---
title: "Simulate 3DS authentication"
method: POST
path: "/v1/three_ds_authentication/simulate"
tags: ["3DS"]
---

# Simulate 3DS authentication

`POST /v1/three_ds_authentication/simulate`

Simulates a 3DS authentication request from the payment network as if it came from an ACS. If you're configured for 3DS Customer Decisioning, simulating authentications requires your customer decisioning endpoint to be set up properly (respond with a valid JSON). If the authentication decision is to challenge, ensure that the account holder associated with the card transaction has a valid phone number configured to receive the OTP code via SMS.

## Request body

- SimulateAuthenticationRequest — Request object for simulating a 3DS authentication
  - `merchant` object, required — Merchant information for the simulated transaction
    - `country` string, required — Country of the address provided by the cardholder in ISO 3166-1 alpha-3 format (e.g. USA)
    - `id` string, required — Unique identifier to identify the payment card acceptor. Corresponds to `merchant_acceptor_id` in authorization.
    - `mcc` string, required — Merchant category code for the transaction to be simulated. A four-digit number listed in ISO 18245. Supported merchant category codes can be found [here](https://docs.lithic.com/docs/transactions#merchant-category-codes-mccs).
    - `name` string, required — Merchant descriptor, corresponds to `descriptor` in authorization. If CHALLENGE keyword is included, Lithic will trigger a challenge.
  - `pan` string, required — Sixteen digit card number.
  - `transaction` object, required — Transaction details for the simulation
    - `amount` integer, required — Amount (in cents) to authenticate.
    - `currency` string, required — 3-character alphabetic ISO 4217 currency code.
  - `card_expiry_check` 'MATCH' | 'MISMATCH' | 'NOT_PRESENT' — When set will use the following values as part of the Simulated Authentication. When not set defaults to MATCH

## Response `201`

OK

- object
  - `token` string, uuid — Globally unique identifier for the 3DS authentication.

## Other responses

- `400` — A parameter in the query given in the request does not match the valid queries for the endpoint.
- `401` — | | | |---|---| | User has not been authenticated | Invalid or missing API key | | API key is not active | The API key used is no longer active | | Could not find API key | The API key provided is not associated with any user | | Please provide API key in Authorization header | The Authorization header is not in the request | | Please provide API key in the form Authorization: [api-key] | The Authorization header is not formatted properly | | Insufficient privileges. Issuing API key required | Write access requires an Issuing API key. Reach out at [lithic.com/contact](https://lithic.com/contact) | | Insufficient privileges to create virtual cards. | Creating virtual cards requires an additional privilege | Reach out at [lithic.com/contact](https://lithic.com/contact) |
- `422` — Unprocessable entity.
- `429` — Client has exceeded the number of allowed requests in a given time period. | | | |---|---| | Rate limited, too many requests per second | User has exceeded their per second rate limit | | Rate limited, reached daily limit | User has exceeded their daily rate limit | | Rate limited, too many keys tried | One IP has queried too many different API keys |

---

[API](https://skmtc.net/lithic-com/apis/lithic-developer-api.md) · [All operations](https://skmtc.net/lithic-com/apis/lithic-developer-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/lithic-com/lithic-developer-api/revisions/53ab5d4e2adb/schema)