--- title: "Create 3DS Authentication" method: POST path: "/3ds" tags: ["3DS Authentication"] --- # Create 3DS Authentication `POST /3ds` ## Request - Base URL: `https://eu-west-1.api.silverflow.com/v1` - URL: `https://eu-west-1.api.silverflow.com/v1/3ds` - Auth: one of: - HTTP basic - HTTP bearer - TypeScript: (a function with typed inputs; its response is checked against the schema) Create a new 3DS authentication. This endpoint can potentially trigger a 3DS challenge flow. Requires the `threeDs:Create` permission. Diners support is EXPERIMENTAL. Standalone merchant info (`merchantInfo`) is EXPERIMENTAL. ## Request body - union - PublicCreate3dsRequestWithMerchantAcceptor - `merchantAcceptorKey` string, required: Uniquely identifies a merchant acceptor. - `card` union, required: This field represents the card. The card credentials can either be passed directly in the request or be referenced using a `key`. - InputCard: Card data - `number` string, password, required: Full digits of the card or network token. - `expiryMonth` integer, required: The month the card or network token expires. January is 1 - `expiryYear` integer, required: The year the card or network token expires including the century - `cvc` string: The CVC of the card - `holderName` string: The name of the cardholder as displayed on the card. It will be truncated if longer than 45 characters. The name needs to comply with the following regular expression: `^[\x20-\x7E\u00C0-\u00D6\u00D8-\u00F6\u00F8-\u00FF]+$` More information here: [Cardholder name restrictions](charges.html#section/Appendix-A-Cardholder-Name-Restrictions) - CardByProcessorTokenKey - `processorTokenKey` string, required: The key to a card stored using [Processor Tokenization](#tag/Processor-Tokenization). - `cvc` string: The CVC of the card - `type` ThreeDsType, required: Describes the kind of transaction the merchant wants to submit. - `intent` 'purchase' | 'reservation' | 'account-status' | 'payout' | 'payout-status' | 'funding' | 'advice' | 'refund', required: The intention of the cardholder. - `cardEntry` 'e-commerce' | 'card-on-file' | 'token' | 'token-on-file': The method used to capture the card details. **From February 22, 2027 this field will be removed since it has no effect on the 3DS authentication.** - `order` 'checkout' | 'unspecified' | 'one-click' | 'recurring' | 'ucof' | 'installment' | 'standing-order', required: The method used to place the order. When set to `recurring`, `installment`, or `standing-order`, you are also required to set `recurringExpiry` and `recurringFrequency`. - `amount` Amount, required: An amount encoded as an object with a `value` in minor units and a `currency` code. - `value` integer, required: The amount in minor units. For example `$12.34` should be encoded as `1234`. Note that not all currencies have 2 minor units. Some have three or zero. - `currency` string, required - `challengeIndicator` 'no-preference' | 'no-challenge' | 'challenge-preferred' | 'challenge-mandated' | 'no-challenge-tra' | 'no-challenge-low-value' | 'no-challenge-scp' | 'data-only': When set, indicates the preferred 3DS challenge flow as follows: - `no-preference`: No preference related to the challenge flow. - `no-challenge`: No challenge flow requested. - `challenge-preferred`: Preferably a challenge flow takes place. - `challenge-mandated`: The challenge flow must take place. - `no-challenge-tra`: No challenge requested as transaction risk analysis is already performed. - `no-challenge-low-value`: No challenge requested as low value exemption is applied. This exemption is only applicable for Mastercard. - `no-challenge-scp`: No challenge requested as the secure corporate payment exemption is applied. This exemption is only applicable for Mastercard and Visa. - `data-only`: For data sharing purposes only and therefore will never trigger a challenge flow. - `authenticationContext` AuthenticationContext, required: Contains data that the issuer needs to perform the fingerprinting, but also optional configuration settings. - `notificationUrl` string, required: URL that receives the challenge response (CRes) or error message from the issuer's Access Control Server (ACS). - `browserData` union, required: Information about the browser that is performing the transaction. This data is used by the issuer to perform fingerprinting. - object - `acceptHeader` string, required: Exact content of the HTTP accept headers as sent to the 3DS Requestor from the cardholder's browser. - `language` string, required: Value representing the browser language as defined in IETF BCP47. Returned from `navigator.language` property from the HTML DOM API. - `userAgent` string, required: Exact content of the HTTP user-agent header. - `browserIP` string: IP address of the browser as returned by the HTTP headers. Shall be included where regionally acceptable. Example IPv6 address: 2011:0db8:85a3:0101:0101:8a2e:0370:7334. - `javascriptEnabled` true, required: The ability of the cardholder browser to execute JavaScript. - `screenWidth` string, required: Total width of the cardholder's screen in pixels. Value is returned from the `screen.width` property from the HTML DOM API. - `screenHeight` string, required: Total height of the cardholder's screen in pixels. Value is returned from the `screen.height` property from the HTML DOM API. - `timeZoneOffset` string, required: Time-zone offset in minutes between UTC and the cardholder browser local time. Value is returned from the `getTimezoneOffset()` method. Note that the offset is positive if the local time zone is behind UTC and negative if it is ahead. Example: If UTC -5 hours: 300 -> +300, if UTC +5 hours: -> -300 - `javaEnabled` boolean, required: The ability of the cardholder browser to execute Java. Value is returned from the `navigator.javaEnabled` property from the HTML DOM API. - `colorDepth` string, required: Value representing the bit depth of the colour palette for displaying images, in bits per pixel. Obtained from cardholder browser using the `screen.colorDepth` property. Values defined by the EMVCo specification: 1, 4, 8, 15, 16, 24, 32, 48 - object - `acceptHeader` string, required: Exact content of the HTTP accept headers as sent to the 3DS Requestor from the cardholder's browser. - `language` string, required: Value representing the browser language as defined in IETF BCP47. Returned from `navigator.language` property from the HTML DOM API. - `userAgent` string, required: Exact content of the HTTP user-agent header. - `browserIP` string: IP address of the browser as returned by the HTTP headers. Shall be included where regionally acceptable. Example IPv6 address: 2011:0db8:85a3:0101:0101:8a2e:0370:7334. - `javascriptEnabled` false, required: The ability of the cardholder browser to execute JavaScript. - `screenWidth` string: Total width of the cardholder's screen in pixels. Value is returned from the `screen.width` property from the HTML DOM API. - `screenHeight` string: Total height of the cardholder's screen in pixels. Value is returned from the `screen.height` property from the HTML DOM API. - `timeZoneOffset` string: Time-zone offset in minutes between UTC and the cardholder browser local time. Value is returned from the `getTimezoneOffset()` method. Note that the offset is positive if the local time zone is behind UTC and negative if it is ahead. Example: If UTC -5 hours: 300 -> +300, if UTC +5 hours: -> -300 - `javaEnabled` boolean: The ability of the cardholder browser to execute Java. Value is returned from the `navigator.javaEnabled` property from the HTML DOM API. - `colorDepth` string: Value representing the bit depth of the colour palette for displaying images, in bits per pixel. Obtained from cardholder browser using the `screen.colorDepth` property. Values defined by the EMVCo specification: 1, 4, 8, 15, 16, 24, 32, 48 - `transactionReference` string: Unique ID assigned by the merchant or payment service provider for the transaction. Used to identify the transaction. - `localTransactionDateTime` string, iso-8601-date-time: Date and time of the transaction in the local timezone. - `recurringExpiry` string, date: The date at which the recurring authorization expires. Format: YYYY-MM-DD. Required when `type.order` is `recurring`, `installment`, or `standing-order`. - `recurringFrequency` integer: Number of days between recurring authorizations. Required when `type.order` is `recurring`, `installment`, or `standing-order`. - `installmentTerms` integer: Maximum number of authorizations for an installment payment. Required for and only allowed when `type.order` is `installment`. Must be greater than 1 and at most 3 digits (max value 999). - `dynamicDescriptor` DynamicDescriptor: Allows customizing the DBA name on a per-transaction basis, to help the cardholder recognize the business name on their card or bank statement. - `merchantName` string: Recognizable business name that will appear on the customer's card or bank statement. - `cardholderInformation` CardholderInformation: Extra information about the cardholder. - `email` string: The email address associated with the cardholder account. This address is either entered by the cardholder or is on file with the 3DS Requester. - `phone` object: Phone numbers associated with the account. They follow the [ITU-E.164 standard](https://en.wikipedia.org/wiki/E.164). - `work` PhoneNumber - `countryCode` string, required: Country code should be between 1 to 3 digits, more information [here](https://en.wikipedia.org/wiki/E.164). - `number` string, required: Phone number should be between 1 and 15 digits, more information [here](https://en.wikipedia.org/wiki/E.164). - `mobile` PhoneNumber - `countryCode` string, required: Country code should be between 1 to 3 digits, more information [here](https://en.wikipedia.org/wiki/E.164). - `number` string, required: Phone number should be between 1 and 15 digits, more information [here](https://en.wikipedia.org/wiki/E.164). - `home` PhoneNumber - `countryCode` string, required: Country code should be between 1 to 3 digits, more information [here](https://en.wikipedia.org/wiki/E.164). - `number` string, required: Phone number should be between 1 and 15 digits, more information [here](https://en.wikipedia.org/wiki/E.164). - `threeDSServerTransID` string: Universally unique transaction identifier assigned by the 3DS server to identify a single transaction. This identifier is assigned by Silverflow. - `billingAddress` AddressInput: A physical postal address - `countryCode` union, required: ISO 3166-1 country code - object - `alpha3` string, required: ISO 3166-1 alpha-3 country code - object - `alpha2` string, required: ISO 3166-1 alpha-2 country code - object - `numeric` string, required: ISO 3166-1 numeric country code - `stateOrProvince` string: The state (US) or province (non-US) of the address. - `city` string, required: The city of the address. - `line1` string, required: Address line 1 - `line2` string: Address line 2 - `postalCode` string, required: The postal code of the address, allowing spaces and dashes - `shippingAddress` AddressInput: A physical postal address - `countryCode` union, required: ISO 3166-1 country code - object - `alpha3` string, required: ISO 3166-1 alpha-3 country code - object - `alpha2` string, required: ISO 3166-1 alpha-2 country code - object - `numeric` string, required: ISO 3166-1 numeric country code - `stateOrProvince` string: The state (US) or province (non-US) of the address. - `city` string, required: The city of the address. - `line1` string, required: Address line 1 - `line2` string: Address line 2 - `postalCode` string, required: The postal code of the address, allowing spaces and dashes - PublicCreate3dsRequestWithMerchantInfo - `merchantInfo` MerchantInfoRequest, required: Merchant details provided directly in the request, as an alternative to providing a `merchantAcceptorKey`. - `acquirerBin` string: 6-11 digit Bank Identification Number assigned by the card network. Required for all card networks except AMEX. For AMEX populate this with the SE Number or leave blank depending on the model, see [3DS Guide](https://docs.silverflow.com/guides/3d-secure#tag/Supporting-Different-AMEX-Models). - `merchantId` string, required: Merchant identifier (MID) assigned by the acquirer. For AMEX populate this with the Seller ID or SE Number depending on the model, see [3DS Guide](https://docs.silverflow.com/guides/3d-secure#tag/Supporting-Different-AMEX-Models). - `mcc` string, required: 4-digit ISO 18245 merchant category code - `merchantName` string, required: Merchant's doing-business-as name - `merchantCountryCode` union, required: ISO 3166-1 country code. Can be provided in alpha-2, alpha-3, or numeric format - SchemasCountryCodeAlpha3 - `alpha3` string, required: ISO 3166-1 alpha-3 country code - SchemasCountryCodeAlpha2 - `alpha2` string, required: ISO 3166-1 alpha-2 country code - SchemasCountryCodeNumeric - `numeric` string, required: ISO 3166-1 numeric country code - `websiteUrl` string, required: Merchant's website URL - `network` 'american-express' | 'bancontact' | 'diners' | 'mastercard' | 'visa', required: The card network to query for PAN information. Diners support is EXPERIMENTAL. - `card` union, required: This field represents the card. The card credentials can either be passed directly in the request or be referenced using a `key`. - InputCard: Card data - `number` string, password, required: Full digits of the card or network token. - `expiryMonth` integer, required: The month the card or network token expires. January is 1 - `expiryYear` integer, required: The year the card or network token expires including the century - `cvc` string: The CVC of the card - `holderName` string: The name of the cardholder as displayed on the card. It will be truncated if longer than 45 characters. The name needs to comply with the following regular expression: `^[\x20-\x7E\u00C0-\u00D6\u00D8-\u00F6\u00F8-\u00FF]+$` More information here: [Cardholder name restrictions](charges.html#section/Appendix-A-Cardholder-Name-Restrictions) - CardByProcessorTokenKey - `processorTokenKey` string, required: The key to a card stored using [Processor Tokenization](#tag/Processor-Tokenization). - `cvc` string: The CVC of the card - `type` ThreeDsType, required: Describes the kind of transaction the merchant wants to submit. - `intent` 'purchase' | 'reservation' | 'account-status' | 'payout' | 'payout-status' | 'funding' | 'advice' | 'refund', required: The intention of the cardholder. - `cardEntry` 'e-commerce' | 'card-on-file' | 'token' | 'token-on-file': The method used to capture the card details. **From February 22, 2027 this field will be removed since it has no effect on the 3DS authentication.** - `order` 'checkout' | 'unspecified' | 'one-click' | 'recurring' | 'ucof' | 'installment' | 'standing-order', required: The method used to place the order. When set to `recurring`, `installment`, or `standing-order`, you are also required to set `recurringExpiry` and `recurringFrequency`. - `amount` Amount, required: An amount encoded as an object with a `value` in minor units and a `currency` code. - `value` integer, required: The amount in minor units. For example `$12.34` should be encoded as `1234`. Note that not all currencies have 2 minor units. Some have three or zero. - `currency` string, required - `challengeIndicator` 'no-preference' | 'no-challenge' | 'challenge-preferred' | 'challenge-mandated' | 'no-challenge-tra' | 'no-challenge-low-value' | 'no-challenge-scp' | 'data-only': When set, indicates the preferred 3DS challenge flow as follows: - `no-preference`: No preference related to the challenge flow. - `no-challenge`: No challenge flow requested. - `challenge-preferred`: Preferably a challenge flow takes place. - `challenge-mandated`: The challenge flow must take place. - `no-challenge-tra`: No challenge requested as transaction risk analysis is already performed. - `no-challenge-low-value`: No challenge requested as low value exemption is applied. This exemption is only applicable for Mastercard. - `no-challenge-scp`: No challenge requested as the secure corporate payment exemption is applied. This exemption is only applicable for Mastercard and Visa. - `data-only`: For data sharing purposes only and therefore will never trigger a challenge flow. - `authenticationContext` AuthenticationContext, required: Contains data that the issuer needs to perform the fingerprinting, but also optional configuration settings. - `notificationUrl` string, required: URL that receives the challenge response (CRes) or error message from the issuer's Access Control Server (ACS). - `browserData` union, required: Information about the browser that is performing the transaction. This data is used by the issuer to perform fingerprinting. - object - `acceptHeader` string, required: Exact content of the HTTP accept headers as sent to the 3DS Requestor from the cardholder's browser. - `language` string, required: Value representing the browser language as defined in IETF BCP47. Returned from `navigator.language` property from the HTML DOM API. - `userAgent` string, required: Exact content of the HTTP user-agent header. - `browserIP` string: IP address of the browser as returned by the HTTP headers. Shall be included where regionally acceptable. Example IPv6 address: 2011:0db8:85a3:0101:0101:8a2e:0370:7334. - `javascriptEnabled` true, required: The ability of the cardholder browser to execute JavaScript. - `screenWidth` string, required: Total width of the cardholder's screen in pixels. Value is returned from the `screen.width` property from the HTML DOM API. - `screenHeight` string, required: Total height of the cardholder's screen in pixels. Value is returned from the `screen.height` property from the HTML DOM API. - `timeZoneOffset` string, required: Time-zone offset in minutes between UTC and the cardholder browser local time. Value is returned from the `getTimezoneOffset()` method. Note that the offset is positive if the local time zone is behind UTC and negative if it is ahead. Example: If UTC -5 hours: 300 -> +300, if UTC +5 hours: -> -300 - `javaEnabled` boolean, required: The ability of the cardholder browser to execute Java. Value is returned from the `navigator.javaEnabled` property from the HTML DOM API. - `colorDepth` string, required: Value representing the bit depth of the colour palette for displaying images, in bits per pixel. Obtained from cardholder browser using the `screen.colorDepth` property. Values defined by the EMVCo specification: 1, 4, 8, 15, 16, 24, 32, 48 - object - `acceptHeader` string, required: Exact content of the HTTP accept headers as sent to the 3DS Requestor from the cardholder's browser. - `language` string, required: Value representing the browser language as defined in IETF BCP47. Returned from `navigator.language` property from the HTML DOM API. - `userAgent` string, required: Exact content of the HTTP user-agent header. - `browserIP` string: IP address of the browser as returned by the HTTP headers. Shall be included where regionally acceptable. Example IPv6 address: 2011:0db8:85a3:0101:0101:8a2e:0370:7334. - `javascriptEnabled` false, required: The ability of the cardholder browser to execute JavaScript. - `screenWidth` string: Total width of the cardholder's screen in pixels. Value is returned from the `screen.width` property from the HTML DOM API. - `screenHeight` string: Total height of the cardholder's screen in pixels. Value is returned from the `screen.height` property from the HTML DOM API. - `timeZoneOffset` string: Time-zone offset in minutes between UTC and the cardholder browser local time. Value is returned from the `getTimezoneOffset()` method. Note that the offset is positive if the local time zone is behind UTC and negative if it is ahead. Example: If UTC -5 hours: 300 -> +300, if UTC +5 hours: -> -300 - `javaEnabled` boolean: The ability of the cardholder browser to execute Java. Value is returned from the `navigator.javaEnabled` property from the HTML DOM API. - `colorDepth` string: Value representing the bit depth of the colour palette for displaying images, in bits per pixel. Obtained from cardholder browser using the `screen.colorDepth` property. Values defined by the EMVCo specification: 1, 4, 8, 15, 16, 24, 32, 48 - `transactionReference` string: Unique ID assigned by the merchant or payment service provider for the transaction. Used to identify the transaction. - `localTransactionDateTime` string, iso-8601-date-time: Date and time of the transaction in the local timezone. - `recurringExpiry` string, date: The date at which the recurring authorization expires. Format: YYYY-MM-DD. Required when `type.order` is `recurring`, `installment`, or `standing-order`. - `recurringFrequency` integer: Number of days between recurring authorizations. Required when `type.order` is `recurring`, `installment`, or `standing-order`. - `installmentTerms` integer: Maximum number of authorizations for an installment payment. Required for and only allowed when `type.order` is `installment`. Must be greater than 1 and at most 3 digits (max value 999). - `dynamicDescriptor` DynamicDescriptor: Allows customizing the DBA name on a per-transaction basis, to help the cardholder recognize the business name on their card or bank statement. - `merchantName` string: Recognizable business name that will appear on the customer's card or bank statement. - `cardholderInformation` CardholderInformation: Extra information about the cardholder. - `email` string: The email address associated with the cardholder account. This address is either entered by the cardholder or is on file with the 3DS Requester. - `phone` object: Phone numbers associated with the account. They follow the [ITU-E.164 standard](https://en.wikipedia.org/wiki/E.164). - `work` PhoneNumber - `countryCode` string, required: Country code should be between 1 to 3 digits, more information [here](https://en.wikipedia.org/wiki/E.164). - `number` string, required: Phone number should be between 1 and 15 digits, more information [here](https://en.wikipedia.org/wiki/E.164). - `mobile` PhoneNumber - `countryCode` string, required: Country code should be between 1 to 3 digits, more information [here](https://en.wikipedia.org/wiki/E.164). - `number` string, required: Phone number should be between 1 and 15 digits, more information [here](https://en.wikipedia.org/wiki/E.164). - `home` PhoneNumber - `countryCode` string, required: Country code should be between 1 to 3 digits, more information [here](https://en.wikipedia.org/wiki/E.164). - `number` string, required: Phone number should be between 1 and 15 digits, more information [here](https://en.wikipedia.org/wiki/E.164). - `threeDSServerTransID` string: Universally unique transaction identifier assigned by the 3DS server to identify a single transaction. This identifier is assigned by Silverflow. - `billingAddress` AddressInput: A physical postal address - `countryCode` union, required: ISO 3166-1 country code - object - `alpha3` string, required: ISO 3166-1 alpha-3 country code - object - `alpha2` string, required: ISO 3166-1 alpha-2 country code - object - `numeric` string, required: ISO 3166-1 numeric country code - `stateOrProvince` string: The state (US) or province (non-US) of the address. - `city` string, required: The city of the address. - `line1` string, required: Address line 1 - `line2` string: Address line 2 - `postalCode` string, required: The postal code of the address, allowing spaces and dashes - `shippingAddress` AddressInput: A physical postal address - `countryCode` union, required: ISO 3166-1 country code - object - `alpha3` string, required: ISO 3166-1 alpha-3 country code - object - `alpha2` string, required: ISO 3166-1 alpha-2 country code - object - `numeric` string, required: ISO 3166-1 numeric country code - `stateOrProvince` string: The state (US) or province (non-US) of the address. - `city` string, required: The city of the address. - `line1` string, required: Address line 1 - `line2` string: Address line 2 - `postalCode` string, required: The postal code of the address, allowing spaces and dashes ## Response `201` The 3DS authentication entity - union - ThreeDsFrictionlessAuthenticated - `key` string, required: Uniquely identifies a 3DS authentication. - `merchantAcceptorRef` SchemasAcceptorRef: Reference key and status of the acceptor - `key` string, required: Uniquely identifies a merchant acceptor. - `version` integer, required: The version of this object - `merchantInfo` MerchantInfoResponse: Merchant details as stored and returned in the response. The `merchantCountryCode` is returned as a complete ISO 3166-1 country code object containing all representations. - `acquirerBin` string: 6-11 digit Bank Identification Number assigned by the card network. Required for all card networks except AMEX. - `merchantId` string, required: Merchant identifier (MID) assigned by the acquirer. - `mcc` string, required: 4-digit ISO 18245 merchant category code - `merchantName` string, required: Merchant's doing-business-as name - `merchantCountryCode` object, required - `alpha3` string, required: ISO 3166-1 alpha-3 country code - `alpha2` string, required: ISO 3166-1 alpha-2 country code - `numeric` string, required: ISO 3166-1 numeric country code - `websiteUrl` string, required: Merchant's website URL - `network` 'american-express' | 'bancontact' | 'diners' | 'mastercard' | 'visa', required: The card network to query for PAN information. Diners support is EXPERIMENTAL. - `amount` union, required: An amount encoded as an object with a `value` in minor units and a `currency` code. The amount is unknown for entities older than 2023-03-30. - Amount: An amount encoded as an object with a `value` in minor units and a `currency` code. - `value` integer, required: The amount in minor units. For example `$12.34` should be encoded as `1234`. Note that not all currencies have 2 minor units. Some have three or zero. - `currency` string, required - UnknownAmount - `value` -1, required: The value of the amount is unknown. - `currency` 'unknown', required: The currency code is unknown. - `network` 'american-express' | 'bancontact' | 'diners' | 'mastercard' | 'visa' | 'unknown', required: The card network that was used for the authentication. It is `unknown` for entities older than 2024-04-11. - `protocolVersion` '2.1.0' | '2.2.0', required: The 3DS protocol version which has been used to perform 3DS. **Protocol version 2.1.0 is no longer supported by the card networks. The value 2.1.0 can be retrieved for older authentications.** - `deviceChannel` 'browser' | 'app' | '3ri', required: Indicates the type of the interface used to initiate the transaction. - `flow` 'frictionless', required: Indicates the flow that was used for the 3DS authentication. - `result` 'authenticated', required: Authentication result. - `ares` ARes, required: A 3DS protocol message as it is received by the card network. Note: `threeDSServerTransID` is present in all message types except `Erro` (ErrorMessage), where it is conditional per the EMVCo spec. - `messageVersion` '2.2.0', required: The 3DS protocol version which has been used to perform 3DS. **Protocol version 2.1.0 is no longer supported by the card networks. The value 2.1.0 can be retrieved for older authentications.** - `sdkTransID` string, uuid: Universally unique transaction identifier assigned upon the activation of 3DS SDK. - `messageExtension` MessageExtension[]: Carries additional data that is not defined within the 3DS protocol. This field is usually used for card network specific data. - `name` string, required - `id` string, required - `criticalityIndicator` boolean, required - `data` unknown, required - `messageType` 'ARes', required - `dsTransID` string, uuid, required: Universally unique transaction identifier assigned by the DS to identify a single transaction. - `acsTransID` string, uuid, required: Universally unique transaction identifier assigned by the ACS to identify a single transaction. Each DS can provide a unique ID to each ACS on an individual basis. - `transStatus` 'Y' | 'N' | 'U' | 'A' | 'C' | 'D' | 'R' | 'I', required: Indicates whether a transaction qualifies as an authenticated transaction or account verification. - `transStatusReason` string: Provides information on why the `transStatus` field has the specified value. - `threeDSServerTransID` string, required: Universally unique transaction identifier assigned by the 3DS server to identify a single transaction. This identifier is assigned by Silverflow. - `cardholderInfo` string: Text provided by the ACS/issuer to cardholder during a frictionless or decoupled transaction. - `acsChallengeMandated` string: Indication of whether a challenge is required for the transaction to be authorized due to local/regional mandates or other variable. - `dsReferenceNumber` string, required: EMVCo-assigned unique identifier to track approved DS. - `acsReferenceNumber` string, required: Unique identifier assigned by the EMVCo secretariat upon testing and approval. - `acsOperatorID` string: DS assigned ACS identifier. - `acsDecConInd` string: Indicates whether the ACS confirms utilisation of decoupled authentication and agrees to utilize decoupled authentication to authenticate the cardholder. - `acsRenderingType` AcsRenderingType: The ACS rendering type contains information about the rendering type that the ACS is sending for the cardholder authentication. - `acsInterface` string, required: This is the ACS interface that the challenge will present to the cardholder. - `acsUiTemplate` string, required: Identifies the UI template format that the ACS first presents to the consumer. - `acsURL` string: The merchant or PSP needs to send the base64 encoded CReq message as a form to this URL using an HTTP POST, from the cardholder challenge window. The content type needs to be `application/x-www-form-urlencoded`. - `authenticationType` string: Indicates the type of authentication method the issuer will use to challenge the cardholder, whether in the ARes message or what was used by the ACS when in the RReq message. - `eci` string: Payment system-specific value provided by the ACS or DS to indicate the results of the attempt to authenticate the Cardholder. - `whiteListStatus` string: Enables the communication of trusted beneficiary/whitelist status between the ACS, the DS and the 3DS requestor. - `whiteListStatusSource` string: This data element will be populated by the system setting Whitelist Status. Required if Whitelist Status is present. - `acsSignedContent` string: Contains the JWS object (represented as a string) created by the ACS for the ARes message. - `authenticationValue` string: The result value from the 3DS transaction received from the ACS. This value is no longer present on responses after 45 days have passed after the authentication. Note that Mastercard and Visa use a different underlying format. This property will only be present in the ARes if `transStatus` is `Y`, `A` and conditionally (by DS rules) `I`. - `transactionReference` string: Unique ID assigned by the merchant or payment service provider for the transaction. Used to identify the transaction. - `fraudLiability` 'acquirer' | 'issuer': Which party is liable in case of fraud. - `type` object: Transaction type information from the request - `order` 'checkout' | 'unspecified' | 'one-click' | 'recurring' | 'ucof' | 'installment' | 'standing-order': The method used to place the order. When set to `recurring`, `installment`, or `standing-order`, you are also required to set `recurringExpiry` and `recurringFrequency`. - `intent` 'purchase' | 'reservation' | 'account-status' | 'payout' | 'payout-status' | 'funding' | 'advice' | 'refund': The intention of the cardholder. - `created` string, iso-8601-date-time, required: The date and time this object was created - `version` integer, required: The version of this object - ThreeDsChallenge - `key` string, required: Uniquely identifies a 3DS authentication. - `merchantAcceptorRef` SchemasAcceptorRef: Reference key and status of the acceptor - `key` string, required: Uniquely identifies a merchant acceptor. - `version` integer, required: The version of this object - `merchantInfo` MerchantInfoResponse: Merchant details as stored and returned in the response. The `merchantCountryCode` is returned as a complete ISO 3166-1 country code object containing all representations. - `acquirerBin` string: 6-11 digit Bank Identification Number assigned by the card network. Required for all card networks except AMEX. - `merchantId` string, required: Merchant identifier (MID) assigned by the acquirer. - `mcc` string, required: 4-digit ISO 18245 merchant category code - `merchantName` string, required: Merchant's doing-business-as name - `merchantCountryCode` object, required - `alpha3` string, required: ISO 3166-1 alpha-3 country code - `alpha2` string, required: ISO 3166-1 alpha-2 country code - `numeric` string, required: ISO 3166-1 numeric country code - `websiteUrl` string, required: Merchant's website URL - `network` 'american-express' | 'bancontact' | 'diners' | 'mastercard' | 'visa', required: The card network to query for PAN information. Diners support is EXPERIMENTAL. - `amount` union, required: An amount encoded as an object with a `value` in minor units and a `currency` code. The amount is unknown for entities older than 2023-03-30. - Amount: An amount encoded as an object with a `value` in minor units and a `currency` code. - `value` integer, required: The amount in minor units. For example `$12.34` should be encoded as `1234`. Note that not all currencies have 2 minor units. Some have three or zero. - `currency` string, required - UnknownAmount - `value` -1, required: The value of the amount is unknown. - `currency` 'unknown', required: The currency code is unknown. - `network` 'american-express' | 'bancontact' | 'diners' | 'mastercard' | 'visa' | 'unknown', required: The card network that was used for the authentication. It is `unknown` for entities older than 2024-04-11. - `protocolVersion` '2.1.0' | '2.2.0', required: The 3DS protocol version which has been used to perform 3DS. **Protocol version 2.1.0 is no longer supported by the card networks. The value 2.1.0 can be retrieved for older authentications.** - `deviceChannel` 'browser' | 'app' | '3ri', required: Indicates the type of the interface used to initiate the transaction. - `flow` 'challenge', required: Indicates the flow that was used for the 3DS authentication. - `result` 'challenge', required: Authentication result. - `ares` ARes, required: A 3DS protocol message as it is received by the card network. Note: `threeDSServerTransID` is present in all message types except `Erro` (ErrorMessage), where it is conditional per the EMVCo spec. - `messageVersion` '2.2.0', required: The 3DS protocol version which has been used to perform 3DS. **Protocol version 2.1.0 is no longer supported by the card networks. The value 2.1.0 can be retrieved for older authentications.** - `sdkTransID` string, uuid: Universally unique transaction identifier assigned upon the activation of 3DS SDK. - `messageExtension` MessageExtension[]: Carries additional data that is not defined within the 3DS protocol. This field is usually used for card network specific data. - `name` string, required - `id` string, required - `criticalityIndicator` boolean, required - `data` unknown, required - `messageType` 'ARes', required - `dsTransID` string, uuid, required: Universally unique transaction identifier assigned by the DS to identify a single transaction. - `acsTransID` string, uuid, required: Universally unique transaction identifier assigned by the ACS to identify a single transaction. Each DS can provide a unique ID to each ACS on an individual basis. - `transStatus` 'Y' | 'N' | 'U' | 'A' | 'C' | 'D' | 'R' | 'I', required: Indicates whether a transaction qualifies as an authenticated transaction or account verification. - `transStatusReason` string: Provides information on why the `transStatus` field has the specified value. - `threeDSServerTransID` string, required: Universally unique transaction identifier assigned by the 3DS server to identify a single transaction. This identifier is assigned by Silverflow. - `cardholderInfo` string: Text provided by the ACS/issuer to cardholder during a frictionless or decoupled transaction. - `acsChallengeMandated` string: Indication of whether a challenge is required for the transaction to be authorized due to local/regional mandates or other variable. - `dsReferenceNumber` string, required: EMVCo-assigned unique identifier to track approved DS. - `acsReferenceNumber` string, required: Unique identifier assigned by the EMVCo secretariat upon testing and approval. - `acsOperatorID` string: DS assigned ACS identifier. - `acsDecConInd` string: Indicates whether the ACS confirms utilisation of decoupled authentication and agrees to utilize decoupled authentication to authenticate the cardholder. - `acsRenderingType` AcsRenderingType: The ACS rendering type contains information about the rendering type that the ACS is sending for the cardholder authentication. - `acsInterface` string, required: This is the ACS interface that the challenge will present to the cardholder. - `acsUiTemplate` string, required: Identifies the UI template format that the ACS first presents to the consumer. - `acsURL` string: The merchant or PSP needs to send the base64 encoded CReq message as a form to this URL using an HTTP POST, from the cardholder challenge window. The content type needs to be `application/x-www-form-urlencoded`. - `authenticationType` string: Indicates the type of authentication method the issuer will use to challenge the cardholder, whether in the ARes message or what was used by the ACS when in the RReq message. - `eci` string: Payment system-specific value provided by the ACS or DS to indicate the results of the attempt to authenticate the Cardholder. - `whiteListStatus` string: Enables the communication of trusted beneficiary/whitelist status between the ACS, the DS and the 3DS requestor. - `whiteListStatusSource` string: This data element will be populated by the system setting Whitelist Status. Required if Whitelist Status is present. - `acsSignedContent` string: Contains the JWS object (represented as a string) created by the ACS for the ARes message. - `authenticationValue` string: The result value from the 3DS transaction received from the ACS. This value is no longer present on responses after 45 days have passed after the authentication. Note that Mastercard and Visa use a different underlying format. This property will only be present in the ARes if `transStatus` is `Y`, `A` and conditionally (by DS rules) `I`. - `transactionReference` string: Unique ID assigned by the merchant or payment service provider for the transaction. Used to identify the transaction. - `type` object: Transaction type information from the request - `order` 'checkout' | 'unspecified' | 'one-click' | 'recurring' | 'ucof' | 'installment' | 'standing-order': The method used to place the order. When set to `recurring`, `installment`, or `standing-order`, you are also required to set `recurringExpiry` and `recurringFrequency`. - `intent` 'purchase' | 'reservation' | 'account-status' | 'payout' | 'payout-status' | 'funding' | 'advice' | 'refund': The intention of the cardholder. - `created` string, iso-8601-date-time, required: The date and time this object was created - `version` integer, required: The version of this object - ThreeDsNoFlowNoAuth - `key` string, required: Uniquely identifies a 3DS authentication. - `merchantAcceptorRef` SchemasAcceptorRef: Reference key and status of the acceptor - `key` string, required: Uniquely identifies a merchant acceptor. - `version` integer, required: The version of this object - `merchantInfo` MerchantInfoResponse: Merchant details as stored and returned in the response. The `merchantCountryCode` is returned as a complete ISO 3166-1 country code object containing all representations. - `acquirerBin` string: 6-11 digit Bank Identification Number assigned by the card network. Required for all card networks except AMEX. - `merchantId` string, required: Merchant identifier (MID) assigned by the acquirer. - `mcc` string, required: 4-digit ISO 18245 merchant category code - `merchantName` string, required: Merchant's doing-business-as name - `merchantCountryCode` object, required - `alpha3` string, required: ISO 3166-1 alpha-3 country code - `alpha2` string, required: ISO 3166-1 alpha-2 country code - `numeric` string, required: ISO 3166-1 numeric country code - `websiteUrl` string, required: Merchant's website URL - `network` 'american-express' | 'bancontact' | 'diners' | 'mastercard' | 'visa', required: The card network to query for PAN information. Diners support is EXPERIMENTAL. - `amount` union, required: An amount encoded as an object with a `value` in minor units and a `currency` code. The amount is unknown for entities older than 2023-03-30. - Amount: An amount encoded as an object with a `value` in minor units and a `currency` code. - `value` integer, required: The amount in minor units. For example `$12.34` should be encoded as `1234`. Note that not all currencies have 2 minor units. Some have three or zero. - `currency` string, required - UnknownAmount - `value` -1, required: The value of the amount is unknown. - `currency` 'unknown', required: The currency code is unknown. - `network` 'american-express' | 'bancontact' | 'diners' | 'mastercard' | 'visa' | 'unknown', required: The card network that was used for the authentication. It is `unknown` for entities older than 2024-04-11. - `protocolVersion` '2.1.0' | '2.2.0', required: The 3DS protocol version which has been used to perform 3DS. **Protocol version 2.1.0 is no longer supported by the card networks. The value 2.1.0 can be retrieved for older authentications.** - `deviceChannel` 'browser' | 'app' | '3ri', required: Indicates the type of the interface used to initiate the transaction. - `flow` 'none', required: Indicates the flow that was used for the 3DS authentication. - `result` 'attempt' | 'non-authenticated', required: Authentication result. - `ares` ARes, required: A 3DS protocol message as it is received by the card network. Note: `threeDSServerTransID` is present in all message types except `Erro` (ErrorMessage), where it is conditional per the EMVCo spec. - `messageVersion` '2.2.0', required: The 3DS protocol version which has been used to perform 3DS. **Protocol version 2.1.0 is no longer supported by the card networks. The value 2.1.0 can be retrieved for older authentications.** - `sdkTransID` string, uuid: Universally unique transaction identifier assigned upon the activation of 3DS SDK. - `messageExtension` MessageExtension[]: Carries additional data that is not defined within the 3DS protocol. This field is usually used for card network specific data. - `name` string, required - `id` string, required - `criticalityIndicator` boolean, required - `data` unknown, required - `messageType` 'ARes', required - `dsTransID` string, uuid, required: Universally unique transaction identifier assigned by the DS to identify a single transaction. - `acsTransID` string, uuid, required: Universally unique transaction identifier assigned by the ACS to identify a single transaction. Each DS can provide a unique ID to each ACS on an individual basis. - `transStatus` 'Y' | 'N' | 'U' | 'A' | 'C' | 'D' | 'R' | 'I', required: Indicates whether a transaction qualifies as an authenticated transaction or account verification. - `transStatusReason` string: Provides information on why the `transStatus` field has the specified value. - `threeDSServerTransID` string, required: Universally unique transaction identifier assigned by the 3DS server to identify a single transaction. This identifier is assigned by Silverflow. - `cardholderInfo` string: Text provided by the ACS/issuer to cardholder during a frictionless or decoupled transaction. - `acsChallengeMandated` string: Indication of whether a challenge is required for the transaction to be authorized due to local/regional mandates or other variable. - `dsReferenceNumber` string, required: EMVCo-assigned unique identifier to track approved DS. - `acsReferenceNumber` string, required: Unique identifier assigned by the EMVCo secretariat upon testing and approval. - `acsOperatorID` string: DS assigned ACS identifier. - `acsDecConInd` string: Indicates whether the ACS confirms utilisation of decoupled authentication and agrees to utilize decoupled authentication to authenticate the cardholder. - `acsRenderingType` AcsRenderingType: The ACS rendering type contains information about the rendering type that the ACS is sending for the cardholder authentication. - `acsInterface` string, required: This is the ACS interface that the challenge will present to the cardholder. - `acsUiTemplate` string, required: Identifies the UI template format that the ACS first presents to the consumer. - `acsURL` string: The merchant or PSP needs to send the base64 encoded CReq message as a form to this URL using an HTTP POST, from the cardholder challenge window. The content type needs to be `application/x-www-form-urlencoded`. - `authenticationType` string: Indicates the type of authentication method the issuer will use to challenge the cardholder, whether in the ARes message or what was used by the ACS when in the RReq message. - `eci` string: Payment system-specific value provided by the ACS or DS to indicate the results of the attempt to authenticate the Cardholder. - `whiteListStatus` string: Enables the communication of trusted beneficiary/whitelist status between the ACS, the DS and the 3DS requestor. - `whiteListStatusSource` string: This data element will be populated by the system setting Whitelist Status. Required if Whitelist Status is present. - `acsSignedContent` string: Contains the JWS object (represented as a string) created by the ACS for the ARes message. - `authenticationValue` string: The result value from the 3DS transaction received from the ACS. This value is no longer present on responses after 45 days have passed after the authentication. Note that Mastercard and Visa use a different underlying format. This property will only be present in the ARes if `transStatus` is `Y`, `A` and conditionally (by DS rules) `I`. - `transactionReference` string: Unique ID assigned by the merchant or payment service provider for the transaction. Used to identify the transaction. - `fraudLiability` 'acquirer' | 'issuer': Which party is liable in case of fraud. - `type` object: Transaction type information from the request - `order` 'checkout' | 'unspecified' | 'one-click' | 'recurring' | 'ucof' | 'installment' | 'standing-order': The method used to place the order. When set to `recurring`, `installment`, or `standing-order`, you are also required to set `recurringExpiry` and `recurringFrequency`. - `intent` 'purchase' | 'reservation' | 'account-status' | 'payout' | 'payout-status' | 'funding' | 'advice' | 'refund': The intention of the cardholder. - `created` string, iso-8601-date-time, required: The date and time this object was created - `version` integer, required: The version of this object - ThreeDsDataOnly - `key` string, required: Uniquely identifies a 3DS authentication. - `merchantAcceptorRef` SchemasAcceptorRef: Reference key and status of the acceptor - `key` string, required: Uniquely identifies a merchant acceptor. - `version` integer, required: The version of this object - `merchantInfo` MerchantInfoResponse: Merchant details as stored and returned in the response. The `merchantCountryCode` is returned as a complete ISO 3166-1 country code object containing all representations. - `acquirerBin` string: 6-11 digit Bank Identification Number assigned by the card network. Required for all card networks except AMEX. - `merchantId` string, required: Merchant identifier (MID) assigned by the acquirer. - `mcc` string, required: 4-digit ISO 18245 merchant category code - `merchantName` string, required: Merchant's doing-business-as name - `merchantCountryCode` object, required - `alpha3` string, required: ISO 3166-1 alpha-3 country code - `alpha2` string, required: ISO 3166-1 alpha-2 country code - `numeric` string, required: ISO 3166-1 numeric country code - `websiteUrl` string, required: Merchant's website URL - `network` 'american-express' | 'bancontact' | 'diners' | 'mastercard' | 'visa', required: The card network to query for PAN information. Diners support is EXPERIMENTAL. - `amount` union, required: An amount encoded as an object with a `value` in minor units and a `currency` code. The amount is unknown for entities older than 2023-03-30. - Amount: An amount encoded as an object with a `value` in minor units and a `currency` code. - `value` integer, required: The amount in minor units. For example `$12.34` should be encoded as `1234`. Note that not all currencies have 2 minor units. Some have three or zero. - `currency` string, required - UnknownAmount - `value` -1, required: The value of the amount is unknown. - `currency` 'unknown', required: The currency code is unknown. - `network` 'american-express' | 'bancontact' | 'diners' | 'mastercard' | 'visa' | 'unknown', required: The card network that was used for the authentication. It is `unknown` for entities older than 2024-04-11. - `protocolVersion` '2.1.0' | '2.2.0', required: The 3DS protocol version which has been used to perform 3DS. **Protocol version 2.1.0 is no longer supported by the card networks. The value 2.1.0 can be retrieved for older authentications.** - `deviceChannel` 'browser' | 'app' | '3ri', required: Indicates the type of the interface used to initiate the transaction. - `flow` 'none', required: Indicates the flow that was used for the 3DS authentication. - `result` 'informational', required: Authentication result. - `ares` ARes, required: A 3DS protocol message as it is received by the card network. Note: `threeDSServerTransID` is present in all message types except `Erro` (ErrorMessage), where it is conditional per the EMVCo spec. - `messageVersion` '2.2.0', required: The 3DS protocol version which has been used to perform 3DS. **Protocol version 2.1.0 is no longer supported by the card networks. The value 2.1.0 can be retrieved for older authentications.** - `sdkTransID` string, uuid: Universally unique transaction identifier assigned upon the activation of 3DS SDK. - `messageExtension` MessageExtension[]: Carries additional data that is not defined within the 3DS protocol. This field is usually used for card network specific data. - `name` string, required - `id` string, required - `criticalityIndicator` boolean, required - `data` unknown, required - `messageType` 'ARes', required - `dsTransID` string, uuid, required: Universally unique transaction identifier assigned by the DS to identify a single transaction. - `acsTransID` string, uuid, required: Universally unique transaction identifier assigned by the ACS to identify a single transaction. Each DS can provide a unique ID to each ACS on an individual basis. - `transStatus` 'Y' | 'N' | 'U' | 'A' | 'C' | 'D' | 'R' | 'I', required: Indicates whether a transaction qualifies as an authenticated transaction or account verification. - `transStatusReason` string: Provides information on why the `transStatus` field has the specified value. - `threeDSServerTransID` string, required: Universally unique transaction identifier assigned by the 3DS server to identify a single transaction. This identifier is assigned by Silverflow. - `cardholderInfo` string: Text provided by the ACS/issuer to cardholder during a frictionless or decoupled transaction. - `acsChallengeMandated` string: Indication of whether a challenge is required for the transaction to be authorized due to local/regional mandates or other variable. - `dsReferenceNumber` string, required: EMVCo-assigned unique identifier to track approved DS. - `acsReferenceNumber` string, required: Unique identifier assigned by the EMVCo secretariat upon testing and approval. - `acsOperatorID` string: DS assigned ACS identifier. - `acsDecConInd` string: Indicates whether the ACS confirms utilisation of decoupled authentication and agrees to utilize decoupled authentication to authenticate the cardholder. - `acsRenderingType` AcsRenderingType: The ACS rendering type contains information about the rendering type that the ACS is sending for the cardholder authentication. - `acsInterface` string, required: This is the ACS interface that the challenge will present to the cardholder. - `acsUiTemplate` string, required: Identifies the UI template format that the ACS first presents to the consumer. - `acsURL` string: The merchant or PSP needs to send the base64 encoded CReq message as a form to this URL using an HTTP POST, from the cardholder challenge window. The content type needs to be `application/x-www-form-urlencoded`. - `authenticationType` string: Indicates the type of authentication method the issuer will use to challenge the cardholder, whether in the ARes message or what was used by the ACS when in the RReq message. - `eci` string: Payment system-specific value provided by the ACS or DS to indicate the results of the attempt to authenticate the Cardholder. - `whiteListStatus` string: Enables the communication of trusted beneficiary/whitelist status between the ACS, the DS and the 3DS requestor. - `whiteListStatusSource` string: This data element will be populated by the system setting Whitelist Status. Required if Whitelist Status is present. - `acsSignedContent` string: Contains the JWS object (represented as a string) created by the ACS for the ARes message. - `authenticationValue` string: The result value from the 3DS transaction received from the ACS. This value is no longer present on responses after 45 days have passed after the authentication. Note that Mastercard and Visa use a different underlying format. This property will only be present in the ARes if `transStatus` is `Y`, `A` and conditionally (by DS rules) `I`. - `transactionReference` string: Unique ID assigned by the merchant or payment service provider for the transaction. Used to identify the transaction. - `fraudLiability` 'acquirer' | 'issuer': Which party is liable in case of fraud. - `type` object: Transaction type information from the request - `order` 'checkout' | 'unspecified' | 'one-click' | 'recurring' | 'ucof' | 'installment' | 'standing-order': The method used to place the order. When set to `recurring`, `installment`, or `standing-order`, you are also required to set `recurringExpiry` and `recurringFrequency`. - `intent` 'purchase' | 'reservation' | 'account-status' | 'payout' | 'payout-status' | 'funding' | 'advice' | 'refund': The intention of the cardholder. - `created` string, iso-8601-date-time, required: The date and time this object was created - `version` integer, required: The version of this object ## Other responses - `400`: Bad Request - `401`: Authentication Required - `409`: Conflict - `422`: Unprocessable Content - `429`: Too Many Requests - `500`: Internal Server Error --- [API](https://skmtc.dev/silverflow/apis/silverflow-api.md) - [All operations](https://skmtc.dev/silverflow/apis/silverflow-api/llms.txt) - [OpenAPI document](https://skmtc.dev/silverflow/apis/silverflow-api/revisions/43ecbe4fd6ea?raw)