---
title: "Enroll a card in 3DS"
method: POST
path: "/issuing/cards/{cardId}/3ds-enrollment"
tags: ["Cards"]
---

# Enroll a card in 3DS

`POST /issuing/cards/{cardId}/3ds-enrollment`

## Request

- Base URL: `https://{prefix}.api.sandbox.checkout.com`
- URL: `https://{prefix}.api.sandbox.checkout.com/issuing/cards/{cardId}/3ds-enrollment`
- Auth: OAuth 2
  - Client credentials
  - Token URL: `string` scopes: `issuing:card-management-write`
- TypeScript: <https://skmtc.dev/checkout/apis/checkout-com-api-reference/docs/issuing/cards/:cardId/3ds-enrollment/post.ts> (a function with typed inputs; its response is checked against the schema)

Enrolls a card in <a href="https://www.checkout.com/docs/risk-management/3d-secure">3D Secure</a> (3DS). Additional information is requested from the cardholder through a 3DS challenge when performing a transaction.

Two-factor authentication (2FA) is supported. For maximum security, we recommend using a combination of a one-time password (OTP) sent via SMS, along with a password or question and answer security pair.

## Path parameters

- `cardId` string, required: The card's unique identifier.

## Request body

- union
  - SecurityQuestion
    - `security_pair` 3dsSecurityPair, required: The question and answer security pair used to support knowledge-based 3DS authentication. Security pairs are set per-card, not per-cardholder.
      - `question` string, required: The cardholder’s security question.
      - `answer` string, required: The cardholder’s answer to the security question. The answer is not case-sensitive. Leading and trailing white spaces will be ignored.
    - `locale` 'en-US' | 'fr-FR', language-COUNTRY: The card's locale, as one of the possible BCP 47 formatted enum values. The locale determines the language that text messages and 3DS challenge prompts are displayed to the user in, as well as the format used for amounts and dates. When not provided, the locale of the card product is used.
    - `phone_number` 3dsPhoneNumber, required: The phone number to send the one-time password (OTP) for 3DS authentication to. This phone number is independent of the cardholder's mobile phone number on file. The number is used for authorizations that require a <a href="https://www.checkout.com/docs/payments/authenticate-payments/3d-secure">3DS challenge</a>.
      - `country_code` string, required: The phone number's <a href="https://docs.checkout.com/resources/codes/country-codes" target="blank">international country calling code</a>.
      - `number` string, required: A valid phone number without leading zeros.
  - Password
    - `password` string, required: The case-sensitive password used to support knowledge-based 3DS authentication. Leading and trailing white spaces will be ignored.
    - `locale` 'en-US' | 'fr-FR', language-COUNTRY: The card's locale, as one of the possible BCP 47 formatted enum values. The locale determines the language that text messages and 3DS challenge prompts are displayed to the user in, as well as the format used for amounts and dates. When not provided, the locale of the card product is used.
    - `phone_number` 3dsPhoneNumber, required: The phone number to send the one-time password (OTP) for 3DS authentication to. This phone number is independent of the cardholder's mobile phone number on file. The number is used for authorizations that require a <a href="https://www.checkout.com/docs/payments/authenticate-payments/3d-secure">3DS challenge</a>.
      - `country_code` string, required: The phone number's <a href="https://docs.checkout.com/resources/codes/country-codes" target="blank">international country calling code</a>.
      - `number` string, required: A valid phone number without leading zeros.

## Response `202`

3DS card enrollment completed successfully

- 3dsEnrollmentPostResponse: The card's 3DS authentication details.
  - `_links` 3dsLink: The link to the card's 3DS enrollment details.
    - `self` IssuingLink, required
      - `href` string, required: The link URL.
      - `actions` string[], required: The HTTP Methods that can be performed on the link.
      - `types` string[], required: The Content Types for the link to the resource

## Other responses

- `401`: Unauthorized
- `404`: Card not found
- `422`: Invalid data was sent
- `500`: Internal Server Error

---

[API](https://skmtc.dev/checkout/apis/checkout-com-api-reference.md) - [All operations](https://skmtc.dev/checkout/apis/checkout-com-api-reference/llms.txt) - [OpenAPI document](https://skmtc.dev/checkout/apis/checkout-com-api-reference/revisions/0f1abdb1c3e9?raw)