---
title: "Create a Card Validation"
method: POST
path: "/v2.01/{ClientId}/cards/{CardId}/validation"
tags: ["cardValidations"]
---

# Create a Card Validation

`POST /v2.01/{ClientId}/cards/{CardId}/validation`

Create a Card Validation

## Path parameters

- `ClientId` string, required
- `CardId` string, required

## Headers

- `Authorization` string, required

## Request body

- CreateACardValidationRequest
  - `AuthorId` string, required — The unique identifier of the user at the source of the transaction.
  - `SecureModeReturnURL` string, required — Max. length: 255 characters The URL to which users are automatically returned after 3DS2 if it is triggered (i.e., if the `SecureModeNeeded` parameter is set to `true`).
  - `IpAddress` string, required — The IP address of the end user initiating the transaction, in IPV4 or IPV6 format.
  - `Tag` string — Max. length: 255 characters Custom data that you can add to this object.
  - `BrowserInfo` BrowserInfo, required — Information about the browser used by the end user (author) to perform the payment.
    - `AcceptHeader` string, required — The exact content of the HTTP accept headers as sent to the platform from the end user's browser.
    - `JavaEnabled` boolean, required — Whether or not the end user's browser has the ability to execute Java.
    - `Language` string, required — Format: Two-letter language code (ISO 639-1 alpha-2) followed by two-letter country code (ISO 3166-1 alpha-2), separated by a hyphen (example: `en-US`; pattern:`^[a-zA-Z]{2}(-[a-zA-Z]{2})?$`) The language of the browser.
    - `ColorDepth` integer, required — The value representing the depth of the screen's color palette for displaying images, in bits per pixel.
    - `ScreenHeight` integer, required — The height of the screen in pixels.
    - `ScreenWidth` integer, required — The width of the screen in pixels.
    - `TimeZoneOffset` integer, required — The difference in minutes between the browser's timezone and UTC.
    - `UserAgent` string, required — The exact content of the HTTP User-Agent header.
    - `JavascriptEnabled` boolean, required — Whether or not the end user's browser has the ability to execute JavaScript.
  - `PreferredCardNetwork` string — **Allowed values:** `VISA`, `MASTERCARD`, `CB`, `MAESTRO` The card network to use, as chosen by the cardholder, in case of <a href="/guides/payment-methods/card/co-branded">co-branded cards</a>.
  - `PaymentCategory` string — **Default value:** `ECommerce` **Allowed values:** `ECommerce`, `TelephoneOrder` The channel through which the user provided their card details, used to indicate mail-order and telephone-order (MOTO) payments: - `ECommerce` – Payment received online. - `TelephoneOrder` – Payment received via mail order or telephone order (MOTO).
  - `SecureMode` string — **Allowed values:** `DEFAULT`, `FORCE`, `NO_CHOICE` **Default value:** `DEFAULT` The mode applied for the <a href="/guides/payment-methods/card/3ds">3DS2 protocol</a> for CB, Visa, and Mastercard. The options are: - `DEFAULT` – Requests an exemption to strong customer authentication (SCA), and thus a frictionless payment experience, if allowed by your Mangopay contract and accepted by the issuer. - `FORCE` – Requests SCA. - `NO_CHOICE` – Leaves the choice to the issuer whether to allow for a frictionless payment experience or to enforce SCA. **Note:** Sending the FORCE value automatically sets the ValidationUsage value to MIT.
  - `ValidationUsage` string — **Default value:** MIT\ **Allowed values:** MIT, CIT Indicates the intended usage of the card: - CIT – For customer-initiated transactions (CITs), meaning 3DS is less likely to be required on the card validation. - MIT – For merchant-initiated transactions (MITs), meaning 3DS is more likely to be required on the card validation. _Note: The MIT value is returned automatically if the SecureMode value is FORCE, even if CIT is sent._
  - `ProfilingAttemptReference` string — The unique reference generated for the profiling session, used by the <a href="/guides/fraud-prevention">fraud prevention</a> solution to produce recommendations for the transaction using the profiling data. **Note:** Parameter not returned by the API. Profiling feature available on request – contact Mangopay <a href="https://hub.mangopay.com/" target="_blank">via the Dashboard</a> for more information.

## Response `200`

Success

- CardValidationResponse
  - `Id` string — Max length: 128 characters (see [data formats](/api-reference/overview/data-formats) for details) The unique identifier of the object.
  - `AuthorId` string — The unique identifier of the user at the source of the transaction.
  - `Status` string — **Returned values:** `CREATED`, `SUCCEEDED`, `FAILED` The status of the transaction.
  - `SecureModeReturnURL` string — Max. length: 255 characters The URL to which users are automatically returned after 3DS2 if it is triggered (i.e., if the `SecureModeNeeded` parameter is set to `true`).
  - `SecureModeRedirectURL` string — Max. length: 255 characters The URL to which to redirect the user to proceed to 3DS2 validation.
  - `SecureModeNeeded` boolean — Whether or not the `SecureMode` was used.
  - `IpAddress` string — The IP address of the end user initiating the transaction, in IPV4 or IPV6 format.
  - `BrowserInfo` BrowserInfo — Information about the browser used by the end user (author) to perform the payment.
    - `AcceptHeader` string, required — The exact content of the HTTP accept headers as sent to the platform from the end user's browser.
    - `JavaEnabled` boolean, required — Whether or not the end user's browser has the ability to execute Java.
    - `Language` string, required — Format: Two-letter language code (ISO 639-1 alpha-2) followed by two-letter country code (ISO 3166-1 alpha-2), separated by a hyphen (example: `en-US`; pattern:`^[a-zA-Z]{2}(-[a-zA-Z]{2})?$`) The language of the browser.
    - `ColorDepth` integer, required — The value representing the depth of the screen's color palette for displaying images, in bits per pixel.
    - `ScreenHeight` integer, required — The height of the screen in pixels.
    - `ScreenWidth` integer, required — The width of the screen in pixels.
    - `TimeZoneOffset` integer, required — The difference in minutes between the browser's timezone and UTC.
    - `UserAgent` string, required — The exact content of the HTTP User-Agent header.
    - `JavascriptEnabled` boolean, required — Whether or not the end user's browser has the ability to execute JavaScript.
  - `PreferredCardNetwork` string — **Allowed values:** `VISA`, `MASTERCARD`, `CB`, `MAESTRO` The card network to use, as chosen by the cardholder, in case of <a href="/guides/payment-methods/card/co-branded">co-branded cards</a>.
  - `PaymentCategory` string — **Default value:** `ECommerce` **Allowed values:** `ECommerce`, `TelephoneOrder` The channel through which the user provided their card details, used to indicate mail-order and telephone-order (MOTO) payments: - `ECommerce` – Payment received online. - `TelephoneOrder` – Payment received via mail order or telephone order (MOTO).
  - `SecureMode` string — **Default value:** DEFAULT\ **Allowed values:** DEFAULT, FORCE, NO_CHOICE The mode applied for the [3DS protocol](/guides/payment-methods/card/3ds) for CB, Visa, and Mastercard. The options are: - `DEFAULT` – Requests an exemption to strong customer authentication (SCA), and thus a frictionless payment experience, if allowed by your Mangopay contract and accepted by the issuer. - `FORCE` – Requests SCA. - `NO_CHOICE` – Leaves the choice to the issuer whether to allow for a frictionless payment experience or to enforce SCA. _Note: Sending the FORCE value automatically sets the ValidationUsage value to MIT._
  - `ValidationUsage` string — **Default value:** MIT\ **Allowed values:** MIT, CIT Indicates the intended usage of the card: - CIT – For customer-initiated transactions (CITs), meaning 3DS is less likely to be required on the card validation. - MIT – For merchant-initiated transactions (MITs), meaning 3DS is more likely to be required on the card validation. _Note: The MIT value is returned automatically if the SecureMode value is FORCE, even if CIT is sent._
  - `Validity` string — **Returned values:** `UNKNOWN`, `VALID`, `INVALID` Whether the card is valid or not. - `UNKNOWN` – No payment or card validation has been processed, so the validity of the card remains unknown. - `VALID` – The first payment or card validation using the card was processed successfully within 24 hours of the initial card registration. - `INVALID` – The first payment or card validation using the card was attempted and failed, or the status of the corresponding card registration was `CREATED` for more than 24 hours. Once a card is set to `INVALID`, it cannot be set back to `VALID`. A new card registration will be necessary to make a payment.
  - `CreationDate` integer — Unix timestamp (UTC) of the date and time the object was created.
  - `Type` string — **Returned values:** `CARD_VALIDATION` The type of the card validation.
  - `Applied3DSVersion` string — **Returned values:** `V1`, `V2_1` The 3DS protocol version applied to the transaction.
  - `ResultCode` string — The code indicating the result of the operation. This information is mostly used to <a href="/errors/codes">handle errors</a> or for filtering purposes.
  - `ResultMessage` string — The explanation of the result code.
  - `Tag` string — Max. length: 255 characters Custom data that you can add to this object.
  - `CardInfo` CardInfo — Information about the card used for the transaction. If the information or data is not available, `null` is returned.
    - `BIN` string — The bank identification number (BIN) of the card.
    - `IssuingBank` string — The name of the bank that issued the card.
    - `IssuerCountryCode` string — The country code of the card issuer.
    - `Type` string — The type of card (for example, `CREDIT` or `DEBIT`).
    - `SubType` string, nullable — The sub-type of the card, if available.
    - `Brand` string — The card brand (for example, `VISA` or `MASTERCARD`).
  - `AuthenticationResult` AuthenticationResult — Information about the authentication result, based on the request made by Mangopay and the decision of the issuer regarding the type of authentication to be enforced (if applicable).
    - `AuthenticationType` string, nullable — **Returned values:** `CHALLENGE`, `FRICTIONLESS`, `DIRECT_AUTHORIZATION` The type of authentication: - `CHALLENGE` – The issuer requested SCA to be enforced (for example, using 3DS). - `FRICTIONLESS` – The transaction was exempted from SCA because an exemption was granted by the issuer. - `DIRECT_AUTHORIZATION` – The transaction was sent to the issuer for authorization without any frictionless or challenge (for example, if SCA doesn't apply). A `null` value typically indicates that authentication was not requested (for example, because the request failed before being sent) or a decision was not received. A `null` value typically indicates that authentication was not requested (for example, because the request failed before being sent) or a decision was not received.

## Other responses

- `400` — Bad Request

---

[API](https://skmtc.dev/mangopay/apis/api-reference.md) · [All operations](https://skmtc.dev/mangopay/apis/api-reference/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/mangopay/api-reference/revisions/fafbd0c69654/schema)