entityId=8ac7a49f6e4a18ae016e4b8b4c4b2146
amount=12.00
currency=EUR
paymentBrand=VISA
paymentType=PA
merchantTransactionId=order99234
transactionCategory=EC
card.number=4000000000000010
card.expiryMonth=12
card.expiryYear=2025
card.cvv=123
card.holder=John Smith
merchant.name=MerchantCo
merchant.city=Munich
merchant.country=DE
merchant.mcc=5399
shopperResultUrl=https://merchant.org
customer.ip=192.168.0.1
customer.browser.acceptHeader=text/html
customer.browser.screenColorDepth=48
customer.browser.javaEnabled=false
customer.browser.language=de
customer.browser.screenHeight=1200
customer.browser.screenWidth=1600
customer.browser.timezone=60
customer.browser.challengeWindow=4
customer.browser.userAgent=Mozilla/4.0 (MSIE 6.0; Windows NT 5.0)
testMode=EXTERNAL

{
    "id": "8ac7a4a0686138d701687eebfbc74747",
    "paymentType": "DB",
    "paymentBrand": "VISA",
    "result": {
        "code": "000.200.000",
        "description": "transaction pending"
    },
    "resultDetails": {
        "clearingInstituteName": "CI_Test"
    },
    "card": {
        "bin": "411111",
        "last4Digits": "1111",
        "holder": "Jane Jones",
        "expiryMonth": "05",
        "expiryYear": "2020"
    },
    "redirect": {
        "url": "https://test.oppwa.com/v1/threeDSecure/execute",
        "parameters": [{
            "name": "name",
            "value": "value"
        }],
        "preconditions": [{
            "origin": "iframe#hidden",
            "waitUntil": "iframe#onload",
            "description": "Hidden iframe post for 3D Secure 2.0",
            "method": "POST",
            "url": "methodURL",
            "parameters": [{
                "name": "threeDSMethodData",
                "value": "methodData"
            }]
        }]
    },
    "risk": {
        "score": "100"
    },
    "buildNumber": "deebd8c9af7d84ddee98c38b7f4afcc814012b5b@2019-01-22 13:58:00 +0000",
    "timestamp": "2019-01-24 08:13:41+0000",
    "ndc": "8a8294174b7ecb28014b9699220015ca_0557df43f75643d19479440642979e00"
}

{
  "id":"8ac7a49f6e4a18ae016e4b8b4c4b2146",
  "paymentType":"PA",
  "paymentBrand":"VISA",
  "amount":"12.00",
  "currency":"EUR",
  "result":{
    "code":"000.100.112",
    "description":"Request successfully processed in 'Merchant in Connector Test Mode'"
  },
  "resultDetails":{
    "ExtendedDescription":"Approved",
    "AcquirerResponse":"00",
  },
  "card":{
    "bin":"400000",
    "last4Digits":"0044",
    "expiryMonth":"12",
    "expiryYear":"2025"
  },
  "threeDSecure":{
    "eci":"05",
    "verificationId":"MTIzNDU2Nzg5MDEyMzQ1Njc4OTA=",
    "version":"2.1.0",
    "dsTransactionId":"91caca63-5c4e-4aa2-a3f1-b4d418972de8",
    "acsTransactionId":"7055d78e-eb35-46e7-8c4e-56e15092b5f5",
  },
  "buildNumber":"7810ceecdd913cd9c4807becb99b89ce68454900@2019-11-08 12:20:52 +0000",
  "timestamp":"2019-11-08 15:05:42+0000",
  "ndc":"8ac7a4c76dd857ea016dda2ea6970684_3ba4c7691f854354906b2f6c402840e7"
}

Response fields

In the returned response there are two places where 3D Secure related response values can be present. In the "threeDSecure" object we store the values that are not brand specific and can be returned by any card brand and issuer. In the "resultDetails" object we store the brand specific values if the scheme directory server returns such value.

Values returned in the threeDSecure object

"threeDSecure":{
    "eci":"05",
    "verificationId":"MTIzNDU2Nzg5MDEyMzQ1Njc4OTA=",
    "version":"2.1.0",
    "flow":"challenge"
    "dsTransactionId":"1231-2342-3453-4564"
    "challengeMandatedIndicator":"Y"
    "authenticationType":"2"
    "acsTransactionId":"7777-8797-4645-1233"
  },

Values returned in the resultDetails object

"resultDetails":{
    "ExtendedDescription":"Approved or completed successfully",
    "clearingInstituteName":"Clearing_Institute",
    "ConnectorTxID1":"12345",
    "AcquirerResponse":"00",
    "reconciliationId":"132499881"
    "CB_Authentication_value_algorithm":"2"
    "CB_Score":"55"
  },

New return codes

Two new return codes have been introduced in the 3DS 2.0 workflow:

• 300.100.100 - may be returned during the payment authorization. Indicates that the acquirer or the issuer declined the transaction due to SCA was not applied. This is a soft decline, and the appropriate action to take is to re-submit the transaction with 3D Secure, which will result in a challenge flow.
• 000.400.110 - Authentication successful (fricitionless flow). This may be returned during the authentication (3D Secure) flow, when the issuer authenticates the transaction solely based on the data received in the authentication request without the need for the cardholder to authenticate themselves
• 000.400.109 - Card is not enrolled for 3D Secure version 2. This code may be returned during the 3DS lookup request (PReq). If the card is not enrolled for 3DS 2.x, and the fallback to 3DS 1.0 is not enabled, then the transactions status will be 000.400.109

Parameters for merchants using 3rd party 3DS Server/MPI

If a merchant is using a third-party 3DS Server provider, and the API is used only for processing authorizations, then some additional parameters might be required:

Exemptions

Exemptions are particular transactions that can be exempted from SCA, and they don't necessarily need explicit cardholder authentication. In a simpler way: they can be either authorized without previous authentication, or they will go though a frictionless flow during authentication which means the cardholder doesn't have authenticate themselves with the issuer.

These exemptions are transactions which are:

• Low value
• Low risk
• Between cardholder and merchant, where the cardholder white-listed the merchant as a 'trusted beneficiary'
• Made with a corporate card

Merchants can request an exemption by marking the transaction with the exemption flag. It is important to know, that in this case:

• Merchant takes liability for the transaction
• The issuer has the power to override the exemption request
• Some acquirers may not allow certain exemptions for their merchants. Merchants should consult with their acquirers to which extent can they use the exemption flags.

Exemptions can be requested in 2 ways:

• By sending the transaction directly to authorization with an exemption flag (no 3D Secure will be executed, and liability will be with the merchant)
• By sending the transaction for authentication with an exemption flag (3D Secure will be attempted and the issuer will take the liability)

To request an exemption via authorization (1st option above), it is enough to send only the threeDSecure.exemptionFlag field. To request an exemption via authentication (2nd option above), the parameter that has to be sent depends on the 3D Secure version:

• For versions 2.1+ and 2.2, only the threeDSecure.exemptionFlag parameter needs to be sent
• For version 2.1, both threeDSecure.challengeIndicator and threeDSecure. exemptionFlag has to be sent. The reason for this, is that 3DS 2.1 authentication doesn't support exemptions, but the merchant can still flag the transaction to the issuer their preference.

Possible values for the threeDSecure.challengeIndicator and threeDSecure.exemptionFlag fields:

• threeDSecure.challengeIndicator - should be used in the case when the transaction is sent to the issuer for authentication, but a challenge is not requested.

  Value	Challenge preference	Description
  01	No preference	The merchant has no preference, and fully trust the issuer to ask a challenge from the cardholder.
  02	No challenge requested	The merchant prefers that the cardholder is not authenticated by the issuer, and only the frictionless flow applies
  03	Challenge requested: 3D Secure Requestor Preference	The merchant prefers that the cardholder is authenticated by the issuer.
  04	Challenge requested: Mandate	The cardholder authentication is mandated (eg. by regional mandates)
  05	No challenge requested	Transactional risk analysis is already performed
  06	No challenge requested	Data share only
  07	No challenge requested	Strong consumer authentication is already performed
  08	No challenge requested	Utilise whitelist exemption if no challenge required
  09	Challenge requested	Whitelist prompt requested if challenge required