---
title: "Update a session"
method: PUT
path: "/sessions/{id}/collect-data"
tags: ["Standalone"]
---

# Update a session

`PUT /sessions/{id}/collect-data`

## Request

- Base URL: `https://{prefix}.api.sandbox.checkout.com`
- URL: `https://{prefix}.api.sandbox.checkout.com/sessions/{id}/collect-data`
- Auth: one of:
  - OAuth 2
    - Client credentials
    - Token URL: `string` scopes: `sessions:app`, `sessions:browser`
  - API key in header `Authorization`
- TypeScript: <https://skmtc.dev/checkout/apis/checkout-com-api-reference/docs/sessions/:id/collect-data/put.ts> (a function with typed inputs; its response is checked against the schema)

Update a session by providing information about the environment.

## Path parameters

- `id` string, required

## Request body

- union: The information gathered from the environment used to initiate the session
  - object
    - `channel` 'browser', required
    - `three_ds_method_completion` 'Y' | 'N' | 'U': Indicates whether the 3DS Method successfully completed<br/> • Y = Successfully completed <br/> • N = Did not successfully complete <br/> • U = Unavailable (3DS Method URL was not present in the preparation response (PRes) message data for the card range associated with the cardholder's account number)
    - `accept_header` string, required: Exact content of the HTTP accept headers as sent to the 3DS Requestor from the cardholder’s browser
    - `java_enabled` boolean, required: Boolean that represents the ability of the cardholder's browser to execute Java. Value is returned from the `navigator.javaEnabled` property.
    - `javascript_enabled` boolean, required: Boolean that represents the ability of the cardholder's browser to execute Javascript. Value is returned from the `navigator.javascriptEnabled` property. *only applicable/required for authentication performed using 3DS 2.2. If authentications results in processing on 2.1 or lower, this field will be disregarded.
    - `language` string, required: Value representing the browser language as defined in IETF BCP47. Returned from the `navigator.language` property.
    - `color_depth` string, required: Value representing the bit depth of the color palette for displaying images, in bits per pixel. Obtained from the cardholder's browser from the `screen.colorDepth` property.
    - `screen_height` string, required: Total height of the cardholder’s screen in pixels. Value is returned from the `screen.height` property.
    - `screen_width` string, required: Total width of the cardholder’s screen in pixels. Value is returned from the `screen.width` property.
    - `timezone` string, required: Time difference between UTC time and the local time of the cardholder's browser, in minutes.
    - `user_agent` string, required: Exact content of the HTTP user-agent header
    - `ip_address` string, required: IP address of the browser as returned by the HTTP headers to the 3DS Requestor
    - `iframe_payment_allowed` boolean: Whether the Payment API is enabled for all parent frames. This is required for Google SPA support in hosted sessions.
    - `user_agent_client_hint` string: The raw Sec-CH-UA header value. This can improve Google SPA support.
  - object
    - `channel` 'app', required
    - `sdk_app_id` string, required: Universally unique ID created upon all installations and updates of the 3DS Requestor App on a consumer device. This will be newly generated and stored by the 3DS SDK for each installation or update.
    - `sdk_max_timeout` integer, required: Indicates maximum amount of time (in minutes) for all exchanges
    - `sdk_ephem_pub_key` SdkEphemeralPublicKey, required: Public key component of the ephemeral key pair generated by the 3DS SDK and used to establish session keys between the 3DS SDK and ACS. Refer to https://tools.ietf.org/html/rfc7517#appendix-A.1
      - `kty` 'EC': The key type.
      - `crv` string: The type of elliptic curve.
      - `x` string: x coordinate of the elliptic curve that is base64url-encoded.
      - `y` string: y coordinate of the elliptic curve that is base64url-encoded.
    - `sdk_reference_number` string, required: Identifies the vendor and version for the 3DS SDK that is integrated in a 3DS Requestor App, assigned by EMVCo when the 3DS SDK is approved.
    - `sdk_encrypted_data` string, required: A JSON web encryption (JWE) object in compact serialization, containing data encrypted by the SDK for the Directory Server to decrypt.
    - `sdk_transaction_id` string, required: Universally unique transaction identifier assigned by the 3DS SDK to identify a single transaction
    - `sdk_interface_type` 'native' | 'html' | 'both', required: Lists all of the SDK interface types that the device supports for displaying specific challenge user interfaces within the SDK
    - `sdk_ui_elements` string[], required: Lists all the user interface elements that the cardholder's device supports for displaying specific challenge user interfaces within the SDK
  - object
    - `channel` 'merchant_initiated', required
    - `request_type` 'recurring_transaction' | 'installment_transaction' | 'add_card' | 'maintain_card_information' | 'account_verification' | 'split_or_delayed_shipment' | 'top_up' | 'mail_order' | 'telephone_order' | 'whitelist_status_check' | 'other_payment', required

## Response `200`

Session updated successfully

- GetSessionResponse
  - `id` string, required: Session unique identifier
  - `session_secret` string: A base64 encoded value prefixed with `sek_` that gives access to client-side operations for a single authentication within the Sessions API. This value is returned as the `session_secret` when requesting a session.
  - `transaction_id` string, required: The transaction identifier that needs to be provided when communicating directly with the Access Control Server (ACS)
  - `scheme` 'visa' | 'mastercard' | 'jcb' | 'amex' | 'diners' | 'cartes_bancaires' | 'discover' | 'upi', required: Indicates the scheme this authentication is carried out against
  - `amount` integer, required: The amount in the minor currency.
  - `currency` string, required: The three-letter ISO currency code
  - `completed` boolean: Indicates whether this session has been completed
  - `challenged` boolean: Indicates whether this session involved a challenge. This will only be set after communication with the scheme is finished.
  - `authentication_type` 'regular' | 'recurring' | 'installment' | 'maintain_card' | 'add_card', required: Indicates the type of payment this session is for. Please note the spelling of `installment` consists of two `l`s.
  - `authentication_category` 'payment' | 'non_payment', required: Indicates the category of the authentication request
  - `certificates` DsPublicKeys: Public certificates specific to a Directory Server (DS) for encrypting device data and verifying ACS signed content. Required when channel is `app`.
    - `ds_public` string, required: A public certificate provided by the DS for encryption of device data. It is a base64 URL encoded <a href="https://tools.ietf.org/html/rfc7517" target="_blank">JSON web key</a>.
    - `ca_public` string: Certificate authority (CA) public certificate (root) of the DS-CA. This certificate is used to validate the ACS signed content JSON web signature (JWS) object. It is a base64 URL encoded DER encoded X.509.
    - `ca_public_all` string[]: An array of available certificate authority (CA) public certificates (root) of the DS-CA. The certificates are used to validate the JSON web signature (JWS) object signed by the access control server (ACS). Each array element is a Base64 URL-encoded DER-encoded X.509 certificate.
  - `status` 'challenged' | 'pending' | 'processing' | 'challenge_abandoned' | 'expired' | 'approved' | 'attempted' | 'unavailable' | 'declined' | 'rejected', required: Indicates the status of the session
  - `status_reason` 'ares_status' | 'ares_error' | 'rreq_error' | 'rreq_status' | 'risk_declined': When the Session is unavailable this will point to the reason it is so. <br/><br/> • ares_error = There was an issue in the Authentication response we got back from the Directory Server (scheme server - 3DS2) <br/> • ares_status = The status was set to the status in the Authentication response we got back from the Directory Server (scheme server - 3DS2) <br/> • rreq_error = There was an issue in the Response we got back from the Access Control Server (issuer server - 3DS2) <br/> • rreq_status = The status was set to the status in the Response we got back from the Access Control Server (issuer server - 3DS2) <br/> • risk_declined = The status was set to declined because the Risk engine recommended we decline the authentication <br/>
  - `approved` boolean: Whether the authentication was successful. This will only be set if the Session is in a final state
  - `protocol_version` string, required: The protocol version number of the specification used by the API for authentication
  - `account_info` CardholderAccountInfo: Additional information about the Cardholder's account.
    - `purchase_count` number: The number of purchases with this cardholder's account during the last six months.
    - `account_age` 'no_account' | 'created_during_transaction' | 'less_than_thirty_days' | 'thirty_to_sixty_days' | 'more_than_sixty_days': The length of time that the payment account was enrolled in the cardholder's account.
    - `add_card_attempts` number: The number of Add Card attempts in the last 24 hours.
    - `shipping_address_age` 'this_transaction' | 'less_than_thirty_days' | 'thirty_to_sixty_days' | 'more_than_sixty_days': Indicates when the shipping address used for this transaction was first used.
    - `account_name_matches_shipping_name` boolean: Indicates if the Cardholder Name on the account is identical to the shipping Name used for this transaction.
    - `suspicious_account_activity` boolean: Indicates whether suspicious activity on the cardholder account has been observed.
    - `transactions_today` number: The number of transactions (successful and abandoned) for the cardholder account across all payment accounts in the previous 24 hours
    - `authentication_method` 'no_authentication' | 'own_credentials' | 'federated_id' | 'issuer_credentials' | 'third_party_authentication' | 'fido': Information about how the cardholder was authenticated before or during the transaction.
    - `cardholder_account_age_indicator` 'no_account,' | 'this_transaction' | 'less_than_thirty_days' | 'thirty_to_sixty_days' | 'more_than_sixty_days': The length of time the cardholder has held the account with the 3DS Requestor.
    - `account_change` string, date-time: The UTC date and time the cardholder’s account with the 3DS Requestor was last changed, in ISO 8601 format. Changes that affect this value include: - updating the billing or shipping address - adding a new payment account - adding a new user
    - `account_change_indicator` 'this_transaction' | 'less_than_thirty_days' | 'thirty_to_sixty_days' | 'more_than_sixty_days': The amount of time since the cardholder’s account information with the 3DS Requestor was last changed. Changes that affect this value include: - updating the billing or shipping address - adding a new payment account - adding a new user
    - `account_date` string, date-time: The UTC date and time the cardholder opened the account with the 3DS Requestor, in ISO 8601 format.
    - `account_password_change` string, date-time: The UTC date and time the cardholder’s account with the 3DS Requestor was last reset or had a password change, in ISO 8601 format.
    - `account_password_change_indicator` 'no_change' | 'this_transaction' | 'less_than_thirty_days' | 'thirty_to_sixty_days' | 'more_than_sixty_days': The amount of time since the cardholder’s account with the 3DS Requestor was last reset or had a password change.
    - `transactions_per_year` integer: The number of transactions associated with the cardholder's account with the 3DS Requestor in the previous year. This value includes both successful and abandoned transactions, across all payment accounts. Set this value to `999` if the number of transactions is `1000` or greater.
    - `payment_account_age` string, date-time: The UTC date and time the payment account was enrolled in the cardholder’s account with the 3DS Requestor, in ISO 8601 format.
    - `shipping_address_usage` string, date-time: The UTC date and time the shipping address used for the transaction was first used with the 3DS Requestor, in ISO 8601 format.
    - `account_type` 'not_applicable' | 'credit' | 'debit': The type of account, in the case of a card product with multiple accounts.
    - `account_id` string: Additional information about the account optionally provided by the 3DS Requestor.
    - `three_ds_requestor_authentication_info` ThreeDsRequestorAuthenticationInfo: Information about how the 3DS Requestor authenticated the cardholder before or during the transaction.
      - `three_ds_req_auth_method` 'no_threeds_requestor_authentication_occurred' | 'three3ds_requestor_own_credentials' | 'federated_id' | 'issuer_credentials' | 'third_party_authentication' | 'fido_authenticator' | 'fido_authenticator_fido_assurance_data_signed' | 'src_assurance_data': The mechanism used by the cardholder to authenticate with the 3DS Requestor.
      - `three_ds_req_auth_timestamp` string, date-time: The UTC date and time the cardholder authenticated with the 3DS Requestor, in ISO 8601 format.
      - `three_ds_req_auth_data` string: Data that documents and supports a specific authentication process.
  - `merchant_risk_info` MerchantRiskInfo: Additional information about the cardholder's purchase.
    - `delivery_email` string: For Electronic delivery, the email address to which the merchandise was delivered.
    - `delivery_timeframe` 'electronic_delivery' | 'same_day' | 'overnight' | 'two_day_or_more': Indicates the merchandise delivery timeframe.
    - `is_preorder` boolean: Indicates whether the cardholder is placing an order for merchandise with a future availability or release date.
    - `is_reorder` boolean: Indicates whether the cardholder is reordering previously purchased merchandise.
    - `shipping_indicator` 'billing_address' | 'another_address_on_file' | 'not_on_file' | 'store_pick_up' | 'digital_goods' | 'travel_and_event_no_shipping' | 'other': Indicates the shipping method chosen for the transaction. Please choose an option that accurately describes the cardholder's specific transaction.
    - `reorder_items_indicator` 'first_time_ordered' | 'reordered': Specifies whether the cardholder is reordering merchandise they've previously purchased.
    - `pre_order_purchase_indicator` 'merchandise_available' | 'future_availability': Specifies whether the cardholder is placing an order for merchandise with an availability date or release date in the future.
    - `pre_order_date` string, date-time: The UTC date the pre-ordered merchandise is expected to be available, in ISO 8601 format.
    - `gift_card_amount` string: The total purchase amount, in major units. For example, the major unit amount for a gift card purchase of 135.20 USD is `135`. Only applicable for prepaid or gift card purchases.
    - `gift_card_currency` string: The currency code of the gift card, as a three-digit ISO 4217 code. Only applicable for prepaid or gift card purchases.
    - `gift_card_count` string: The total number of individual prepaid cards, gift cards, or gift codes purchased. Only applicable for prepaid or gift card purchases.
  - `reference` string: A reference you can later use to identify this payment, such as an order number. **Do not pass sensitive information in this field e.g. card details**
  - `transaction_type` 'goods_service' | 'check_acceptance' | 'account_funding' | 'quasi_card_transaction' | 'prepaid_activation_and_load': Identifies the type of transaction being authenticated
  - `next_actions` string[]: Specifies which action to take in order to complete the session. The `redirect_cardholder` action is only applicable for <a href="https://www.checkout.com/docs/payments/authenticate-payments/3d-secure/standalone-sessions/hosted-sessions">hosted sessions</a>.
  - `ds` Ds: The directory server (DS) information. Can be empty if the session is pending or communication with the DS failed
    - `ds_id` string: Required if the session is deemed app-based. Registered application provider identifier (RID) that is unique to the payment system. RIDs are defined by the ISO 7816-5 standard. Used as part of the device data encryption process.
    - `reference_number` string: EMVCo-assigned unique identifier to track approved DS
    - `transaction_id` string: Universally unique transaction identifier assigned by the DS
  - `acs` Acs: The access control server (ACS) information. Can be empty if the session is still pending or if communication with the ACS failed. This will be available when the channel data and issuer fingerprint result have been provided.
    - `reference_number` string, required: EMVCo-assigned unique identifier to track approved ACS
    - `transaction_id` string, required: Universally unique transaction identifier assigned by the ACS
    - `operator_id` string, required: DS assigned ACS identifier
    - `url` string: Fully qualified URL of the ACS to be used for the challenge
    - `signed_content` string: Contains the JSON web signature (JWS) compact serialization created by the ACS for a challenged app authentication. (Example has been truncated for readability.)
    - `challenge_mandated` boolean, required: Indicates whether a challenge is required for the transaction to be authorized
    - `authentication_type` string: The type of authentication as returned from the ACS provider. <br/> • 01 = Static <br/> • 02 = Dynamic <br/> • 03 = OOB <br/> • 04-79 = Reserved for EMVCo future use <br/> • 80-99 = Reserved for DS use
    - `challenge_cancel_reason` 'cardholder_cancel' | 'transaction_timed_out' | 'challenge_timed_out' | 'transaction_error' | 'unknown' | 'sdk_timed_out': Indicator informing the ACS and the DS that the authentication has been cancelled
    - `interface` 'native_ui' | 'html'
    - `ui_template` 'text' | 'single_select' | 'multi_select' | 'oob' | 'html_other'
    - `challenge_cancel_reason_code` string: Indicator in the 3D Secure 2 RReq when the challenge is cancelled
  - `response_code` 'Y' | 'N' | 'U' | 'A' | 'C' | 'D' | 'R' | 'I': Only available as a result of a 3DS2 authentication. The response from the DS or ACS which indicates whether a transaction qualifies as an authenticated transaction or account verification. <br/> Only available if communication with the scheme was successful and the Session is in a final state. <br/><br/> • Y = Authentication Verification Successful. <br/> • N = Not Authenticated /Account Not Verified; Transaction denied. <br/> • U = Authentication/ Account Verification Could Not Be Performed; Technical or other problem, as indicated in ARes or RReq. <br/> • A = Attempts Processing Performed; Not Authenticated/Verified, but a proof of attempted authentication/verification is provided. <br/> • C = Challenge Required; Additional authentication is required using the CReq/CRes. <br/> • D = Challenge Required; Decoupled Authentication confirmed. <br/> • R = Authentication/ Account Verification Rejected; Issuer is rejecting authentication/verification and request that authorization not be attempted. <br/> • I = Informational Only; 3DS Requestor challenge preference acknowledged.
  - `response_status_reason` string: Only available as a result of a 3DS2 authentication. The response from the DS or ACS which provides information on why the `response_code` field has the specified value. <br/> Only available when `response_code` is not `Y`. <br/> Learn more about the reasons for <a href="https://www.checkout.com/docs/risk-management/3d-secure/sessions/understand-authentication-failures" target="_blank">authentication failures</a>.<br/><br/>
  - `cryptogram` string: Payment system-specific value provided as part of the ACS registration for each supported DS. Please be advised that this field will only be included in responses when authenticating with a valid OAuth token and not when authenticating with `session_secret`. Cryptogram can only be retrieved for up to 24 hours after the session is created.
  - `eci` string: Electronic Commerce Indicator. Please be advised that this field will only be included in responses when authenticating with a valid OAuth token and not when authenticating with `session_secret`.
  - `xid` string: The xid value to use for authorization
  - `cardholder_info` string: May provide cardholder information from the DS to be presented to the cardholder
  - `card` CardInfo: Details related to the Session source. This property should always be in the response, unless a `card` source was used and communication with Checkout.com's Vault was not possible.
    - `instrument_id` string, required: The identifier of the card instrument.
    - `fingerprint` string, required: A token that can uniquely identify this card across all customers.
    - `metadata` object: Additional details for this card
      - `card_type` 'CREDIT' | 'DEBIT' | 'PREPAID' | 'CHARGE' | 'DEFERRED DEBIT': The card type
      - `card_category` 'CONSUMER' | 'COMMERCIAL': The card category.
      - `issuer_name` string: The card issuer's name.
      - `issuer_country` string: The two letter alpha country code of the card issuer.
      - `product_id` string: The issuer/card scheme product identifier.
      - `product_type` string: The issuer/card scheme product type.
  - `recurring` Recurring: Details of a recurring authentication. This property is needed only for a recurring authentication type. Value will be ignored in any other cases.
    - `days_between_payments` integer: Indicates the minimum number of days between authorisations. If no value is specified for a recurring authentication type the default value will be used.
    - `expiry` string: Date after which no further authorisations are performed in the format yyyyMMdd. If no value is specified for a recurring authentication type the default value will be used.
  - `installment` Installment: Details of an installment authentication. This property is needed only for an installment authentication type. Value will be ignored in any other cases.
    - `number_of_payments` integer, required: Indicates the agreed total number of payment installments to be made in the duration of the installment agreement. Required when the authentication type is `instalment`.
    - `days_between_payments` integer: Indicates the minimum number of days between authorisations. If no value is specified for an installment authentication type the default value will be used.
    - `expiry` string: Date after which no further authorisations are performed in the format yyyyMMdd. If no value is specified for an installment authentication type the default value will be used.
  - `initial_transaction` InitialTransaction: Details of a previous transaction
    - `acs_transaction_id` string: The Access Control Server (ACS) transaction ID for a previously authenticated transaction
    - `authentication_method` 'frictionless_authentication' | 'challenge_occurred' | 'avs_verified' | 'other_issuer_methods'
    - `authentication_timestamp` string: The timestamp of the previous authentication, in ISO 8601 format.
    - `authentication_data` string: Data that documents and supports a specific authentication process
    - `initial_session_id` string: The ID for a previous session, which is used for retrieve the initial transaction's properties
  - `customer_ip` string: Indicates the card holder's IP address. Only available when the scheme selected is Cartes Bancaires.
  - `_links` GetSessionLinks, required: The links related to the session
    - `self` object, required: The URI of the session
      - `href` string, required
  - `authentication_date` string, date-time: Authentication date and time
  - `exemption` object: Details related to exemption present in 3DS flow
    - `requested` 'none': Indicates merchant requested exemption
    - `applied` 'none' | 'low_value' | 'transaction_risk_assessment' | 'secure_corporate_payment' | 'trusted_listing' | '3ds_outage' | 'sca_delegation' | 'out_of_sca_scope' | 'other' | 'low_risk_program': Indicates Issuer accepted or applied exemption
    - `code` string: Indicates Cartes Bancaire specific exemption value
    - `trusted_beneficiary` TrustedBeneficiary: Details of the trusted listing status of the merchant.
      - `status` 'Y' | 'N' | 'E' | 'P' | 'R' | 'U': Enables the communication of trusted beneficiary status between the Access Control Server (ACS), the Directory Server (DS), and the 3D Secure (3DS) Requestor.<br/><br/> • Y = 3DS Requestor is allowlisted by cardholder<br/> • N = 3DS Requestor is not allowlisted by cardholder<br/> • E = Not eligible as determined by issuer<br/> • P = Pending confirmation by cardholder<br/> • R = Cardholder rejected<br/> • U = Allowlist status unknown, unavailable, or does not apply
      - `source` string: The system setting trusted beneficiary status.<br/><br/> • 01 = 3DS Server <br/> • 02 = DS <br/> • 03 = ACS <br/> • 80-99 = DS-specific values <br/>
  - `flow_type` 'challenged' | 'frictionless' | 'frictionless_delegated': Indicates whether the 3D Secure 2 authentication was challenged or frictionless
  - `challenge_indicator` 'no_preference' | 'no_challenge_requested' | 'challenge_requested' | 'challenge_requested_mandate', required: Indicates the preference for whether or not a 3DS challenge should be performed. The customer’s bank has the final say on whether or not the customer receives the challenge
  - `optimization` object: The information about the optimization options selected
    - `optimized` boolean: Indicates if any optimization has been applied
    - `framework` 'acceptance_rates': The optimization framework applied
    - `optimized_properties` OptimizedProperty[]: The collection of fields optimized
      - `field` string: Name of the field which has been optimized.
      - `original_value` string: Value prior to optimization.
      - `optimized_value` string: Value prior to optimization.
  - `scheme_info` object: Indicates scheme-specific information
    - `name` 'cartes_bancaires' | 'visa' | 'mastercard': Indicates which scheme was used to perform authentication
    - `score` string: Risk score calculated by Directory Server (DS). Cartes Bancaires 3D Secure 2 only
    - `avalgo` string: Identification of the algorithm used by the ACS to calculate the Authentication Value indicated
  - `3ds` object: This object provides more information about the 3DS experience
    - `challenge_request` string: The CReq message, encoded in Base 64.
    - `interaction_counter` string: The number of authentication attempts performed by the cardholder.
    - `error_details` ErrorDetails: Provides additional information about the error returned.
      - `error_code` string: An error code identifying the type of issue.
      - `error_component` string: A code that specifies which 3D Secure component identified the error.
      - `error_detail` string: Provides additional details about the issue.
      - `error_description` string: A description of the issue identified.
  - `preferred_experiences` PreferredExperiences: Preferred Experiences
    - `google_spa` object: Google SPA experience.
      - `status` 'available' | 'unprocessed' | 'processed' | 'unavailable'
      - `reason` string[]: Reason(s) why processing the experience was unsuccessful.
    - `3ds` object: 3DS experience.
      - `status` 'available' | 'unprocessed' | 'processed' | 'unavailable'
      - `reason` string[]: Reason(s) why processing the experience was unsuccessful.
  - `experience` '3ds' | 'google_spa': The authentication experience that was used for processing
  - `google_spa` union: Details of Google SPA (Secure Payment Authentication)
    - HostedGoogleSpaInfo: Details of Google SPA (Secure Payment Authentication) for a hosted authentication
      - `token` GoogleSpaToken: Token for the given PAN provisioned and authenticated
        - `number` string: Value of token. Represented as a numerical string
        - `expiry_month` number: Expiry month of the token
        - `expiry_year` number: Expiry year of the token
    - NonHostedGoogleSpaInfo: Details of Google SPA (Secure Payment Authentication) for a non-hosted authentication
      - `challenge_url` string: Fully qualified URL of the Google SPA (Secure Payment Authentication) frontend for user challenge/unlock
      - `initial_timeout` string: Indicates the amount of time (in minutes) allowed for establishing the initial connection to the user's specific authentication session, as determined by the challenge_url)
      - `max_timeout` string: Indicates maximum amount of time (in minutes) allowed for completing all PSP-Google message exchanges for current authentication session
      - `iframe` object: Details of the challenge iframe displayed in the Cardholder browser window
        - `height` string: Height of the challenge iframe displayed in the Cardholder browser window.
        - `width` string: Width of the challenge iframe displayed in the Cardholder browser window.
      - `token` GoogleSpaToken: Token for the given PAN provisioned and authenticated
        - `number` string: Value of token. Represented as a numerical string
        - `expiry_month` number: Expiry month of the token
        - `expiry_year` number: Expiry year of the token

## Other responses

- `401`: Unauthorized
- `403`: Forbidden
- `404`: Session not found
- `422`: Unprocessable channel information

---

[API](https://skmtc.dev/checkout/apis/checkout-com-api-reference.md) - [All operations](https://skmtc.dev/checkout/apis/checkout-com-api-reference/llms.txt) - [OpenAPI document](https://skmtc.dev/checkout/apis/checkout-com-api-reference/revisions/0f1abdb1c3e9?raw)