---
title: "Risk Call"
method: POST
path: "/pws/risk/"
tags: ["VCAS"]
---

# Risk Call

`POST /pws/risk/`

Risk request is communicated by the VCAS platform to the partner for risk decisioning.

## Request body

- RiskRequest
  - `IssuerId` string, required — Cardinal provided identifier for the partner. Length - Up to 24 Characters
  - `ProcessorId` string, required — Cardinal provided identifier for the partner. Length - Up to 24 Characters
  - `TransactionId` string, required — VCAS generated transaction reference id. Length - Up to 36 Characters. GUID format for EMV 3DS.
  - `DSTransactionId` string — Directory Server (DS) generated transaction reference id. GUID Format. EMV 3DS only.
  - `MerchantChallengeIndicator` string — Indicates whether the merchant requested a challenge.
  - `3RIIndicator` string — Indicates the type of 3RI request for EMV transactions.
  - `NonPaymentAuthenticationIndicator` string — Type of Non-Payment Authentication.
  - `MessageVersion` string — Version of the message based on 3DS spec. Examples - 2.1.0, 2.2.0
  - `RDXMessageVersion` string — Version of the RDX protocol being used.
  - `MessageCategory` string — Message category: 01=PA, 02=NPA, 03-99 reserved.
  - `RiskScore` string — Transaction risk score determined by VCAS (if available). 2 chars.
  - `RuleOutcome` string — VCAS rule evaluation result: SUCCESS, FAIL, CHALLENGE, REJECTED, ERROR.
  - `CardBrandName` string — Card brand name.
  - `ExemptionInfo` ExemptionInfo — Information related to EMV exemptions in the risk request.
    - `MerchantFraudRate` string — Merchant fraud rate in the EEA calculated as per PSD2 RTS.
    - `SecureCorporatePayment` string — Indicates use of dedicated payment processes for potential exemption.
    - `MCRiskScore` string — Mastercard risk score from AReq message extension (Mastercard only).
    - `WhitelistStatus` string — Indicates current whitelist status as indicated by the 3DS Server. Values: Y, N, E, P, R, U.
    - `WhitelistStatusSource` string — Origin of whitelisting request from authentication request. Values: Merchant, DS.
  - `MerchantAuthInfo` RiskMerchantAuthInfo — Merchant authentication information for EMV requests.
    - `DecoupledRequestIndicator` string — Requests ACS utilization of decoupled authentication. Values: DecoupledPreferred, NoDecoupledPreferred.
    - `DecoupledMaxTime` string — Maximum wait time for decoupled authentication results (1-10080 minutes).
  - `MerchantInfo` MerchantInfo
    - `merchantId` string
    - `merchantName` string
  - `TransactionInfo` RiskTransactionInfo — Transaction information including payment details.
    - `TransactionTimeStamp` string — Transaction timestamp in UTC per ISO 8601 UTC. Length - 24 Characters e.g 2019-03-21T20:55:49.000Z
    - `TransactionAmount` number — Transaction Amount (raw amount, example 1000 for $10.00). Length - Up to 48 Characters
    - `TransactionCurrency` string — ISO 4217 3 digit numeric standard.[ISO 4217 Link] https://en.wikipedia.org/wiki/ISO_4217 Length - 3 Characters
    - `TransactionExponent` integer — Exponent for formatting the given currency ISO 4217 code. Length - 1 Character
    - `TransactionType` 'Purchase' | 'CardAdd' — Type of the transaction.
    - `MandatedRegion` 'EEA' | 'NONE' | 'UNKNOWN' — A value describing the region in which mandates may apply to the current transaction. Added to support the new PSD2 transactions in the EEA. A value of EEA will denote that the transaction falls under the PSD2 mandates, otherwise the value will be null. Note - you must account for new values being added to this field over time due to new regulations being rolled out in other regions
    - `Channel` 'WEB' | 'APP' | 'MWEB' | 'THREERI' — Channel in which the transaction occurs.
    - `TransactionAmountUSD` number — Transaction amount converted to USD.
    - `AddressMatch` string — Indicates whether the shipping address matches the billing address. Y or N.
    - `TriggeredRuleName` string — Name of the triggered risk processing rule.
    - `PaymentInfo` PaymentInfo — Payment information
      - `CardExpiryMonth` string, required — Expiration month
      - `CardExpiryYear` string, required — Expiration year. For 3DS1 Transactions this value is 4-digits e.g. 2019. For 3DS2 Transactions this value is 2-digits e.g. 19.
      - `CardNumber` string, required — Payment card number used in transaction. Length - between 13 and 19 Characters
      - `CardType` 'Credit' | 'Debit' | 'NotApplicable' — Card or account type e.g. Debit or Credit.
      - `CardHolderName` string — Name of the cardholder. Length - Up to 45 Characters
    - `MerchantAdditionalData` object — Merchant additional data including shipping, delivery, and gift card details.
    - `BillingAddress` object — Billing address details.
    - `ShippingAddress` object — Shipping address details.
    - `ConsumerInfo` object — Consumer contact information including email and phone numbers.
    - `ConsumerWalletInfo` object — Wallet provider and age details.
    - `DeviceInfo` object — Device and browser information.
    - `RiskProviderInfo` object — Risk engine provider identification.
    - `RecurringInfo` object — Recurring transaction frequency and expiry.
    - `ThreeDSRequestorPriorAuthenticationInfo` object — Prior authentication documentation for 3DS Requestor.
  - `ExtensionData` RiskExtensionData — DAF extension data and other extensions in the risk request.
    - `DAFExtension` object — DAF extension data containing AuthPayCredStatus, AuthPayProcessReqInd, DafAdvice, Version.
    - `VisaPaymentTokenExtension` object — Visa Payment Token extension data containing TokenRequestorId, TokenStatusIndicator, TokenAdditionalData, Version, Token, TokenAssuranceMethod, TokenCryptogram, TokenCryptogramValidityIndicator.

## Response `200`

Successful Response

- RiskResponse
  - `IssuerId` string, required — Echoed from Request. Length - Up to 24 Characters
  - `ProcessorId` string, required — Echoed from Request. Length - Up to 24 Characters
  - `Status` 'SUCCESS' | 'FAILURE' | 'RETRY' | 'PENDING' | 'BLOCKED' | 'STEPUP' | 'ERROR' | 'ATTEMPTS' | 'FAILWITHFEEDBACK' | 'REJECTED' | 'FAIL' | 'CHALLENGE' | 'AUTHENTICATED' | 'SUCCESS' | 'FAIL' | 'FAILWITHFEEDBACK' | 'CHALLENGE' | 'REJECTED' | 'ERROR', required — Status of Risk Request. Possible values: SUCCESS, FAIL, FAILWITHFEEDBACK, CHALLENGE, REJECTED, ERROR.
  - `TransactionId` string, required — Echoed from Request. Length - Up to 36 Characters
  - `TransStatusReason` string — Provides information on why the Transaction Status field has the specified value. 2 chars.
  - `Language` string — Language for cardholder prompts (e.g., en, en-US). Up to 50 chars.
  - `RiskIndicator` string — Used in AV creation for EMV 3DS. Up to 3 chars (hex).
  - `RiskScore` string — Client-determined risk score (00-99). 2 chars.
  - `ExemptionResponse` ExemptionResponse — Response to exemption request in the risk response.
    - `WhitelistStatus` string — Indicates whether the whitelist exemption was accepted. Values: Y, N, E, P, R, U.
  - `Reason` Reason — An object that can be used for sending a status code and description.
    - `ReasonCode` string — Used by the issuer for informational purposes. Length - Up to 32 Characters
    - `ReasonDescription` string — Used by the issuer for informational purposes. Length - Up to 256 Characters
  - `Error` ErrorMessage — An object that can be used to convey an error message on the response.
    - `ReferenceNumber` string — System reference number for the error message. Length - Up to 15 Characters
    - `Description` string — A description of the error. Length - Up to 50 Characters
    - `Message` string — A message that will be displayed to the customer on the error screen. Length - Up to 100 Characters
    - `ReasonDescription` string — Used by the issuer for informational purposes. Up to 256 characters.
  - `WhyInfo` WhyInfo — Object defining dynamic text values that can be shown to the consumer during the challenge flow. These fields will be mapped directly to both browser templates and SDK info fields. Note: this field is also configurable for SDK screens today via our template configuration. If this value is passed on RDX it will override the current configurable value.
    - `Label` string — Label to be displayed to the Cardholder for the "why" information section.
    - `Text` string — Text provided by the Issuer to be displayed to the Cardholder to explain why the Cardholder is being asked to perform the authentication task. Note: Carriage return is supported in this data element and is represented by an “\n”.

## Other responses

- `404` — Webservices does not exist
- `500` — Internal Server error

---

[API](https://skmtc.net/paymentology/apis/payapi-docs.md) · [All operations](https://skmtc.net/paymentology/apis/payapi-docs/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/paymentology/payapi-docs/revisions/a675891b0365/schema)