---
title: "3D Secure Lookup"
method: POST
path: "/v2/clients/{ClientID}/3ds/lookup"
tags: ["3D Secure"]
---

# 3D Secure Lookup

`POST /v2/clients/{ClientID}/3ds/lookup`

3D Secure Card Lookup.

## Path parameters

- `ClientID` string, required

## Query parameters

- `enhancedResponse` string, required

## Request body

- 3dslookup
  - `3dsID` string, required — 3dsID returned from [3dsinit](https://developers.tabapay.com/reference/3dsinit#/)
  - `sdkSessionID` string — Mobile flow referenceID (used in conjunction with init.sdkVersion, comes from the SDK's setup.onComplete) Required if the device channel is SDK.
  - `authenticationIndicator` string, required — 2-digit [Authentication Indicator](https://developers.tabapay.com/reference/lookup#/authentication-indicator)
  - `transactionMode` string — 1-character [Transaction Mode](https://developers.tabapay.com/reference/lookup#/transaction-mode)
  - `transactionType` string, required — `C` is the only [Transaction Type](https://developers.tabapay.com/reference/lookup#/transaction-type) supported.
  - `productCode` string, required — 3-character [Product Code](lookup#product-code)
  - `account` object, required — Account Details
    - `accountID` string — <<glossary:Account ID>> 22 characters. Exclusively use `accountID` field or `card` object to input card information. Incompatible with the `card` object.
    - `card` object — Payment Card Data. Incompatible with `accountID`. Exclusively use: `card` *OR* `accountID`.
      - `accountNumber` string — <<glossary:Payment Card Not Encrypted>> A Primary Account Number (PAN/Card Number) Compatible *only* with `expirationDate`, nothing else.
      - `expirationDate` string — <<glossary:Payment Card Not Encrypted>> Expiration Date in YYYYMM Compatible *only* with `accountNumber`, nothing else.
    - `owner` object, required — Owner
      - `email` string, required — Valid Email Address
      - `phone` Phone, required — Phone *object*
        - `countryCode` string — 1-3 digit Country Calling Code *Optional.* Default is `1`.
        - `number` string, required — Phone Number. For phone numbers with `countryCode` equal to `1` (or blank), provide a 10-digit phone number. For all `countryCodes`, other than `1`, a 4-14 digit phone number is accepted.
      - `name` object, required
        - `first` string, required — 2-22 character First Name
        - `last` string, required — 2-22 character Last Name
      - `address` object — Billing Address. Please Do NOT use this field unless you are allowed to send cards in the clear. Otherwise, please Create Accounts with Address. If a TabaPay Account already has an address, then that will be used.
        - `line1` string — Address Line 1
        - `line2` string — Address Line 2 *Optional*
        - `city` string — City
        - `state` string — State Code [State Code](https://developers.tabapay.com/reference/us-state-codes#/) must be a valid 2-character code if `country` is [840](https://developers.tabapay.com/reference/country-codes#/) or [Canadian 2-char code](https://developers.tabapay.com/reference/canadian-province-codes#/) if [124](https://developers.tabapay.com/reference/country-codes#/).
        - `zipcode` string — Zip Code If `country` is `840`, `zipcode` must be 5 or 9 digits. If country is `124`, `zipcode` must be in the *A1A 1A1* format. Zip codes from other countries will not be checked.
        - `country` string — [Country Code](https://developers.tabapay.com/reference/country-codes#/) *Optional. Default is `840`*
  - `order` object, required — Order
    - `orderID` string, uuid, required — 1-50 characters
    - `currency` string — [ISO 4217](https://en.wikipedia.org/wiki/ISO_4217) 3-Digit [Currency Code](https://developers.tabapay.com/reference/currency-numbers#/). *Optional. Default is `840`*
    - `amount` string, required — See how to [properly format an amount](/reference/data#how-to-specify-an-amount-value).
  - `browser` Browser, required — Browser Information. For more information on these fields see [here](https://developers.tabapay.com/reference/browser-fields)
    - `javascriptEnabled` boolean — *Deprecated* Javascript Enabled
    - `userAgent` string — *Deprecated* User Agent
    - `header` string — *Deprecated* Header
    - `javaEnabled` boolean — *Deprecated* Java Enabled
    - `language` string — *Deprecated* Language
    - `colorDepth` string — *Deprecated* Color Depth
    - `screenHeight` string — *Deprecated* Screen Height
    - `screenWidth` string — *Deprecated* Screen Width
    - `ipAddress` string — *Deprecated* IP Addresses in IPv4 or IPv6 formats are accepted.
    - `browserInfo` string — Concatenated [Browser Data Fields](https://developers.tabapay.com/reference/browser-fields). Concatenate the below fields (in order!) with the `|` 1. `javascriptEnabled` 2. `userAgent` 3. `header` 4. `javaEnabled` 5. `language` 6. `colorDepth` 7. `screenHeight` 8. `screenWidth` 9. `timezone` 10. `ipAddress` *See an example [here](https://developers.tabapay.com/reference/browser-fields#browser-object-field-browserinfo)*
    - `deviceChannel` string, required — Either `Browser` or `SDK`

## Response `200`

A Lookup Response is returned.

- 3dsLookupResponse
  - `SC` integer — [HTTP Status Code](https://developers.tabapay.com/reference/http-status-codes#/)
  - `EC` string — Internal Error Code. This is used to help TabaPay team members trace an error.
  - `EM` string — Short description of the error if an error occurred.
  - `3dsVersion` string — The 3D Secure Version that was used to process this request. Expected values are of the form: `2.X.X`
  - `enrolled` string — Authentication Eligibility Status Possible Values: - `Y` Enrolled - `N` Not Enrolled - `U` Issuer Server Unavailable - `B` Merchant bypassed authentication
  - `processorTransactionID` string — Processor Transaction Identifier
  - `dsTransactionID` string — Directory Server Transaction Identifier Save to pass to [Create Transaction](/reference/transactioncreate) for a 3DS Payment
  - `status` string — Transaction Status Result Possible Values: - `Y` Successful Authentication - `N` Failed Authentication - `B` Merchant bypassed authentication - `U` Unable to Complete Authentication - `A` Successful Attempts Transaction - `C` Challenge Required for Authentication - `R` Authentication Rejected - `I` Informational Only; 3DS Requester challenge preference acknowledged
  - `ECI` string — [Electronic Commerce Indicator](/docs/visa-eci-response) Possible Values: - `00` - `01` - `02` - `05` - `06` - `07`
  - `UCAF` string — Universal Cardholder Authentication Field [Visa](/docs/visa-cavv-results-code#/) uses <<glossary:CAVV>> (Cardholder Authentication Verification Value) [MasterCard](/docs/mastercard-ucaf-collection-downgrade-indicator#/) uses AAV (Account-Holder Authentication Value)
  - `XID` string — XID (Transaction ID) Optional
  - `challengeURL` string — Consumer Authentication URL ***Only present if Challenge***
  - `payload` string — Base64 Encoded Payment Request ***Only present if Challenge***
  - `cardholderInfo` string — Text provided by the ACS/Issuer to Cardholder during a Frictionless transaction. The Issuer can provide information to Cardholder. For example: Additional authentication is needed for this transaction, please contact (Issuer Name) at xxx-xxx-xxxx. The Issuing Bank can optionally support this value. The merchant is required to display this within their Checkout when present.
  - `signatureVerification` string — Transaction Signature status identifier. Possible Values: Y - Indicates that the signature of the PARes has been validated successfully and the message contents can be trusted. N - Indicates that the PARes could not be validated. This result could be for a variety of reasons; tampering, certificate expiration, etc., and the result should not be trusted.
  - `stepUpURL` string — The fully qualified URL that the client uses to post the cardholder in order to complete the Consumer Authentication transaction for the Cardinal Cruise API integration. Note: This is only for a Cardinal Cruise API Integration
  - `3dsRC` string — TabaPay Error Code for <<glossary:3DS>>, this should be 0 unless there is an issue. Please store this in your logs.

## Other responses

- `207` — One or more Failures occurred while processing the Request.
- `404` — The AccountID does not point to a valid Account.

---

[API](https://skmtc.dev/tabapay/apis/tabapay-apis.md) · [All operations](https://skmtc.dev/tabapay/apis/tabapay-apis/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/tabapay/tabapay-apis/revisions/154fa3d585cf/schema)