---
title: "Approve a 3D Secure challenge"
method: POST
path: "/v2/three-ds-challenges/{challengeId}/approve"
---

# Approve a 3D Secure challenge

`POST /v2/three-ds-challenges/{challengeId}/approve`

## Request

- Base URL: `https://api.slash.com`
- URL: `https://api.slash.com/v2/three-ds-challenges/{challengeId}/approve`
- Auth: API key in header `X-API-Key`

Confirm the purchase on the cardholder's behalf; it then goes on to authorization as usual. Only a `pending` challenge can be decided, once, before its `expiresAt`.

## Path parameters

- `challengeId` string, required

## Response `200`

The approved 3D Secure challenge.

- ThreeDsChallenge: A request to confirm a card purchase with 3D Secure. It must be approved or declined before `expiresAt`, about five minutes after it is requested; a challenge left unanswered is declined.
  - `id` string, required: 3D Secure challenge id with the `three_ds_challenge_` prefix.
  - `cardId` string, required: The card the purchase was made with, with the `c_` prefix.
  - `status` 'pending' | 'approved' | 'declined' | 'expired' | 'failed', required: `pending` until it is decided. `approved` and `declined` record the decision. `expired` means it was not decided in time and the purchase was declined. `failed` means the decision could not be reported and the purchase was declined.
  - `merchant` object, required
    - `description` string, required
    - `location` object, required
      - `country` string, required: The merchant's three-letter ISO 3166-1 alpha-3 country code, such as `USA` or `GBR`.
  - `amount` Money, required: A signed monetary amount expressed in minor units.
    - `amount` integer, required: Amount in the currency's minor units.
    - `currency` string, required: Uppercase ISO 4217 currency code.
  - `expiresAt` string, date-time, required: The deadline to approve or decline the challenge.

## Other responses

- `400`: - `invalid_request (request shape)` — The body, query, or headers failed validation, or a required header is missing. `details` has one entry per failing location, keyed by JSON pointer or header name.
- `401`: - `unauthorized` — API key authentication is missing or invalid.
- `403`: - `feature_not_enabled` — The feature this request uses is not enabled for the legal entity. Contact Slash support to enable it. - `forbidden` — The credential is not permitted to perform this action on the resource. When the resource is a field of the request, `details` names that `field` and the `id` it received. - `forbidden (legal entity)` — The credential is not permitted to act for the selected legal entity. - `not_available` — Public API v2 is not yet available. Use [Public API v1](https://docs.slash.com/introduction) in the meantime. - `user_api_key_required` — The API key is scoped to a legal entity rather than a user. Every v2 request needs a user API key, created under Settings → API keys in the Slash dashboard, together with the `x-legal-entity` header.
- `404`: - `not_found` — No resource matches the identifier. When the identifier is a field of the request, `details` names that `field` and the `id` it received.
- `409`: - `three_ds_challenge_already_decided` — The 3D Secure challenge is no longer pending; `details.status` is its current status. - `three_ds_challenge_expired` — A 3D Secure challenge must be approved or declined before its `expiresAt`, about five minutes after it is requested. Once it expires the purchase is declined; the cardholder can retry the purchase.
- `429`: The request exceeded the applicable rate limit. The response body is plain text, not the error object; clients must not depend on its wording.
- `500`: - `internal` — Slash could not complete the request. Quote `referenceId` when contacting Slash support.

## Changes

- **2026-10-29** `eacc613f7cb7`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/slashfi/apis/slash-public-api/changes/v2/three-ds-challenges/:challengeId/approve/post.md)

---

[API](https://skmtc.dev/slashfi/apis/slash-public-api.md) - [All operations](https://skmtc.dev/slashfi/apis/slash-public-api/llms.txt) - [OpenAPI document](https://skmtc.dev/slashfi/apis/slash-public-api/revisions/eaed2d63c9e2?raw)