--- title: "Update session 3DS Method completion indicator" method: PUT path: "/sessions/{id}/issuer-fingerprint" tags: ["Standalone"] --- # Update session 3DS Method completion indicator `PUT /sessions/{id}/issuer-fingerprint` ## Request - Base URL: `https://{prefix}.api.sandbox.checkout.com` - URL: `https://{prefix}.api.sandbox.checkout.com/sessions/{id}/issuer-fingerprint` - Auth: one of: - OAuth 2 - Client credentials - Token URL: `string` scopes: `sessions:browser` - API key in header `Authorization` - TypeScript: (a function with typed inputs; its response is checked against the schema) Update the session's 3DS Method completion indicator based on the result of accessing the 3DS Method URL. ## Path parameters - `id` string, required ## Request body - ThreeDsMethodCompletion: The result of the 3DS method url - `three_ds_method_completion` 'Y' | 'N' | 'U', required: The result of the 3DS method URL.
Default to `U` if a response is not received from the 3DS Method URL within 10 seconds. ## Response `200` Session updated successfully - GetSessionResponseAfterChannelDataSupplied - `id` string, required: Session unique identifier - `session_secret` string: A base64 encoded value prefixed with `sek_` that gives access to client-side operations for a single authentication within the Sessions API. This value is returned as the `session_secret` when requesting a session. - `transaction_id` string, required: The transaction identifier that needs to be provided when communicating directly with the Access Control Server (ACS) - `scheme` 'visa' | 'mastercard' | 'jcb' | 'amex' | 'diners' | 'cartes_bancaires' | 'discover' | 'upi', required: Indicates the scheme this authentication is carried out against - `amount` integer, required: The amount in the minor currency. - `currency` string, required: The three-letter ISO currency code - `completed` boolean: Indicates whether this session has been completed - `challenged` boolean: Indicates whether this session involved a challenge. This will only be set after communication with the scheme is finished. - `authentication_type` 'regular' | 'recurring' | 'installment' | 'maintain_card' | 'add_card', required: Indicates the type of payment this session is for. Please note the spelling of `installment` consists of two `l`s. - `authentication_category` 'payment' | 'non_payment', required: Indicates the category of the authentication request - `status` 'challenged' | 'pending' | 'processing' | 'challenge_abandoned' | 'expired' | 'approved' | 'attempted' | 'unavailable' | 'declined' | 'rejected', required: Indicates the status of the session - `status_reason` 'ares_status' | 'ares_error' | 'rreq_error' | 'rreq_status' | 'risk_declined': When the Session is unavailable this will point to the reason it is so.

• ares_error = There was an issue in the Authentication response we got back from the Directory Server (scheme server - 3DS2)
• ares_status = The status was set to the status in the Authentication response we got back from the Directory Server (scheme server - 3DS2)
• rreq_error = There was an issue in the Response we got back from the Access Control Server (issuer server - 3DS2)
• rreq_status = The status was set to the status in the Response we got back from the Access Control Server (issuer server - 3DS2)
• risk_declined = The status was set to declined because the Risk engine recommended we decline the authentication
- `approved` boolean: Whether the authentication was successful. This will only be set if the Session is in a final state - `protocol_version` string, required: The protocol version number of the specification used by the API for authentication - `account_info` CardholderAccountInfo: Additional information about the Cardholder's account. - `purchase_count` number: The number of purchases with this cardholder's account during the last six months. - `account_age` 'no_account' | 'created_during_transaction' | 'less_than_thirty_days' | 'thirty_to_sixty_days' | 'more_than_sixty_days': The length of time that the payment account was enrolled in the cardholder's account. - `add_card_attempts` number: The number of Add Card attempts in the last 24 hours. - `shipping_address_age` 'this_transaction' | 'less_than_thirty_days' | 'thirty_to_sixty_days' | 'more_than_sixty_days': Indicates when the shipping address used for this transaction was first used. - `account_name_matches_shipping_name` boolean: Indicates if the Cardholder Name on the account is identical to the shipping Name used for this transaction. - `suspicious_account_activity` boolean: Indicates whether suspicious activity on the cardholder account has been observed. - `transactions_today` number: The number of transactions (successful and abandoned) for the cardholder account across all payment accounts in the previous 24 hours - `authentication_method` 'no_authentication' | 'own_credentials' | 'federated_id' | 'issuer_credentials' | 'third_party_authentication' | 'fido': Information about how the cardholder was authenticated before or during the transaction. - `cardholder_account_age_indicator` 'no_account,' | 'this_transaction' | 'less_than_thirty_days' | 'thirty_to_sixty_days' | 'more_than_sixty_days': The length of time the cardholder has held the account with the 3DS Requestor. - `account_change` string, date-time: The UTC date and time the cardholder’s account with the 3DS Requestor was last changed, in ISO 8601 format. Changes that affect this value include: - updating the billing or shipping address - adding a new payment account - adding a new user - `account_change_indicator` 'this_transaction' | 'less_than_thirty_days' | 'thirty_to_sixty_days' | 'more_than_sixty_days': The amount of time since the cardholder’s account information with the 3DS Requestor was last changed. Changes that affect this value include: - updating the billing or shipping address - adding a new payment account - adding a new user - `account_date` string, date-time: The UTC date and time the cardholder opened the account with the 3DS Requestor, in ISO 8601 format. - `account_password_change` string, date-time: The UTC date and time the cardholder’s account with the 3DS Requestor was last reset or had a password change, in ISO 8601 format. - `account_password_change_indicator` 'no_change' | 'this_transaction' | 'less_than_thirty_days' | 'thirty_to_sixty_days' | 'more_than_sixty_days': The amount of time since the cardholder’s account with the 3DS Requestor was last reset or had a password change. - `transactions_per_year` integer: The number of transactions associated with the cardholder's account with the 3DS Requestor in the previous year. This value includes both successful and abandoned transactions, across all payment accounts. Set this value to `999` if the number of transactions is `1000` or greater. - `payment_account_age` string, date-time: The UTC date and time the payment account was enrolled in the cardholder’s account with the 3DS Requestor, in ISO 8601 format. - `shipping_address_usage` string, date-time: The UTC date and time the shipping address used for the transaction was first used with the 3DS Requestor, in ISO 8601 format. - `account_type` 'not_applicable' | 'credit' | 'debit': The type of account, in the case of a card product with multiple accounts. - `account_id` string: Additional information about the account optionally provided by the 3DS Requestor. - `three_ds_requestor_authentication_info` ThreeDsRequestorAuthenticationInfo: Information about how the 3DS Requestor authenticated the cardholder before or during the transaction. - `three_ds_req_auth_method` 'no_threeds_requestor_authentication_occurred' | 'three3ds_requestor_own_credentials' | 'federated_id' | 'issuer_credentials' | 'third_party_authentication' | 'fido_authenticator' | 'fido_authenticator_fido_assurance_data_signed' | 'src_assurance_data': The mechanism used by the cardholder to authenticate with the 3DS Requestor. - `three_ds_req_auth_timestamp` string, date-time: The UTC date and time the cardholder authenticated with the 3DS Requestor, in ISO 8601 format. - `three_ds_req_auth_data` string: Data that documents and supports a specific authentication process. - `merchant_risk_info` MerchantRiskInfo: Additional information about the cardholder's purchase. - `delivery_email` string: For Electronic delivery, the email address to which the merchandise was delivered. - `delivery_timeframe` 'electronic_delivery' | 'same_day' | 'overnight' | 'two_day_or_more': Indicates the merchandise delivery timeframe. - `is_preorder` boolean: Indicates whether the cardholder is placing an order for merchandise with a future availability or release date. - `is_reorder` boolean: Indicates whether the cardholder is reordering previously purchased merchandise. - `shipping_indicator` 'billing_address' | 'another_address_on_file' | 'not_on_file' | 'store_pick_up' | 'digital_goods' | 'travel_and_event_no_shipping' | 'other': Indicates the shipping method chosen for the transaction. Please choose an option that accurately describes the cardholder's specific transaction. - `reorder_items_indicator` 'first_time_ordered' | 'reordered': Specifies whether the cardholder is reordering merchandise they've previously purchased. - `pre_order_purchase_indicator` 'merchandise_available' | 'future_availability': Specifies whether the cardholder is placing an order for merchandise with an availability date or release date in the future. - `pre_order_date` string, date-time: The UTC date the pre-ordered merchandise is expected to be available, in ISO 8601 format. - `gift_card_amount` string: The total purchase amount, in major units. For example, the major unit amount for a gift card purchase of 135.20 USD is `135`. Only applicable for prepaid or gift card purchases. - `gift_card_currency` string: The currency code of the gift card, as a three-digit ISO 4217 code. Only applicable for prepaid or gift card purchases. - `gift_card_count` string: The total number of individual prepaid cards, gift cards, or gift codes purchased. Only applicable for prepaid or gift card purchases. - `reference` string: A reference you can later use to identify this payment, such as an order number. **Do not pass sensitive information in this field e.g. card details** - `transaction_type` 'goods_service' | 'check_acceptance' | 'account_funding' | 'quasi_card_transaction' | 'prepaid_activation_and_load': Identifies the type of transaction being authenticated - `initial_transaction` InitialTransaction: Details of a previous transaction - `acs_transaction_id` string: The Access Control Server (ACS) transaction ID for a previously authenticated transaction - `authentication_method` 'frictionless_authentication' | 'challenge_occurred' | 'avs_verified' | 'other_issuer_methods' - `authentication_timestamp` string: The timestamp of the previous authentication, in ISO 8601 format. - `authentication_data` string: Data that documents and supports a specific authentication process - `initial_session_id` string: The ID for a previous session, which is used for retrieve the initial transaction's properties - `next_actions` string[]: Specifies which action to take in order to complete the session. The `redirect_cardholder` action is only applicable for hosted sessions. - `ds` Ds: The directory server (DS) information. Can be empty if the session is pending or communication with the DS failed - `ds_id` string: Required if the session is deemed app-based. Registered application provider identifier (RID) that is unique to the payment system. RIDs are defined by the ISO 7816-5 standard. Used as part of the device data encryption process. - `reference_number` string: EMVCo-assigned unique identifier to track approved DS - `transaction_id` string: Universally unique transaction identifier assigned by the DS - `acs` Acs: The access control server (ACS) information. Can be empty if the session is still pending or if communication with the ACS failed. This will be available when the channel data and issuer fingerprint result have been provided. - `reference_number` string, required: EMVCo-assigned unique identifier to track approved ACS - `transaction_id` string, required: Universally unique transaction identifier assigned by the ACS - `operator_id` string, required: DS assigned ACS identifier - `url` string: Fully qualified URL of the ACS to be used for the challenge - `signed_content` string: Contains the JSON web signature (JWS) compact serialization created by the ACS for a challenged app authentication. (Example has been truncated for readability.) - `challenge_mandated` boolean, required: Indicates whether a challenge is required for the transaction to be authorized - `authentication_type` string: The type of authentication as returned from the ACS provider.
• 01 = Static
• 02 = Dynamic
• 03 = OOB
• 04-79 = Reserved for EMVCo future use
• 80-99 = Reserved for DS use - `challenge_cancel_reason` 'cardholder_cancel' | 'transaction_timed_out' | 'challenge_timed_out' | 'transaction_error' | 'unknown' | 'sdk_timed_out': Indicator informing the ACS and the DS that the authentication has been cancelled - `interface` 'native_ui' | 'html' - `ui_template` 'text' | 'single_select' | 'multi_select' | 'oob' | 'html_other' - `challenge_cancel_reason_code` string: Indicator in the 3D Secure 2 RReq when the challenge is cancelled - `response_code` 'Y' | 'N' | 'U' | 'A' | 'C' | 'D' | 'R' | 'I': Only available as a result of a 3DS2 authentication. The response from the DS or ACS which indicates whether a transaction qualifies as an authenticated transaction or account verification.
Only available if communication with the scheme was successful and the Session is in a final state.

• Y = Authentication Verification Successful.
• N = Not Authenticated /Account Not Verified; Transaction denied.
• U = Authentication/ Account Verification Could Not Be Performed; Technical or other problem, as indicated in ARes or RReq.
• A = Attempts Processing Performed; Not Authenticated/Verified, but a proof of attempted authentication/verification is provided.
• C = Challenge Required; Additional authentication is required using the CReq/CRes.
• D = Challenge Required; Decoupled Authentication confirmed.
• R = Authentication/ Account Verification Rejected; Issuer is rejecting authentication/verification and request that authorization not be attempted.
• I = Informational Only; 3DS Requestor challenge preference acknowledged. - `response_status_reason` string: Only available as a result of a 3DS2 authentication. The response from the DS or ACS which provides information on why the `response_code` field has the specified value.
Only available when `response_code` is not `Y`.
Learn more about the reasons for authentication failures.

- `cryptogram` string: Payment system-specific value provided as part of the ACS registration for each supported DS. Please be advised that this field will only be included in responses when authenticating with a valid OAuth token and not when authenticating with `session_secret`. Cryptogram can only be retrieved for up to 24 hours after the session is created. - `eci` string: Electronic Commerce Indicator. Please be advised that this field will only be included in responses when authenticating with a valid OAuth token and not when authenticating with `session_secret`. - `xid` string: The xid value to use for authorization - `preferred_experiences` PreferredExperiences: Preferred Experiences - `google_spa` object: Google SPA experience. - `status` 'available' | 'unprocessed' | 'processed' | 'unavailable' - `reason` string[]: Reason(s) why processing the experience was unsuccessful. - `3ds` object: 3DS experience. - `status` 'available' | 'unprocessed' | 'processed' | 'unavailable' - `reason` string[]: Reason(s) why processing the experience was unsuccessful. - `experience` '3ds' | 'google_spa': The authentication experience that was used for processing - `google_spa` union: Details of Google SPA (Secure Payment Authentication) - HostedGoogleSpaInfo: Details of Google SPA (Secure Payment Authentication) for a hosted authentication - `token` GoogleSpaToken: Token for the given PAN provisioned and authenticated - `number` string: Value of token. Represented as a numerical string - `expiry_month` number: Expiry month of the token - `expiry_year` number: Expiry year of the token - NonHostedGoogleSpaInfo: Details of Google SPA (Secure Payment Authentication) for a non-hosted authentication - `challenge_url` string: Fully qualified URL of the Google SPA (Secure Payment Authentication) frontend for user challenge/unlock - `initial_timeout` string: Indicates the amount of time (in minutes) allowed for establishing the initial connection to the user's specific authentication session, as determined by the challenge_url) - `max_timeout` string: Indicates maximum amount of time (in minutes) allowed for completing all PSP-Google message exchanges for current authentication session - `iframe` object: Details of the challenge iframe displayed in the Cardholder browser window - `height` string: Height of the challenge iframe displayed in the Cardholder browser window. - `width` string: Width of the challenge iframe displayed in the Cardholder browser window. - `token` GoogleSpaToken: Token for the given PAN provisioned and authenticated - `number` string: Value of token. Represented as a numerical string - `expiry_month` number: Expiry month of the token - `expiry_year` number: Expiry year of the token - `card` CardInfo: Details related to the Session source. This property should always be in the response, unless a `card` source was used and communication with Checkout.com's Vault was not possible. - `instrument_id` string, required: The identifier of the card instrument. - `fingerprint` string, required: A token that can uniquely identify this card across all customers. - `metadata` object: Additional details for this card - `card_type` 'CREDIT' | 'DEBIT' | 'PREPAID' | 'CHARGE' | 'DEFERRED DEBIT': The card type - `card_category` 'CONSUMER' | 'COMMERCIAL': The card category. - `issuer_name` string: The card issuer's name. - `issuer_country` string: The two letter alpha country code of the card issuer. - `product_id` string: The issuer/card scheme product identifier. - `product_type` string: The issuer/card scheme product type. - `_links` GetFingerprintSessionLinks, required: The links related to the session - `self` object, required: The URI of the session - `href` string, required - `3ds` object: Provides additional information about the 3DS authentication experience. - `challenge_request` string: The CReq message, encoded in Base 64. - `interaction_counter` string: The number of authentication attempts performed by the cardholder. - `error_details` ErrorDetails: Provides additional information about the error returned. - `error_code` string: An error code identifying the type of issue. - `error_component` string: A code that specifies which 3D Secure component identified the error. - `error_detail` string: Provides additional details about the issue. - `error_description` string: A description of the issue identified. ## Other responses - `401`: Unauthorized - `403`: Forbidden - `404`: Session not found - `422`: Unprocessable channel information --- [API](https://skmtc.dev/checkout/apis/checkout-com-api-reference.md) - [All operations](https://skmtc.dev/checkout/apis/checkout-com-api-reference/llms.txt) - [OpenAPI document](https://skmtc.dev/checkout/apis/checkout-com-api-reference/revisions/0f1abdb1c3e9?raw)