Partner URL</em>
            </td>
            <td>
                
                        <p>
                            Enter one (1) of the following destination FDA Gateway URLs:
                        </p>
                        <ul>
                            <li>
                                For a production account, enter <code>https://upload-api-esgng.fda.gov:4080/as2/receive</code>
                            </li>
                            <li>
                                For a test account, enter <code>https://upload-api-esgng.fda.gov:4080/as2/receive/test</code>
                            </li>
                        </ul>
                    
            </td>
        </tr>
        <tr>
            <td>
                <em>AS2 Partner Certificate Expiry</em>
            </td>
            <td>
                Vault populates this field when your Admin <a
                href="#upload-certificates">uploads the partner certificate</a>.
            </td>
        </tr>
        <tr>
            <td>
                <em>AS2 Partner Certificate Serial Number</em>
            </td>
            <td>
                When you upload a new partner certificate for this connection, Vault sets this field to the Serial Number of the certificate in decimal format.
            </td>
        </tr>
    </tbody>
</table>

#### AS2 Sponsor Details Fields {#sponsor-fields}

<table>
    <thead>
        <tr>
            <th>
                Field
            </th>
            <th>
                Description
            </th>
        </tr>
    </thead>
    <tbody>
        <tr>
            <td>
                <em>AS2 Vault ID</em>
            </td>
            <td>
                
                      Enter the ID registered with FDA Gateway, typically your FDA D-U-N-S number. This value cannot include spaces. Instead, use a hyphen (<code>-</code>) or an underscore (<code>_</code>).
                    
            </td>
        </tr>
        <tr>
            <td>
                <a id="as2-vault-url"></a>
                <em>AS2 Vault URL</em>
            </td>
            <td>
                
                <p>
                    Enter the AS2 URL of your Vault in the following format, replacing <code>&lt;SponsorName&gt;&lt;Partner&gt;&lt;Environment&gt;</code> with the corresponding values of your Vault:
                </p>
                <p>
                    <code>https://&lt;SponsorName&gt;&lt;Partner&gt;&lt;Environment&gt;.gateway.veevavaultsafety.com:4080</code>
                </p>
                <p>
                    The following example demonstrates how to form the AS2 Vault URL for a Vault with the following values:
                </p>
                <ul>
                    <li><code>&lt;SponsorName&gt;</code> = vern</li>
                    <li><code>&lt;Partner&gt;</code> = fda</li>
                    <li><code>&lt;Environment&gt;</code> = validation</li>
                    <li>AS2 Vault URL = <code>https://vernfdavalidation.gateway.veevavaultsafety.com:4080</code></li>
                </ul>
                <p>
                    <strong>Informing the Partner of your AS2 Vault URL</strong>
                </p>
                <p>
                    When informing the partner of the URL they need to use for this <em>AS2 Connection</em>, use the value you entered in this field appended with <code>/api/v1/inbound/transmission</code>
                </p>
                <p>
                    In the example shown above, this is <code>https://vernfdavalidation.gateway.veevavaultsafety.com:4080/api/v1/inbound/transmission</code>
                </p>
                
            </td>
        </tr>
        <tr>
            <td>
                <em>AS2 Vault Certificate Expiry</em>
            </td>
            <td>
                Vault populates this field when your Admin <a
                href="#upload-certificates">uploads the sponsor certificate</a>.
            </td>
        </tr>
        <tr>
            <td>
                <em>AS2 Vault Certificate Serial Number</em>
            </td>
            <td>
                When you upload a new sponsor certificate for this connection, Vault sets this field to the Serial Number of the certificate.
            </td>
        </tr>
        <tr>
            <td>
                <a id="as2-vault-domain-ip-config"></a>
                <em>AS2 Vault Domain / IP Configuration</em>
            </td>
            <td>
                <p>
                    Select the method the partner uses to interface with the <em>AS2 Connection</em>.
                </p>
                <ul>
                    <li><strong>AS2 Vault URL: Domain Name (typical)</strong>: A standard domain name that resolves to dynamic IP addresses.</li>
                    <li><strong>AS2 Vault URL: Domain Name bound to static IP addresses</strong>: A standard domain name that resolves to static IP addresses.</li>
                    <li><strong>AS2 Vault URL: IP URL (uncommon)</strong>: A non-standard IP address domain name that resolves to an IP address.</li>
                </ul>
                
                      For the FDA, select <strong>AS2 Vault URL: Domain Name (typical)</strong>.
                    
            </td>
        </tr>
    </tbody>
</table>

#### Transfer Connection Fields {#transfer-fields}

Leave the fields in this section blank.


### Upload the Partner and Sponsor Certificates {#upload-certificates}

Safety uses
<a href="/en/lr/872385/">partner and sponsor certificates</a>
to communicate securely with the partner. You will have received the partner certificate as part of creating your account with the partner.

Complete the following steps to create and upload these certificates:
* <a href="/en/lr/872385/#upload-partner-cert">Upload the partner certificate for the connection</a>.
* <a href="/en/lr/872385/#create-sponsor-cert">Create a sponsor certificate for the connection</a>.

### Add Connection Allowed IPs

Specify one (1) or more Allowed Connections for the _AS2 Connection_. These are Internet Protocol (IP) addresses that Vault will allow to connect with this _AS2 Connection_.

Perform the following steps for each Allowed Connection you want to add to the _AS2 Connection_:

1. Navigate to **Admin > Connections > [Connection] > Connection Allowed Lists**, then select **Create**.
2. On the **Create Connection Allowed List** window, complete the following information:
  * **Name**: Enter a name for the Allowed Connection.
  * (Optional) **Description**: Enter a description for the Allowed Connection.
  * **IP**: Enter the address of the Allowed Connection. \
  Ensure the format of the **IP** address is `XX.XX.XX.XX` or `XX.XX.XX.XX/{subnet mask}` where the `{subnet mask} `is a number between 24 and 32.
3. Repeat the above steps for each Allowed Connection.
4. When you have added all the Allowed Connections, select **Save**.

<div class="note-border alert-info">
  <div class="alert alert-info" role="alert">
    <div><i class="far fa-info-circle"></i></div>
    <div class="alert-text">
      <p><strong>Note</strong>: By default, Vaults are limited to 512 Allowed Connections. If your organization requires more, contact your Veeva Representative.</p>
    </div>
  </div>
</div>



### Synchronize the Connection {#sync-as2-connection}

Once you have entered all the details of the _AS2 Connection_, the Connection must be synchronized with the Gateway.

From the **All Actions** menu, select **Sync Connection to Gateway**.

When Vault successfully completes this action, the Connection's [AS2 Vault Gateway State](#as2-vault-gateway-state) changes to **Registered** and Vault can send and receive messages using this Connection.

<div class="note-border alert-info">
  <div class="alert alert-info" role="alert">
    <div><i class="far fa-info-circle"></i></div>
    <div class="alert-text">
      <p><strong>Note</strong>: If the <em>Sync Connection to Gateway</em> action is not successful, ensure each field value on the <em>AS2 Connection</em> is correct before retrying the action again. If the issue persists, <a href="/en/lr/728014/">troubleshoot the connection</a>.</p>
    </div>
  </div>
</div>



If you make any changes to the **Connection** object or its Connection Allowed List, the **AS2 Vault Gateway State** changes to **Registered - Out of Sync**. Vault cannot send or receive any messages using this Connection while it is in the **Registered - Out of Sync** state. You will need to repeat the **All Actions > Sync to Gateway** action to restore the Connection to the **Registered** state.


**Result**

The FDA _AS2 Connection_ is active and available to use to submit case reports to the FDA.

## Configure FDA Transmission Profiles {#configure-an-fda-esg-transmission-profile}

Safety comes with standard, system-provided _Transmission Profiles_ for FDA submissions. You must configure these _Transmission Profiles_ as part of the FDA Gateway setup.

The following table lists the Vault-provided FDA _Transmission Profiles_:

| Transmission Profile | Description | Routing ID |
| --- | --- | --- |
| _CBER_ | ICSR transmissions to the Center for Biologics Evaluation and Research (CBER) | FDA_AERS |
| _CDER_ | ICSR transmissions to the Center for Drug Evaluation and Research (CDER) | FDA_AERS |
| _GWTEST_ | Test transmissions to the FDA | GWTEST_CONNECTION |
| _CBER VAERS_ | VAERS ICSR transmissions to the Center for Biologics Evaluation and Research (CBER) | CBER_VAERS |
| _CBER Study_ | _Study_ data transmissions to the Center for Biologics Evaluation and Research (CBER) | FDA_AERS_PREMKT_CBER |
| _CDER Study_ | _Study_ data transmissions to the Center for Drug Evaluation and Research (CDER) | FDA_AERS_PREMKT_CDER |
| _CDER IND Exempt_ | _Study_ data transmissions for marketed products that are exempt from Investigational New Drugs (IND) requirements | FDA_AERS_PREMKT_CDER |

<div class="note-border alert-info">
  <div class="alert alert-info" role="alert">
    <div><i class="far fa-info-circle"></i></div>
    <div class="alert-text">
      <p><strong>Note</strong>: The above-listed <em>Transmission Profiles</em> can use the same <em>AS2 Connection</em> for communicating with the FDA.</p>
    </div>
  </div>
</div>



<a href="/en/lr/01202/">Manage Transmission Profiles</a> provides instructions on setting up _Transmission Profiles_.

When setting up the _Transmission Profiles_, see the following guidance on setting the _Origin_ and _Destination IDs_:

* **Origin ID**: Enter the ID registered with FDA ESG, typically your FDA D-U-N-S number.
* **Destination ID**: Enter one (1) of the following destination IDs:
    * For a production account, enter `ZZFDA`.
    * For a test account, enter `ZZFDATST`.

<div class="note-border alert-info">
  <div class="alert alert-info" role="alert">
    <div><i class="far fa-info-circle"></i></div>
    <div class="alert-text">
      <p><strong>Note</strong>: When editing the FDA <em>Transmission Profiles</em>, do not edit the Routing ID.</p>
    </div>
  </div>
</div>



Once you set up the FDA _Transmission Profiles_, Vault uses the appropriate _Transmission Profile_ to generate _Submissions_ based on your Vault's FDA <a href="/en/lr/01252/">reporting rules</a>.

## Configure FDA Study Manual Transmissions

For manual Study Case report _Submissions_ to the FDA, which are coordinated outside of Safety, configure the **FDA Study** _Transmission Profile_.

<a href="/en/lr/01202/">Manage Transmission Profiles</a> provides instructions on setting up _Transmission Profiles_.

[1]: #configure-an-fda-esg-transmission-profile