---
title: "Continue taking payment after the initial attempt."
method: POST
path: "/payment-sessions/continue-payment"
tags: ["Payments"]
---

# Continue taking payment after the initial attempt.

`POST /payment-sessions/continue-payment`

Submit additional data for payment sessions that require further action after using `attempt-payment`.
**Note** that our SDKs handle this step automatically.

## Headers

- `Account` string

## Request body

- ContinuePaymentRequestBody
  - `clientSecret` string, required — The client secret of the payment session.
  - `threeDs` union, required — Supply the result of a 3ds fingerprint/challenge step. Provide `fingerprint` (web) or `appAuthentication` (native iOS/Android) after the Identify step, or `challengeResult` after the Challenge step.
    - object
      - `fingerprint` string, required — Base64-encoded string returned after the 3DS fingerprinting step.
      - `appAuthentication` ContinueThreeDsAppAuthentication — Result of the app-based 3DS Identify step, returned by the native 3DS SDK (Ravelin) running in the merchant's app. Used in place of `fingerprint` for native iOS / Android flows. The values here are produced after handling the [`RequiredActionIdentifyApp`](#tag/Payments-Service/operation/getPaymentSession) action returned on the payment session.
        - `sdkAppId` string, required — SDK Application ID generated by the 3DS SDK for this transaction.
        - `sdkEncData` string, required — Encrypted device data (JWE) produced by the 3DS SDK.
        - `sdkEphemeralPublicKey` string, required — Ephemeral public key produced by the 3DS SDK.
        - `sdkMaxTimeoutInMinutes` integer, required — Maximum time (minutes) the SDK will wait for the issuer to respond. EMVCo 3DS 2 mandates a minimum of 5 minutes.
        - `sdkReferenceNumber` string, required — SDK reference number identifying the 3DS SDK build.
        - `sdkTransId` string, required — SDK transaction ID generated for this 3DS authentication.
        - `deviceRenderOptions` ThreeDsDeviceRenderOptions, required — Challenge UI rendering options supported by the device.
          - `sdkInterface` '01' | '02' | '03', required — The interface type the SDK can render. `01` = Native, `02` = HTML, `03` = Both.
          - `sdkUiTypes` string[], required — The challenge UI types the SDK can render. `01` = Text, `02` = Single-select, `03` = Multi-select, `04` = Out-of-band, `05` = HTML (browser only).
      - `challengeResult` string — Base64-encoded string returned after the 3DS challenge step.
    - object
      - `fingerprint` string — Base64-encoded string returned after the 3DS fingerprinting step.
      - `appAuthentication` ContinueThreeDsAppAuthentication, required — Result of the app-based 3DS Identify step, returned by the native 3DS SDK (Ravelin) running in the merchant's app. Used in place of `fingerprint` for native iOS / Android flows. The values here are produced after handling the [`RequiredActionIdentifyApp`](#tag/Payments-Service/operation/getPaymentSession) action returned on the payment session.
        - `sdkAppId` string, required — SDK Application ID generated by the 3DS SDK for this transaction.
        - `sdkEncData` string, required — Encrypted device data (JWE) produced by the 3DS SDK.
        - `sdkEphemeralPublicKey` string, required — Ephemeral public key produced by the 3DS SDK.
        - `sdkMaxTimeoutInMinutes` integer, required — Maximum time (minutes) the SDK will wait for the issuer to respond. EMVCo 3DS 2 mandates a minimum of 5 minutes.
        - `sdkReferenceNumber` string, required — SDK reference number identifying the 3DS SDK build.
        - `sdkTransId` string, required — SDK transaction ID generated for this 3DS authentication.
        - `deviceRenderOptions` ThreeDsDeviceRenderOptions, required — Challenge UI rendering options supported by the device.
          - `sdkInterface` '01' | '02' | '03', required — The interface type the SDK can render. `01` = Native, `02` = HTML, `03` = Both.
          - `sdkUiTypes` string[], required — The challenge UI types the SDK can render. `01` = Text, `02` = Single-select, `03` = Multi-select, `04` = Out-of-band, `05` = HTML (browser only).
      - `challengeResult` string — Base64-encoded string returned after the 3DS challenge step.
    - object
      - `fingerprint` string — Base64-encoded string returned after the 3DS fingerprinting step.
      - `appAuthentication` ContinueThreeDsAppAuthentication — Result of the app-based 3DS Identify step, returned by the native 3DS SDK (Ravelin) running in the merchant's app. Used in place of `fingerprint` for native iOS / Android flows. The values here are produced after handling the [`RequiredActionIdentifyApp`](#tag/Payments-Service/operation/getPaymentSession) action returned on the payment session.
        - `sdkAppId` string, required — SDK Application ID generated by the 3DS SDK for this transaction.
        - `sdkEncData` string, required — Encrypted device data (JWE) produced by the 3DS SDK.
        - `sdkEphemeralPublicKey` string, required — Ephemeral public key produced by the 3DS SDK.
        - `sdkMaxTimeoutInMinutes` integer, required — Maximum time (minutes) the SDK will wait for the issuer to respond. EMVCo 3DS 2 mandates a minimum of 5 minutes.
        - `sdkReferenceNumber` string, required — SDK reference number identifying the 3DS SDK build.
        - `sdkTransId` string, required — SDK transaction ID generated for this 3DS authentication.
        - `deviceRenderOptions` ThreeDsDeviceRenderOptions, required — Challenge UI rendering options supported by the device.
          - `sdkInterface` '01' | '02' | '03', required — The interface type the SDK can render. `01` = Native, `02` = HTML, `03` = Both.
          - `sdkUiTypes` string[], required — The challenge UI types the SDK can render. `01` = Text, `02` = Single-select, `03` = Multi-select, `04` = Out-of-band, `05` = HTML (browser only).
      - `challengeResult` string, required — Base64-encoded string returned after the 3DS challenge step.

## Response `200`

Request ok, check the 'status' field to determine if the payment was successful. If `status` remains in `PendingAction` then further action is required before the payment can be authorized. Check the `requiredAction` field for the next step.

- PublicPaymentSession
  - `id` string — The unique identifier for the payment
  - `amount` integer — The amount of the sale/purchase in minor digits
  - `currency` string — The ISO currency code
  - `customerEmail` string, nullable — The email address of the customer
  - `enabledPaymentMethods` string[] — List of payment method types that can be used to complete payment for this PaymentSession. `Card` is the default and will allow all card schemes configured on your account (Visa, Mastercard etc.). Apple Pay & Google Pay are classified as `Card` types and will be displayed provided you have confogured them properly.
  - `paymentMethod` PaymentSessionPaymentMethod, nullable
    - `type` 'Card'
    - `tokenizedDetails` PaymentSessionPaymentMethodTokenizedDetails, nullable — The details of any tokenized payment method used
      - `id` string — The Id of the tokenized payment method
      - `stored` boolean — Flag to indicate whether or not the tokenized payment method was stored (against the customer)
    - `card` object, nullable — Details of the card used
      - `scheme` 'Visa' | 'Mastercard' | 'Amex'
      - `last4` string — The last 4 digits of the card used
      - `binDetails` CardBinDetails, nullable — The specific details obtained from the BIN/IIN of the card. Note that this is not always available.
        - `issuer` string, nullable — Name of the card issuer
        - `issuerCountry` string, nullable — The two-character ISO 3166 country code of the card issuer
        - `fundingType` 'Debit' | 'Credit' | 'Prepaid' | 'DeferredDebit' | 'Charge', nullable — Refers to how money for purchases comes to the card.
        - `productType` 'Consumer' | 'Corporate', nullable — The category the issuer assigns to the particular card
    - `wallet` object, nullable — Details of the wallet used (Google Pay / Apple Pay)
      - `type` 'GooglePay' | 'ApplePay'
    - `billingAddress` CustomerAddress, nullable
      - `firstName` string — The first name of the customer
      - `lastName` string — The last name of the customer
      - `lineOne` string — First line of the address
      - `lineTwo` string — Second line of the address
      - `city` string — The address city/town
      - `country` string, required — The two-character ISO country code
      - `postalCode` string, required — The postal code/zip of the address
      - `region` string, nullable — The state/county/province/region Required if the address is in the US/Canada and must be a 2-character ISO state/province code
    - `checks` PaymentMethodChecks, nullable
      - `avsResponseCode` string, nullable — The response from Address Verification Service (AVS) that determines the match or partial match of the customer's billing address. Possible values: - A - Partial Match (street address matches, postal/zip code does not match) - B - Partial Match (street address matches, postal/zip code not verified) - C - No Match (street address and postal/zip code not verified) - D - Full Match (street address and postal/zip code match) - F - Full Match (street address and postal/zip code match) - G - Not Supported (address information not verified) - I - No Match (address information not verified) - M - Full Match (street address and postal/zip code match) - N - No Match (neither street address not postal/zip code match) - P - Partial Match (postal/zip code matches, street address not verified) - R - System Unavailable (unable to perform verification) - S - Not Supported (AVS currently not supported by issuer) - U - System Unavailable (address information not verified due to no data from issuer) - W - Partial Match (postal/zip code matches, street address does not match) - X - Full Match (street address and postal/zip code match) - Y - Full Match (street address and postal/zip code match) - Z - Partial Match (postal/zip code matches, street address does not match)
      - `cvvResponseCode` string, nullable — The response from the check on the Card Verification Value (CVV/CVV2/CVC) Possible values: - M - Match (Visa and MC) - Y - Match (Amex) - N - No Match - P - Not Processed - S - Should be on card - U - Issuer does not participate
  - `status` 'PendingPayment' | 'PendingAction' | 'Processing' | 'Approved' | 'Captured' | 'Voided'
  - `lastError` 'insufficient_funds' | 'declined_do_not_honour' | 'invalid_card_number' | 'cvv2_failure' | 'restricted_card' | 'blacklisted_card' | 'blacklisted_bin' | 'blacklisted_country' | 'blacklisted_ip' | 'risk_declined' | 'security_violation' | 'expired_card' | 'gateway_reject' | 'suspected_fraud' | 'contact_issuer' | 'not_permitted' | 'invalid_account' | 'pickup_card' | 'stolen_card' | 'issuer_decline' | 'closed_account' | 'account_not_activated' | 'limit_exceeded' | 'withdrawal_limit_exceeded' | 'blocked_by_cardholder' | '3ds_authentication_failure' | '3ds_cardholder_not_participating' | '3ds_authentication_required' | 'payment_method_option_amex_disabled' | 'cvc_required' | 'payment_method_not_available' | 'payment_method_option_amex_not_available' | 'credit_card_not_permitted' | 'issuer_error' | 'system_error' | 'unknown_error', nullable — The most recent error when attempting to Pay. Note that we may add further values without notice.
  - `requiredAction` RequiredAction, nullable — The action to take (if any) in order to authorise the payment. This will be non-null if the customer's bank challenge the payment (i.e. 3DS)
    - `type` 'Redirect' | 'Identify' | 'Challenge' — The type of action
    - `url` string, nullable — The url to redirect to (if the requiredAction has type `Redirect`)
    - `identify` union
      - object, nullable — Contains the details required to perform device data collection during 3DS (for browser/web authentication only) We recommend using our embedded SDK to handle this action for you.
        - `uniqueId` string, nullable — A uniqueId used to identify the transaction within the 3ds-server
        - `threeDsMethodUrl` string
        - `threeDsMethodSignature` string
        - `sessionId` string
        - `sessionSecret` string
        - `threeDsMethodData` string
        - `scheme` string
        - `paymentMethodId` string — The Id of the tokenized payment method belonging to this 3DS session
      - object, nullable — Contains the details required to perform device data collection during 3DS (for native iOS & Android) **Note** that this is subject to change and should only be handled by our native SDKs.
        - `sessionId` string
        - `sessionSecret` string
        - `scheme` string, required
        - `paymentMethodId` string, required — The Id of the tokenized payment method belonging to this 3DS session
        - `protocolVersion` string — The 3DS message protocol version the native SDK should target when creating the Ravelin transaction.
        - `ravelinPublicKey` string — The Ravelin public API key. Used as a Bearer token when initialising the Ravelin 3DS service on iOS / Android.
    - `challenge` union — Details required to perform the 3DS challenge step for browser/web or native iOS & Android flows.
      - object
        - `acsUrl` string, required — Fully qualified URL of the ACS to be used for the 3DS challenge
        - `cReq` string, required — base64 encoded challenge request message
        - `threeDSServerTransactionID` string — 3DS Server transaction ID issued for this authentication.
        - `acsTransactionID` string — ACS transaction ID returned by the issuer's ACS.
        - `acsRefNumber` string — ACS reference number identifying the issuer's ACS implementation.
        - `acsSignedContent` string — Signed JWS from the ACS containing the challenge protocol data.
      - object
        - `acsUrl` string — Fully qualified URL of the ACS to be used for the 3DS challenge
        - `cReq` string — base64 encoded challenge request message
        - `threeDSServerTransactionID` string, required — 3DS Server transaction ID issued for this authentication.
        - `acsTransactionID` string, required — ACS transaction ID returned by the issuer's ACS.
        - `acsRefNumber` string, required — ACS reference number identifying the issuer's ACS implementation.
        - `acsSignedContent` string, required — Signed JWS from the ACS containing the challenge protocol data.
  - `shippingDetails` ShippingDetails, nullable
    - `address` object, nullable
      - `firstName` string — The first name of the customer
      - `lastName` string — The last name of the customer
      - `lineOne` string — First line of the address
      - `lineTwo` string — Second line of the address
      - `city` string — The address city/town
      - `country` string, required — The two-character ISO country code
      - `postalCode` string, required — The postal code/zip of the address
      - `region` string, nullable — The state/county/province/region Required if the address is in the US/Canada and must be a 2-character ISO state/province code
    - `phoneNumber` string, nullable — The phone number of the recipient receiving the goods, in E.164 format
  - `returnUrl` string — URL to send the customer back to after a redirection (e.g. 3DS). We will always append the paymentSessionId under query param `ps`.
  - `createdTimestamp` integer — The epoch timestamp (seconds) when the payment was created
  - `lastUpdatedTimestamp` integer — The epoch timestamp (seconds) when the payment was last updated

## Other responses

- `400` — One or more inputs are invalid
- `500` — An unexpected error occurred when executing this request

---

[API](https://skmtc.net/ryftpay/apis/ryft-payment-api.md) · [All operations](https://skmtc.net/ryftpay/apis/ryft-payment-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/ryftpay/ryft-payment-api/versions/a042f64d4305/schema)