---
title: "OOB Webhook Notification"
method: POST
path: "/v1/authenticate/{customerNumber}/{sessionId}"
tags: ["OOB Webhook Notification"]
---

# OOB Webhook Notification

`POST /v1/authenticate/{customerNumber}/{sessionId}`

In Out-of-Band (OOB) authentication, a webhook notification is sent to the issuer-provided channel for cardholder's approval.

## Path parameters

- `customerNumber` string, required
- `sessionId` string, required

## Request body

- InitiateAuthenticationBody
  - `callbackUrl` string, required — URL where the authentication result is forwarded.
  - `transaction` Transaction
    - `type` 'PAYMENT' | 'RECURRING', required — Type of transaction.
    - `amount` Money — Amount including currency
      - `amount` number
      - `currency` string — A valid ISO 4217 currency code
    - `cardId` string, required — Unique identification number of the card.
    - `cardNumber` string, required — Truncated card number.
    - `deviceChannel` 'APP' | 'BROWSER' | 'REQUESTOR_INITIATED', required — Channel used for the transaction.
    - `timestamp` string, required — The date when the transaction occured at the POS; Epoch-timestamp format (Number of seconds since 01.01.1970 UTC).
  - `merchant` Merchant — Will give merchant information if available
    - `id` string
    - `acquirerId` string
    - `country` string — A valid ISO 3166-1 alpha-3 country code, except for QZZ (UNMIK in Kosovo) and ROM for Romania.
    - `city` string
    - `name` string
    - `mcc` string
    - `subMerchantId` string

## Response `200`

Successful initiation of authentication

## Other responses

- `401` — Unauthorized
- `403` — Forbidden
- `404` — Customer does not exist
- `500` — Internal server error

---

[API](https://skmtc.net/enfuce/apis/transfer-api.md) · [All operations](https://skmtc.net/enfuce/apis/transfer-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/enfuce/transfer-api/revisions/dc4a41118f80/schema)