WOworldpay
authentication

Authentication

Authenticate your customer by submitting order and risk data.

post/authentications

Request

Headers

WP-Api-Version'2026-10-01' required

The API version.

Request body

orderReferencestring required

Merchant specific reference for the order (e.g. generated ecommerce system order number). Does not have to be unique as multiple payments may apply to a single order.

transactionReferencestring required

A unique reference per authentication request provided by you that is used to identify the authentication throughout its lifecycle.

previousSuspiciousActivityboolean

Has the account been flagged for suspicious activity.

userType'guestUser' | 'registeredUser' | 'federatedAccount' | 'issuerCredentials' | 'thirdPartyAuthentication' | 'fidoAuthenticator'
reorderboolean

Repeat of a previous order.

preOrderDatestring date

Expected date that a pre-ordered purchase will be available. Provide in ISO 8601 format.

Example request

{
  "orderReference": "order-1234",
  "transactionReference": "request-5678",
  "merchant": {
    "entity": "default",
    "acquirerId": "01234567"
  },
  "instruction": {
    "value": {
      "currency": "GBP"
    },
    "paymentInstrument": {
      "type": "card/plain",
      "cardHolderName": "Sherlock Holmes",
      "expiryDate": {
        "month": 1,
        "year": 2028
      },
      "cardNumber": "4444333322221111",
      "billingAddress": {
        "address1": "221B Baker Street",
        "city": "London",
        "postalCode": "NW1 6XE",
        "countryCode": "GB"
      }
    }
  },
  "accountHistory": {
    "createdAt": "2019-11-18",
    "modifiedAt": "2020-05-12",
    "passwordModifiedAt": "2021-03-15",
    "paymentAccountEnrolledAt": "2021-06-20"
  },
  "preOrderDate": "2021-12-25",
  "transactionHistory": {
    "shippingAddressFirstUsedAt": "2021-06-20"
  },
  "giftCardsPurchase": {
    "totalValue": {
      "currency": "GBP"
    }
  }
}

Response

The authentication has been created.

outcome'3dsRedirect'

Client-side 3DS interaction is required. Load the redirect URL to run device data collection and, if the issuer requires it, a challenge.

authenticationIdstring

Unique identifier for a single 3ds authentication, generated by Worldpay

redirectstring

Worldpay hosted URL that runs the client-side 3DS interactions with the card issuer: device data collection (DDC) and, if the issuer requires it, the challenge.

The outcome is sent to your page by postMessage from the Worldpay origin. When the client-side flow is complete, use the query request with the authenticationId to retrieve the authentication result.

Example response

{
  "authenticationId": "3dsLfC-vuhv7J2nEw2m9ca_e0"
}

Changes

No recorded changes to this operation across all 1 revision of this API.