---
title: "Create Authentication"
method: POST
path: "/three-d-secure/authentications"
tags: ["3D Secure"]
---

# Create Authentication

`POST /three-d-secure/authentications`

This operation is used to create an Authentication request. 
The authentication request is used to start the validation process of the card. 
The result of this request determines whether 3DS is supported by the card and what type of authentication is required.

## Request body

- AuthenticationRequest — Use the 3DS Authentication request to start the validation process of the card and cardholder identity. This request supports all 3DS authentication methods, including 3DS Requestor Initiated (3RI) and Decoupled Authentication. The fields device_channel and message_category control the type of 3DS request made. To perform a standard 3DS Authentication with a cardholder browser experience, send device_channel = 02 for BRW. The result of this request determines whether the card supports 3DS features and, if supported, whether the transaction uses a frictionless or challenge flow. To perform a 3DS Requestor Initiated Authentication without a cardholder browser experience, send device_channel = 03 for 3RI. Any fields related to the browser’s challenge prompt are no longer required, but other conditional fields for 3RI become mandatory.
  - `idempotencyKey` string, required — A Unique Identifier that is required for handling idempotent requests. Note: Moneris encourages the use of UUID Version 4 in APIs as an idempotency key."
  - `cardLookupId` string, nullable — Used to identify API resources which may be required for future follow-on transactions; i.e. Refunds, Corrections, Completions, Reversals, etc.
  - `orderId` string, nullable — Indicates the merchant-defined transaction identifer or order ID. Identifiers are unique for every Purchase, Pre-Authorization and Independent Refund transaction **Note**: No two transactions of these types may have the same order ID. Field only accepts alphanumerical characters, dashes and underscores.
  - `amount` Money, required — Monetary amount. Note: The value must be in cents. Therefore $10.59 must be sent as 1059.
    - `amount` integer, required — Amount
    - `currency` string, iso-4217, required — Provides the three letter currency code according the ISO 4217 standard. For a complete list of currency codes, visit: https://en.wikipedia.org/wiki/ISO_4217
  - `cardholderName` string, required — Cardholder name
  - `cardholderEmail` string, email, required — Contains the customer's email address. For standard email protocols, visit: https://www.rfc-editor.org/rfc/rfc5322
  - `cardholderPhoneNumber` string, required — Phone number.
  - `shippingAddress` object, nullable — The postal address including street, town/city, province, and postal code. Optionally an unit number can be provided.
    - `unitNumber` string, nullable — Unit number
    - `streetNumber` string, nullable — Street number
    - `streetName` string, nullable — Street name
    - `city` string, nullable — Identifies the city.
    - `province` string, iso-3166-2, nullable — Province or state ISO 3166-2 code
    - `postalCode` string, nullable — Postal or zip code
    - `country` string, iso-3166, nullable — Provides the two letter country code according the ISO 3166-1 alpha-2 standard. For a complete list of country codes, visit: https://en.wikipedia.org/wiki/ISO_3166-1_alpha-2.
  - `billingAddress` ThreeDSecureAuthenticationBillingAddress, required — The postal address including street, town/city, province, and postal code.
    - `unitNumber` string, nullable — Unit number
    - `streetNumber` string, required — Street number
    - `streetName` string, required — Street name
    - `city` string, required — Identifies the city.
    - `province` string, iso-3166-2, required — Province or state ISO 3166-2 code
    - `postalCode` string, required — Postal or zip code
    - `country` string, iso-3166, required — Provides the two letter country code according the ISO 3166-1 alpha-2 standard. For a complete list of country codes, visit: https://en.wikipedia.org/wiki/ISO_3166-1_alpha-2.
  - `paymentMethod` union — Payment method details
    - object — Use existing unique payment method identifier.
      - `paymentMethodSource` 'PAYMENT_METHOD_ID' | 'CARD' | 'TEMPORARY_TOKEN' | 'PERMANENT_TOKEN' | 'APPLE_PAY_ENCRYPTED' | 'APPLE_PAY_DECRYPTED' | 'GOOGLE_PAY_ENCRYPTED' | 'GOOGLE_PAY_DECRYPTED', required — The source of Payment Method being used. It can be: - The Id of a Payment Method already created. - Permanent Token. - Temporary Token. - Card. - E-Wallet.
      - `paymentMethodId` string, required — Unique Identifier of the payment method.
    - object — Payment Method details. Note: If defined, this will result in the creation of Payment Method as defined in the Payment Method API.
      - `card` Card, required — Card details
        - `cardNumber` string, required — Identifies the customer's credit or debit card number (Primary Account Number).
        - `expiryMonth` integer, required — Card expiration month. Format must be MM
        - `expiryYear` integer, required — Displays the card expiration year. Accepted format: YYYY
        - `cardSecurityCode` string, required — CVD value located on credit card. The CVD value (supplied by the cardholder) must only be passed to the payment gateway. Under no circumstances may it be stored for subsequent use or displayed as part of the receipt information.
      - `cardholderInformation` CardholderInformation, nullable — Information about the holder of the card.
        - `cardholderName` string, required — Cardholder name
        - `companyName` string, nullable — Identifies the associated company name
      - `contactDetails` ContactDetails, nullable — Contact details
        - `phoneNumber` string, nullable — Phone number.
        - `email` string, email, nullable — Contains the customer's email address. For standard email protocols, visit: https://www.rfc-editor.org/rfc/rfc5322
      - `billingAddress` object, nullable — The postal address including street, town/city, province, and postal code. Optionally an unit number can be provided.
        - `unitNumber` string, nullable — Unit number
        - `streetNumber` string, nullable — Street number
        - `streetName` string, nullable — Street name
        - `city` string, nullable — Identifies the city.
        - `province` string, iso-3166-2, nullable — Province or state ISO 3166-2 code
        - `postalCode` string, nullable — Postal or zip code
        - `country` string, iso-3166, nullable — Provides the two letter country code according the ISO 3166-1 alpha-2 standard. For a complete list of country codes, visit: https://en.wikipedia.org/wiki/ISO_3166-1_alpha-2.
      - `paymentMethodSource` 'PAYMENT_METHOD_ID' | 'CARD' | 'TEMPORARY_TOKEN' | 'PERMANENT_TOKEN' | 'APPLE_PAY_ENCRYPTED' | 'APPLE_PAY_DECRYPTED' | 'GOOGLE_PAY_ENCRYPTED' | 'GOOGLE_PAY_DECRYPTED', required — The source of Payment Method being used. It can be: - The Id of a Payment Method already created. - Permanent Token. - Temporary Token. - Card. - E-Wallet.
      - `customData` CustomData, nullable — Merchant can send custom meta data with the transaction in this object. Moneris will echo these values back in response.
    - object — Payment Method details. Note: If defined, this will result in the creation of Payment Method as defined in the Payment Method API.
      - `temporaryToken` string, required — Created when a temporary token is created and returned. This acts as a unique profile identifier, and is a required value for temporary token transactions.
      - `cardholderInformation` CardholderInformation, nullable — Information about the holder of the card.
        - `cardholderName` string, required — Cardholder name
        - `companyName` string, nullable — Identifies the associated company name
      - `contactDetails` ContactDetails, nullable — Contact details
        - `phoneNumber` string, nullable — Phone number.
        - `email` string, email, nullable — Contains the customer's email address. For standard email protocols, visit: https://www.rfc-editor.org/rfc/rfc5322
      - `billingAddress` object, nullable — The postal address including street, town/city, province, and postal code. Optionally an unit number can be provided.
        - `unitNumber` string, nullable — Unit number
        - `streetNumber` string, nullable — Street number
        - `streetName` string, nullable — Street name
        - `city` string, nullable — Identifies the city.
        - `province` string, iso-3166-2, nullable — Province or state ISO 3166-2 code
        - `postalCode` string, nullable — Postal or zip code
        - `country` string, iso-3166, nullable — Provides the two letter country code according the ISO 3166-1 alpha-2 standard. For a complete list of country codes, visit: https://en.wikipedia.org/wiki/ISO_3166-1_alpha-2.
      - `paymentMethodSource` 'PAYMENT_METHOD_ID' | 'CARD' | 'TEMPORARY_TOKEN' | 'PERMANENT_TOKEN' | 'APPLE_PAY_ENCRYPTED' | 'APPLE_PAY_DECRYPTED' | 'GOOGLE_PAY_ENCRYPTED' | 'GOOGLE_PAY_DECRYPTED', required — The source of Payment Method being used. It can be: - The Id of a Payment Method already created. - Permanent Token. - Temporary Token. - Card. - E-Wallet.
      - `customData` CustomData, nullable — Merchant can send custom meta data with the transaction in this object. Moneris will echo these values back in response.
    - object — Payment Method details. Note: If defined, this will result in the creation of Payment Method as defined in the Payment Method API.
      - `permanentToken` string, required — Created when a temporary token is created and returned. This acts as a unique profile identifier, and is a required value for temporary token transactions.
      - `cardholderInformation` CardholderInformation, nullable — Information about the holder of the card.
        - `cardholderName` string, required — Cardholder name
        - `companyName` string, nullable — Identifies the associated company name
      - `contactDetails` ContactDetails, nullable — Contact details
        - `phoneNumber` string, nullable — Phone number.
        - `email` string, email, nullable — Contains the customer's email address. For standard email protocols, visit: https://www.rfc-editor.org/rfc/rfc5322
      - `billingAddress` object, nullable — The postal address including street, town/city, province, and postal code. Optionally an unit number can be provided.
        - `unitNumber` string, nullable — Unit number
        - `streetNumber` string, nullable — Street number
        - `streetName` string, nullable — Street name
        - `city` string, nullable — Identifies the city.
        - `province` string, iso-3166-2, nullable — Province or state ISO 3166-2 code
        - `postalCode` string, nullable — Postal or zip code
        - `country` string, iso-3166, nullable — Provides the two letter country code according the ISO 3166-1 alpha-2 standard. For a complete list of country codes, visit: https://en.wikipedia.org/wiki/ISO_3166-1_alpha-2.
      - `paymentMethodSource` 'PAYMENT_METHOD_ID' | 'CARD' | 'TEMPORARY_TOKEN' | 'PERMANENT_TOKEN' | 'APPLE_PAY_ENCRYPTED' | 'APPLE_PAY_DECRYPTED' | 'GOOGLE_PAY_ENCRYPTED' | 'GOOGLE_PAY_DECRYPTED', required — The source of Payment Method being used. It can be: - The Id of a Payment Method already created. - Permanent Token. - Temporary Token. - Card. - E-Wallet.
      - `customData` CustomData, nullable — Merchant can send custom meta data with the transaction in this object. Moneris will echo these values back in response.
    - object — Payment Method details. Note: If defined, this will result in the creation of Payment Method as defined in the Payment Method API.
      - `cardholderInformation` CardholderInformation, nullable — Information about the holder of the card.
        - `cardholderName` string, required — Cardholder name
        - `companyName` string, nullable — Identifies the associated company name
      - `contactDetails` ContactDetails, nullable — Contact details
        - `phoneNumber` string, nullable — Phone number.
        - `email` string, email, nullable — Contains the customer's email address. For standard email protocols, visit: https://www.rfc-editor.org/rfc/rfc5322
      - `billingAddress` object, nullable — The postal address including street, town/city, province, and postal code. Optionally an unit number can be provided.
        - `unitNumber` string, nullable — Unit number
        - `streetNumber` string, nullable — Street number
        - `streetName` string, nullable — Street name
        - `city` string, nullable — Identifies the city.
        - `province` string, iso-3166-2, nullable — Province or state ISO 3166-2 code
        - `postalCode` string, nullable — Postal or zip code
        - `country` string, iso-3166, nullable — Provides the two letter country code according the ISO 3166-1 alpha-2 standard. For a complete list of country codes, visit: https://en.wikipedia.org/wiki/ISO_3166-1_alpha-2.
      - `paymentMethodSource` 'PAYMENT_METHOD_ID' | 'CARD' | 'TEMPORARY_TOKEN' | 'PERMANENT_TOKEN' | 'APPLE_PAY_ENCRYPTED' | 'APPLE_PAY_DECRYPTED' | 'GOOGLE_PAY_ENCRYPTED' | 'GOOGLE_PAY_DECRYPTED', required — The source of Payment Method being used. It can be: - The Id of a Payment Method already created. - Permanent Token. - Temporary Token. - Card. - E-Wallet.
      - `customData` CustomData, nullable — Merchant can send custom meta data with the transaction in this object. Moneris will echo these values back in response.
      - `applicationPrimaryAccountNumber` string, required — The unique identifier for the primary account number for the payment card.
      - `expiryMonth` integer, required — Card expiration month. Format must be MM
      - `expiryYear` integer, required — Displays the card expiration year. Accepted format: YYYY
      - `deviceManufacturerIdentifier` string, nullable — Hex-encoded device manufacturer identifier
      - `dataType` 'THREE_D_SECURE' | 'EMV', required — Only available to Canada integrations. Applies to merchants using their own API for transaction payload encryptions and is mandatory for INTERAC® e-Commerce Apple Pay and Google Pay transactions.
      - `cryptogram` string, required — Token cryptogram or encoded Base64 for Interac Wallets.
      - `cardBrand` 'MASTERCARD' | 'VISA' | 'AMERICAN_EXPRESS' | 'INTERAC' | 'DISCOVER', required — Card Brand.
      - `walletEcommerceIndicator` string, nullable — ECI Indicator as provided by the Wallet.
      - `walletIndicator` 'IN_APPLICATION' | 'IN_BROWSER', required — Only available to Canada integrations. Applies to merchants using their own API for transaction payload encryptions for Apple Pay and Google Pay transactions. **NOTE**: This field is mandatory for wallet transactions and is case senstive."
    - object — Payment Method details. Note: If defined, this will result in the creation of Payment Method as defined in the Payment Method API.
      - `cardholderInformation` CardholderInformation, nullable — Information about the holder of the card.
        - `cardholderName` string, required — Cardholder name
        - `companyName` string, nullable — Identifies the associated company name
      - `contactDetails` ContactDetails, nullable — Contact details
        - `phoneNumber` string, nullable — Phone number.
        - `email` string, email, nullable — Contains the customer's email address. For standard email protocols, visit: https://www.rfc-editor.org/rfc/rfc5322
      - `billingAddress` object, nullable — The postal address including street, town/city, province, and postal code. Optionally an unit number can be provided.
        - `unitNumber` string, nullable — Unit number
        - `streetNumber` string, nullable — Street number
        - `streetName` string, nullable — Street name
        - `city` string, nullable — Identifies the city.
        - `province` string, iso-3166-2, nullable — Province or state ISO 3166-2 code
        - `postalCode` string, nullable — Postal or zip code
        - `country` string, iso-3166, nullable — Provides the two letter country code according the ISO 3166-1 alpha-2 standard. For a complete list of country codes, visit: https://en.wikipedia.org/wiki/ISO_3166-1_alpha-2.
      - `paymentMethodSource` 'PAYMENT_METHOD_ID' | 'CARD' | 'TEMPORARY_TOKEN' | 'PERMANENT_TOKEN' | 'APPLE_PAY_ENCRYPTED' | 'APPLE_PAY_DECRYPTED' | 'GOOGLE_PAY_ENCRYPTED' | 'GOOGLE_PAY_DECRYPTED', required — The source of Payment Method being used. It can be: - The Id of a Payment Method already created. - Permanent Token. - Temporary Token. - Card. - E-Wallet.
      - `customData` CustomData, nullable — Merchant can send custom meta data with the transaction in this object. Moneris will echo these values back in response.
      - `displayName` string, required — Display Name
      - `cardBrand` 'MASTERCARD' | 'VISA' | 'AMERICAN_EXPRESS' | 'INTERAC' | 'DISCOVER', required — Card Brand.
      - `applePayVersion` 'EC_V1' | 'RSA_V1', required — Version information about the payment token. - EC_V1: For ECC-encrypted data - RSA_V1: For RSA-encrypted data
      - `data` string, byte, required — Encrypted payment data. Base64 encoded as a string.
      - `signature` string, required — Signature of the payment and header data, Base64 encoded as a string. The signature includes the signing certificate, its intermediate CA certificate, and information about the signing algorithm. Can be a detached PKCS #7 signature, Base64 encoded as a string
      - `publicKeyHash` string, required — Hash of the X.509 encoded public key bytes of the merchant’s certificate. Can be either a base64 encoded or SHA-256 Hash string.
      - `ephemeralPublicKey` string, byte, required — Ephemeral public key bytes. Only for RSA_v1. Can be either a base64 encoded string or X.509 bytes.
      - `applePayTransactionId` string, required — The Apple Pay unique identifier for a transaction such as an in-app purchase, restored in-app purchase, or subscription renewal.
      - `walletIndicator` 'IN_APPLICATION' | 'IN_BROWSER', required — Only available to Canada integrations. Applies to merchants using their own API for transaction payload encryptions for Apple Pay and Google Pay transactions. **NOTE**: This field is mandatory for wallet transactions and is case senstive."
    - object — Payment Method details. Note: If defined, this will result in the creation of Payment Method as defined in the Payment Method API.
      - `cardholderInformation` CardholderInformation, nullable — Information about the holder of the card.
        - `cardholderName` string, required — Cardholder name
        - `companyName` string, nullable — Identifies the associated company name
      - `contactDetails` ContactDetails, nullable — Contact details
        - `phoneNumber` string, nullable — Phone number.
        - `email` string, email, nullable — Contains the customer's email address. For standard email protocols, visit: https://www.rfc-editor.org/rfc/rfc5322
      - `billingAddress` object, nullable — The postal address including street, town/city, province, and postal code. Optionally an unit number can be provided.
        - `unitNumber` string, nullable — Unit number
        - `streetNumber` string, nullable — Street number
        - `streetName` string, nullable — Street name
        - `city` string, nullable — Identifies the city.
        - `province` string, iso-3166-2, nullable — Province or state ISO 3166-2 code
        - `postalCode` string, nullable — Postal or zip code
        - `country` string, iso-3166, nullable — Provides the two letter country code according the ISO 3166-1 alpha-2 standard. For a complete list of country codes, visit: https://en.wikipedia.org/wiki/ISO_3166-1_alpha-2.
      - `paymentMethodSource` 'PAYMENT_METHOD_ID' | 'CARD' | 'TEMPORARY_TOKEN' | 'PERMANENT_TOKEN' | 'APPLE_PAY_ENCRYPTED' | 'APPLE_PAY_DECRYPTED' | 'GOOGLE_PAY_ENCRYPTED' | 'GOOGLE_PAY_DECRYPTED', required — The source of Payment Method being used. It can be: - The Id of a Payment Method already created. - Permanent Token. - Temporary Token. - Card. - E-Wallet.
      - `customData` CustomData, nullable — Merchant can send custom meta data with the transaction in this object. Moneris will echo these values back in response.
      - `gatewayMerchantId` string, nullable — Gateway unique store id
      - `messageExpiration` string, date-time, nullable — Date and time at which the message expires. Integrators should reject any message that's expired.
      - `messageId` string, nullable — A unique ID that identifies the message in case it needs to be revoked or located at a later time.
      - `walletSource` 'CARD' | 'TOKENIZED_CARD', required — The type of the payment credential. Supported values are: - CARD - TOKENIZED_CARD
      - `cardBrand` 'MASTERCARD' | 'VISA' | 'AMERICAN_EXPRESS' | 'INTERAC', required — Card Network.
      - `walletIndicator` 'IN_APPLICATION' | 'IN_BROWSER', required — Only available to Canada integrations. Applies to merchants using their own API for transaction payload encryptions for Apple Pay and Google Pay transactions. **NOTE**: This field is mandatory for wallet transactions and is case senstive."
      - `cardDetails` GooglePayDecryptedCardDetails, required — The payment credential itself. The format of this object is determined by the paymentMethod
        - `personalAccountNumber` string, required — The personal account number charged. This string contains only digits.
        - `expiryMonth` integer, required — Card expiration month. Format must be MM
        - `expiryYear` integer, required — Displays the card expiration year. Accepted format: YYYY
        - `authenticationMethod` string, nullable — The authentication method of the card transaction. Must be forwarded as provided by Google Pay.
        - `cryptogram` string, nullable — Token cryptogram or encoded Base64 for Interac Wallets.
        - `walletEcommerceIndicator` string, nullable — ECI Indicator as provided by the Wallet.
    - object — Payment Method details. Note: If defined, this will result in the creation of Payment Method as defined in the Payment Method API.
      - `cardholderInformation` CardholderInformation, nullable — Information about the holder of the card.
        - `cardholderName` string, required — Cardholder name
        - `companyName` string, nullable — Identifies the associated company name
      - `contactDetails` ContactDetails, nullable — Contact details
        - `phoneNumber` string, nullable — Phone number.
        - `email` string, email, nullable — Contains the customer's email address. For standard email protocols, visit: https://www.rfc-editor.org/rfc/rfc5322
      - `billingAddress` object, nullable — The postal address including street, town/city, province, and postal code. Optionally an unit number can be provided.
        - `unitNumber` string, nullable — Unit number
        - `streetNumber` string, nullable — Street number
        - `streetName` string, nullable — Street name
        - `city` string, nullable — Identifies the city.
        - `province` string, iso-3166-2, nullable — Province or state ISO 3166-2 code
        - `postalCode` string, nullable — Postal or zip code
        - `country` string, iso-3166, nullable — Provides the two letter country code according the ISO 3166-1 alpha-2 standard. For a complete list of country codes, visit: https://en.wikipedia.org/wiki/ISO_3166-1_alpha-2.
      - `paymentMethodSource` 'PAYMENT_METHOD_ID' | 'CARD' | 'TEMPORARY_TOKEN' | 'PERMANENT_TOKEN' | 'APPLE_PAY_ENCRYPTED' | 'APPLE_PAY_DECRYPTED' | 'GOOGLE_PAY_ENCRYPTED' | 'GOOGLE_PAY_DECRYPTED', required — The source of Payment Method being used. It can be: - The Id of a Payment Method already created. - Permanent Token. - Temporary Token. - Card. - E-Wallet.
      - `customData` CustomData, nullable — Merchant can send custom meta data with the transaction in this object. Moneris will echo these values back in response.
      - `cardBrand` 'MASTERCARD' | 'VISA' | 'AMERICAN_EXPRESS' | 'INTERAC', required — Card Brand.
      - `signature` string, required — Verifies that the message came from Google. It's base64-encoded, and created with ECDSA by the intermediate signing key.
      - `googlePayProtocolVersion` string, required — Identifies the encryption or signing scheme under which the message is created. It allows the protocol to evolve over time, if needed. Must be fowarded as provided by Google Pay.
      - `signedMessage` string, required — A JSON object serialized as an HTML-safe string that contains the encryptedMessage, ephemeralPublicKey, and tag. It's serialized to simplify the signature verification process.
      - `walletIndicator` 'IN_APPLICATION' | 'IN_BROWSER', required — Only available to Canada integrations. Applies to merchants using their own API for transaction payload encryptions for Apple Pay and Google Pay transactions. **NOTE**: This field is mandatory for wallet transactions and is case senstive."
  - `threeDSecureMessageCategory` 'PAYMENT' | 'NON_PAYMENT', required — Identifies the category of the message for a specific use case.
  - `threeDSecureDeviceChannel` 'BROWSER' | 'THREE_D_SECURE_REQUESTOR_INITIATED', required — Indicates the type of channel interface being used to initiate the transaction.
  - `threeDSecureRequestType` 'CARDHOLDER' | 'RECURRING' | 'null', nullable — Type of payment that triggered the verification. - **CARDHOLDER**: Cardholder initiated payment. - **RECURRING**: Recurring payment.
  - `threeDSecureRecurringFrequency` integer, nullable — Indicates the minimum number of days between authorisations.
  - `threeDSecureRecurringExpiry` string, date, nullable — Date after which no further authorisations shall be performed. This is a required field for recurring transactions, we suggest setting it at a reasonably high value if you don't have a defined expiry date.
  - `threeDSecureRequestorInitiatedIndicator` 'RECURRING_TRANSACTION' | 'INSTALMENT_TRANSACTION' | 'ADD_CARD' | 'MAINTAIN_CARD_INFORMATION' | 'ACCOUNT_VERIFICATION' | 'SPLIT_DELAYED_SHIPMENT' | 'TOP_UP' | 'MAIL_ORDER' | 'TELEPHONE_ORDER' | 'WHITELIST_STATUS_CHECK' | 'OTHER_PAYMENT' | 'null', nullable — Indicates the type of 3RI request. This data element provides additional information to the ACS to determine the best approach for handing a 3RI request.
  - `threeDSecurePriorAuthenticationInformation` ThreeDSecurePriorAuthenticationInformation, nullable — Information about how the 3DS Requestor authenticated the cardholder as part of a previous 3DS transaction.
    - `threeDSecurePriorAuthenticationData` string, nullable — Data that documents and supports a specific authentication process. In the current version of the specification this data element is not defined in detail, however the intention is that for each 3DS Requestor Authentication Method, this field carry data that the ACS can use to verify the authentication process. In future versions of the specification, these details are expected to be included.
    - `threeDSecurePriorAuthenticationMethod` 'FRICTIONLESS_AUTHENTICATION_OCCURRED_BY_ACS' | 'CARDHOLDER_CHALLENGE_OCCURRED_BY_ACS' | 'AVS_VERIFIED' | 'OTHER_ISSUER_METHODS' | 'null', nullable — Mechanism used by the Cardholder to previously authenticate to the 3DS Requestor.
    - `threeDSecurePriorAuthenticationTimestamp` string, date-time, nullable — Date and time in UTC of the prior cardholder authentication.
    - `threeDSecurePriorAuthenticationReference` string, nullable — This data element provides additional information to the ACS to determine the best approach for handing a request.
  - `threeDSecureNotificationUrl` string, nullable — URL-encoded, fully qualified callback URL that receives the response or error message. Note: Request with URL that is not URL-encoded will be rejected for security reasons. Example (URL-encoded): https%3A%2F%2Fmerchant.example.com%2Fcallback%3ForderId%3D123
  - `threeDSecureCompletionIndicator` 'SUCCESS' | 'FAILURE' | 'UNAVAILABLE' | 'null', nullable — Indicates whether 3DS Card Lookup was successfully completed. A successful Card Lookup increases the chances of a frictionless card authentication. - **SUCCESS**: Successfully completed. - **FAILURE**: 3DS Card Lookup attempted, but failed. - **UNAVAILABLE**: Unavailable or not attempted.
  - `threeDSecureChallengeRequested` 'NO_PREFERENCE' | 'NO_CHALLENGE_REQUESTED' | 'CHALLENGE_REQUESTED_MANDATE' | 'null', nullable — Indicates whether a browser-based challenge is requested for this transaction. Standard is 'No Preference'
  - `threeDSecureChallengeWindowSize` 'X_SMALL' | 'SMALL' | 'MEDIUM' | 'LARGE' | 'FULL_SCREEN' | 'null', nullable — Relates to the rendering of the challenge within the browser. - **X_SMALL**: 250 x 400 - **SMALL**: 390 x 400 - **MEDIUM**: 500 x 600 - **LARGE**: 600 x 400 - **FULL_SCREEN**: Full Screen
  - `browserIpAddress` string, ipv4, nullable, required — IP address the browser is connecting from.
  - `browserUserAgent` string, nullable — Exact content of the HTTP user-agent header. Note, when total length exceeds 2048 characters, truncate the excess portion.
  - `browserJavaEnabled` boolean — Indicates whether Java is enabled in the browser
  - `browserJavascriptEnabled` boolean — Indicates whether Javascript is enabled in the browser
  - `browserScreenHeight` integer, required — Defines the pixel height of the cardholder's screen.
  - `browserScreenWidth` integer, required — Defines the pixel width of the cardholder's screen.
  - `browserLanguage` string, iso-639, nullable — Provides the two letter language code according the ISO 639-1 standard. For a complete list of language codes, visit: https://en.wikipedia.org/wiki/List_of_ISO_639-1_codes.

## Response `201`

3DS Secure authentication was successfully created & executed.

- ThreeDSecureAuthentication
  - `threeDSecureAuthenticationId` string, required — Used to identify API resources which may be required for future follow-on transactions; i.e. Refunds, Corrections, Completions, Reversals, etc.
  - `cardLookupId` string, nullable — Used to identify API resources which may be required for future follow-on transactions; i.e. Refunds, Corrections, Completions, Reversals, etc.
  - `merchantId` string, required — Thirteen character long identification provided to merchants by Moneris.
  - `orderId` string, nullable — Indicates the merchant-defined transaction identifer or order ID. Identifiers are unique for every Purchase, Pre-Authorization and Independent Refund transaction **Note**: No two transactions of these types may have the same order ID. Field only accepts alphanumerical characters, dashes and underscores.
  - `threeDSecureMessageType` 'AUTHENTICATION_RESPONSE_MESSAGE' | 'AUTHENTICATION_REQUEST_MESSAGE' | 'PREPARATION_RESPONSE_MESSAGE' | 'PREPARATION_REQUEST_MESSAGE' | 'CHALLENGE_RESPONSE_MESSAGE' | 'CHALLENGE_REQUEST_MESSAGE' | 'RESULTS_REQUEST_MESSAGE' | 'RESULTS_RESPONSE_MESSAGE' | 'ERROR_MESSAGE' | 'null', nullable — Indicates the response type in 3DS flow.
  - `threeDSecureTransactionStatus` 'AUTHENTICATED' | 'AUTHENTICATION_ATTEMPTED' | 'CHALLENGE_AUTHENTICATION_REQUIRED' | 'CHALLENGE_DECOUPLED_AUTHENTICATION_CONFIRMED' | 'TECHNICAL_ISSUE' | 'NOT_AUTHENTICATED' | 'REJECTED' | 'CHALLENGE_PREFERENCE_ACKNOWLEDGED', required — Indicates the Transaction result. For more information about this field, please review https://docs.3dsecure.io/3dsv2/specification_220.html#attr-ARes-transStatus - **AUTHENTICATED**: Authentication/ Account Verification Successful. - **AUTHENTICATION_ATTEMPTED**: Attempts Processing Performed; Not Authenticated/Verified , but a proof of attempted authentication/verification is provided. - **CHALLENGE_AUTHENTICATION_REQUIRED**: Challenge Required; Additional authentication is required using the `challengeUrl` and `challengeData`. - **CHALLENGE_DECOUPLED_AUTHENTICATION_CONFIRMED**: Challenge Required; Decoupled Authentication confirmed. - **TECHNICAL_ISSUE**: Authentication/ Account Verification Could Not Be Performed; Technical or other problem. - **NOT_AUTHENTICATED**: Not Authenticated /Account Not Verified; Transaction denied. - **REJECTED**: Authentication/ Account Verification Rejected; Issuer is rejecting authentication/verification and request that authorisation not be attempted. - **CHALLENGE_PREFERENCE_ACKNOWLEDGED**: Informational Only; 3DS Requestor challenge preference acknowledged.
  - `threeDSecureTransactionStatusReason` string, nullable — Provides information on why the Transaction Status field has the specified value.
  - `ecommerceIndicator` 'MAIL_TELEPHONE_ORDER_SINGLE' | 'MAIL_TELEPHONE_ORDER_RECURRING' | 'MAIL_TELEPHONE_ORDER_INSTALMENT' | 'MAIL_TELEPHONE_ORDER_UNKNOWN' | 'AUTHENTICATED_ECOMMERCE' | 'NON_AUTHENTICATED_ECOMMERCE' | 'SSL_MERCHANT', required — The ecommerce indicator (ECI) specifies the level of security that was used to obtain the cardholder's payment data. It is sent by the merchant and returned by the issuer. When returned in the response, it can be different from the value sent in the request in case transaction was downgraded by the issuer.
  - `threeDSecureChallengeUrl` string, uri, nullable — If the transStatus is “C” this field will be populated with the URL to POST the challengeData to create the cardholder challenge screen
  - `threeDSecureChallengeData` string, nullable — String that must be POSTed to the Challenge URL to create challenge screen
  - `threeDSecureAuthenticationValue` string, nullable — **CAVV**: Cardholder Authentication Verification Value Provided during a payment request to authenticate the card user.
  - `threeDSecureChallengeCompletionIndicator` 'YES' | 'NO' | 'null', nullable — Indicates if Challenge was completed. This is returned in CAVV Lookup Request.
  - `threeDSecureServerTransactionId` string, uuid, nullable — Indicates information required when sending a version 3-D Secure 2.0+ transaction. This data is obtained from a CAVV Lookup Request or MPI 3DS Authentication Request transaction.
  - `threeDSecureDirectoryServerTransactionId` string, uuid, nullable — Universally unique transaction identifier assigned by the 3DS Directory Server (DS) to identify a single transaction.
  - `threeDSecureAccessControlServerTransactionId` string, uuid, nullable — Required if sending a version 3-D Secure 2.0+ transaction. Data is obtained from a Cavv Lookup Request or MPI 3DS Authentication Request transaction
  - `paymentMethod` PaymentMethod, required — Payment method response object
    - `paymentMethodId` string, required — Unique Identifier of the payment method.
    - `merchantId` string, required — Thirteen character long identification provided to merchants by Moneris.
    - `cardholderInformation` CardholderInformation, nullable — Information about the holder of the card.
      - `cardholderName` string, required — Cardholder name
      - `companyName` string, nullable — Identifies the associated company name
    - `contactDetails` ContactDetails, nullable — Contact details
      - `phoneNumber` string, nullable — Phone number.
      - `email` string, email, nullable — Contains the customer's email address. For standard email protocols, visit: https://www.rfc-editor.org/rfc/rfc5322
    - `billingAddress` object, nullable — The postal address including street, town/city, province, and postal code. Optionally an unit number can be provided.
      - `unitNumber` string, nullable — Unit number
      - `streetNumber` string, nullable — Street number
      - `streetName` string, nullable — Street name
      - `city` string, nullable — Identifies the city.
      - `province` string, iso-3166-2, nullable — Province or state ISO 3166-2 code
      - `postalCode` string, nullable — Postal or zip code
      - `country` string, iso-3166, nullable — Provides the two letter country code according the ISO 3166-1 alpha-2 standard. For a complete list of country codes, visit: https://en.wikipedia.org/wiki/ISO_3166-1_alpha-2.
    - `paymentMethodInformation` CardPaymentMethodInformation, required — Details about the card used in the payment method.
      - `paymentMethodType` 'CARD', required — The type of Payment Method being used. It can be: - Card.
      - `paymentMethodSource` 'CARD' | 'TEMPORARY_TOKEN' | 'PERMANENT_TOKEN' | 'APPLE_PAY_ENCRYPTED' | 'APPLE_PAY_DECRYPTED' | 'GOOGLE_PAY_ENCRYPTED' | 'GOOGLE_PAY_DECRYPTED', required — The source of Payment Method being used. It can be: - The Id of a Payment Method already created. - Permanent Token. - Temporary Token. - Card. - E-Wallet.
      - `cardInformation` CardInformation, required — Information about the card being used for the transaction
        - `bankIdentificationNumber` string, nullable — **BIN**: Bank Identification Number Consists of the first six to eight digits of the Primary Account Number (PAN) and identifies the relevant payment network and the specific payment issuing institution.
        - `lastFour` string, nullable — Last 4 digits of the card.
        - `expiryMonth` integer — Card expiration month. Format must be MM
        - `expiryYear` integer — Displays the card expiration year. Accepted format: YYYY
        - `cardBrand` 'MASTERCARD' | 'VISA' | 'AMERICAN_EXPRESS' | 'JCB' | 'DISCOVER' | 'INTERAC' | 'UNIONPAY' | 'GIFT_MONERIS' | 'GIFT_DATACANDY' | 'GIFT_GIVEX' | 'null', nullable — Displays the card brand name associated with the card type.
        - `cardType` 'CREDIT' | 'DEBIT' | 'DOMESTIC_DEBIT' | 'PREPAID_RELOADABLE' | 'PREPAID_NON_RELOADABLE' | 'UNKNOWN' | 'GIFT' | 'LOYALTY' | 'FLEET' | 'CORPORATE', nullable — Specifies the intended card use; i.e. debit or credit.
        - `cardFingerprint` string, nullable — Unique card identifier. Fingerprinting randomly assigns identfiers for cards that share the same Primary Account Number (PAN) to easily identify when multiple payments methods are attached to the same underlying card, and assists merchants identify individual customers across various channels; i.e. loyalty programs.
        - `issuer` string, nullable — Card issuer.
      - `paymentAccountReference` string, nullable — Used to link Primary Account Number (PAN) based transactions and transactions on associated payment tokens without using the PAN as the linking mechanism.
      - `storePaymentMethod` 'DO_NOT_STORE' | 'CARDHOLDER_INITIATED' | 'MERCHANT_INITIATED', required — Store this payment method created through this payment for future use. - DO_NOT_STORE: Payment method will not be stored. - CARDHOLDER_INITIATED: Payment method to be stored and can only re-used with cardholder's consent. Limited to store, pre-authorisation, and card validations." - MERCHANT_INITIATED: Payment method to be stored and can be reused without the cardholder's consent. For example, subscriptions.
    - `createdAt` string, date-time, required — Time at which the object was created
    - `modifiedAt` string, date-time, nullable — Time at which the object was modified
    - `customData` CustomData, nullable — Merchant can send custom meta data with the transaction in this object. Moneris will echo these values back in response.
  - `threeDSecureCardholderInformation` string, nullable — Text provided by the ACS/Issuer to Cardholder during a Frictionless or Decoupled transaction. The Issuer can provide information to Cardholder.
  - `threeDSecureVersion` string, required — Required when sending a 3-D Secure version 2.0+ transaction. If no value is provided, default to V1.
  - `threeDSecureAuthenticationType` 'STATIC' | 'DYNAMIC' | 'OUT_OF_BAND' | 'DECOUPLED' | 'null', nullable — Indicates the type of authentication method the Issuer will use to challenge the Cardholder, whether in the ARes message or what was used by the ACS when in the RReq message.
  - `threeDSecureAuthenticationTimestamp` string, date-time, nullable — Date and time in UTC of the cardholder authentication.

## Other responses

- `202` — MPI Authentication operation resulted in a challenge.
- `400` — Bad Request.
- `401` — Not authorized. The user does not have a valid API Key or Access Token.
- `403` — Forbidden. The user does not have permission to access the requested resource.
- `409` — Request could not be completed due to a conflict with resource state or existing idempotency key.
- `422` — The API cannot complete the requested action due to semantic or business validation errors.
- `429` — Too Many Requests
- `500` — Unexpected error.
- `503` — Service Temporarily Unavailable

---

[API](https://skmtc.net/moneris/apis/moneris-api.md) · [All operations](https://skmtc.net/moneris/apis/moneris-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/moneris/moneris-api/revisions/edefcc925b74/schema)