3-D Secure authentication payment results
Payments return 3-D Secure authentication data in the authentication object. This object is available on the following endpoints and also for the payment status change notification:
POST /v1/paymentsGET /v1/paymentsGET /v1/payments/{paymentId}/status
The authentication object has two parts:
requested | What you asked for on the payment request:threeDSecureRequired, challengeRequested and automaticallyStepUp Returned at any status, and holds only the fields you sent. |
result | The authentication outcome reported by the PSP. Only returned once the payment has left AUTHORIZATION_PENDING, so it is never present while 3-D Secure is still in progress. |
Any field that is missing or unrecognised is omitted. If the PSP returned no authentication outcome, result is omitted; if both parts are empty, authentication is omitted entirely.
The result part of the authentication object has the following fields and options:
result fields | Options |
|---|---|
enrolled | ENROLLED, NOT_ENROLLED, UNKNOWN |
authenticationStatus | SUCCESS, ATTEMPTED, FAILED, UNAVAILABLE, REJECTED, CHALLENGE_REQUIRED, EXEMPT, NOT_ENROLLED |
flow | FRICTIONLESS, CHALLENGE |
version | 3-D Secure protocol version, for example, 2.2.0 |
eci | Electronic Commerce Indicator, normalised to a two digit zero padded string, for example,05. |
Values are normalised across PSPs, so the same authenticationStatus means the same thing whichever PSP processed the payment. Not every PSP returns every field. Refer to Availability below.
ECI values differ by scheme
Visa and American Express use 05 (authenticated), 06 (attempted) and 07 (not authenticated). Mastercard uses 02, 01 and 00 respectively.
Wallets
PSPs do not return 3-D Secure results for Apple Pay and Google Pay. Where an ECI is present in the decrypted wallet payload it is returned as result.eci, and the other result fields are omitted.
External 3-D Secure
3-D Secure data you supply through the externalThreeDSecure object is not echoed back in authentication.
Example
authentication sits alongside avsResult and cvvResult in the response.
{
"status": "AUTHORIZED",
"amount": 151.00,
"currencyCode": "GBP",
"authentication": {
"requested": {
"threeDSecureRequired": true,
"challengeRequested": true,
"automaticallyStepUp": false
},
"result": {
"enrolled": "ENROLLED",
"authenticationStatus": "SUCCESS",
"flow": "CHALLENGE",
"version": "2.2.0",
"eci": "02"
}
}
}PSP Availability
Updated 35 minutes ago