---
title: "Create a protection provider on the given merchant profile"
method: POST
path: "/protection/providers"
tags: ["protection_provider"]
---

# Create a protection provider on the given merchant profile

`POST /protection/providers`

Create a Protection Provider on the given Merchant Profile. A Protection Provider can be used as part of [authorize](https://developer.spreedly.com/reference/authorize), [purchase](https://developer.spreedly.com/reference/purchase), and [verify](https://developer.spreedly.com/reference/verify) transactions. **At least one card type object must be included in the request.** The following card types are supported: `Visa`, `Mastercard`, `American Express`, `Discover`, `Diners`, `JCB`, `Dankort`, `Union Pay`, and `Cartes Bancaires`.

## Request body

- ProtectionProvider
  - `merchant_profile_key` string, required — The token returned upon creating a Merchant Profile
  - `type` string, required — The type of Protection Provider being created. Currently two types are supported: `spreedly` or `test` (case sensitive)
  - `three_ds_enabled` boolean — Enable 3DS2 Global for this Protection Provider. See [Protect documentation](https://developer.spreedly.com/docs/protect) for more details.
  - `visa` ScaProviderVisa — A nested object containing merchant info per card brand that is to be registered with the 3DS server. See `acquirer_bin`, `merchant_url`, and `merchant_password` below for nested field information
    - `acquirer_bin` string, required — The Acquirer Bank Identification Number (BIN) is identifying BIN for an acquiring bank. The BIN is used to submit authorization requests and ensure that payments are routed to the correct institution.
    - `merchant_url` string, required — Fully qualified URL of the merchant’s main website or customer care site that contains a method of contact.
    - `merchant_password` string — An old parameter for 3DS v1, unrelated to 3DS2. We support this parameter for those merchants who already have it activated and are migrating to our 3DSS, not for new ones. If you do not know the parameter, don’t take it into account.
    - `merchant_brand_id` string — An optional parameter for an id issued to a merchant by a particular card scheme. When passed in the `visa` subhash it can be used to enable DAF via 3DS2 Global.
  - `mastercard` ScaProviderCardDetails — A nested object containing merchant info per card brand that is to be registered with the 3DS server. See `acquirer_bin`, `merchant_url`, and `merchant_password` below for nested field information
    - `acquirer_bin` string, required — The Acquirer Bank Identification Number (BIN) is identifying BIN for an acquiring bank. The BIN is used to submit authorization requests and ensure that payments are routed to the correct institution.
    - `merchant_url` string, required — Fully qualified URL of the merchant’s main website or customer care site that contains a method of contact.
    - `merchant_password` string — An old parameter for 3DS v1, unrelated to 3DS2. We support this parameter for those merchants who already have it activated and are migrating to our 3DSS, not for new ones. If you do not know the parameter, don’t take it into account.
  - `amex` ScaProviderCardDetails — A nested object containing merchant info per card brand that is to be registered with the 3DS server. See `acquirer_bin`, `merchant_url`, and `merchant_password` below for nested field information
    - `acquirer_bin` string, required — The Acquirer Bank Identification Number (BIN) is identifying BIN for an acquiring bank. The BIN is used to submit authorization requests and ensure that payments are routed to the correct institution.
    - `merchant_url` string, required — Fully qualified URL of the merchant’s main website or customer care site that contains a method of contact.
    - `merchant_password` string — An old parameter for 3DS v1, unrelated to 3DS2. We support this parameter for those merchants who already have it activated and are migrating to our 3DSS, not for new ones. If you do not know the parameter, don’t take it into account.
  - `discover` ScaProviderCardDetails — A nested object containing merchant info per card brand that is to be registered with the 3DS server. See `acquirer_bin`, `merchant_url`, and `merchant_password` below for nested field information
    - `acquirer_bin` string, required — The Acquirer Bank Identification Number (BIN) is identifying BIN for an acquiring bank. The BIN is used to submit authorization requests and ensure that payments are routed to the correct institution.
    - `merchant_url` string, required — Fully qualified URL of the merchant’s main website or customer care site that contains a method of contact.
    - `merchant_password` string — An old parameter for 3DS v1, unrelated to 3DS2. We support this parameter for those merchants who already have it activated and are migrating to our 3DSS, not for new ones. If you do not know the parameter, don’t take it into account.
  - `diners` ScaProviderCardDetails — A nested object containing merchant info per card brand that is to be registered with the 3DS server. See `acquirer_bin`, `merchant_url`, and `merchant_password` below for nested field information
    - `acquirer_bin` string, required — The Acquirer Bank Identification Number (BIN) is identifying BIN for an acquiring bank. The BIN is used to submit authorization requests and ensure that payments are routed to the correct institution.
    - `merchant_url` string, required — Fully qualified URL of the merchant’s main website or customer care site that contains a method of contact.
    - `merchant_password` string — An old parameter for 3DS v1, unrelated to 3DS2. We support this parameter for those merchants who already have it activated and are migrating to our 3DSS, not for new ones. If you do not know the parameter, don’t take it into account.
  - `jcb` ScaProviderCardDetails — A nested object containing merchant info per card brand that is to be registered with the 3DS server. See `acquirer_bin`, `merchant_url`, and `merchant_password` below for nested field information
    - `acquirer_bin` string, required — The Acquirer Bank Identification Number (BIN) is identifying BIN for an acquiring bank. The BIN is used to submit authorization requests and ensure that payments are routed to the correct institution.
    - `merchant_url` string, required — Fully qualified URL of the merchant’s main website or customer care site that contains a method of contact.
    - `merchant_password` string — An old parameter for 3DS v1, unrelated to 3DS2. We support this parameter for those merchants who already have it activated and are migrating to our 3DSS, not for new ones. If you do not know the parameter, don’t take it into account.
  - `dankort` ScaProviderCardDetails — A nested object containing merchant info per card brand that is to be registered with the 3DS server. See `acquirer_bin`, `merchant_url`, and `merchant_password` below for nested field information
    - `acquirer_bin` string, required — The Acquirer Bank Identification Number (BIN) is identifying BIN for an acquiring bank. The BIN is used to submit authorization requests and ensure that payments are routed to the correct institution.
    - `merchant_url` string, required — Fully qualified URL of the merchant’s main website or customer care site that contains a method of contact.
    - `merchant_password` string — An old parameter for 3DS v1, unrelated to 3DS2. We support this parameter for those merchants who already have it activated and are migrating to our 3DSS, not for new ones. If you do not know the parameter, don’t take it into account.
  - `union_pay` ScaProviderCardDetails — A nested object containing merchant info per card brand that is to be registered with the 3DS server. See `acquirer_bin`, `merchant_url`, and `merchant_password` below for nested field information
    - `acquirer_bin` string, required — The Acquirer Bank Identification Number (BIN) is identifying BIN for an acquiring bank. The BIN is used to submit authorization requests and ensure that payments are routed to the correct institution.
    - `merchant_url` string, required — Fully qualified URL of the merchant’s main website or customer care site that contains a method of contact.
    - `merchant_password` string — An old parameter for 3DS v1, unrelated to 3DS2. We support this parameter for those merchants who already have it activated and are migrating to our 3DSS, not for new ones. If you do not know the parameter, don’t take it into account.
  - `cartes_bancaires` ScaProviderCardDetails — A nested object containing merchant info per card brand that is to be registered with the 3DS server. See `acquirer_bin`, `merchant_url`, and `merchant_password` below for nested field information
    - `acquirer_bin` string, required — The Acquirer Bank Identification Number (BIN) is identifying BIN for an acquiring bank. The BIN is used to submit authorization requests and ensure that payments are routed to the correct institution.
    - `merchant_url` string, required — Fully qualified URL of the merchant’s main website or customer care site that contains a method of contact.
    - `merchant_password` string — An old parameter for 3DS v1, unrelated to 3DS2. We support this parameter for those merchants who already have it activated and are migrating to our 3DSS, not for new ones. If you do not know the parameter, don’t take it into account.

## Response `201`

Created

- ProtectionProviderResponse
  - `protection_provider` object
    - `token` string — The token identifying your newly created Protection Provider. Can be used as the `protection_provider_token` field on [authorize](https://developer.spreedly.com/reference/authorize-1) and [purchase](https://developer.spreedly.com/reference/purchase) transactions.
    - `three_ds_enabled` boolean — If 3DS is enabledfor this Protection Provider.
    - `created_at` string — The time the protection provider was created
    - `updated_at` string — The time the protection provider was last updated
    - `type` string — The type of Protection Provider being created. Currently two types are supported: `spreedly` or `test` (case sensitive)
    - `visa` ScaProviderVisa — A nested object containing merchant info per card brand that is to be registered with the 3DS server. See `acquirer_bin`, `merchant_url`, and `merchant_password` below for nested field information
      - `acquirer_bin` string, required — The Acquirer Bank Identification Number (BIN) is identifying BIN for an acquiring bank. The BIN is used to submit authorization requests and ensure that payments are routed to the correct institution.
      - `merchant_url` string, required — Fully qualified URL of the merchant’s main website or customer care site that contains a method of contact.
      - `merchant_password` string — An old parameter for 3DS v1, unrelated to 3DS2. We support this parameter for those merchants who already have it activated and are migrating to our 3DSS, not for new ones. If you do not know the parameter, don’t take it into account.
      - `merchant_brand_id` string — An optional parameter for an id issued to a merchant by a particular card scheme. When passed in the `visa` subhash it can be used to enable DAF via 3DS2 Global.
    - `mastercard` ScaProviderCardDetails — A nested object containing merchant info per card brand that is to be registered with the 3DS server. See `acquirer_bin`, `merchant_url`, and `merchant_password` below for nested field information
      - `acquirer_bin` string, required — The Acquirer Bank Identification Number (BIN) is identifying BIN for an acquiring bank. The BIN is used to submit authorization requests and ensure that payments are routed to the correct institution.
      - `merchant_url` string, required — Fully qualified URL of the merchant’s main website or customer care site that contains a method of contact.
      - `merchant_password` string — An old parameter for 3DS v1, unrelated to 3DS2. We support this parameter for those merchants who already have it activated and are migrating to our 3DSS, not for new ones. If you do not know the parameter, don’t take it into account.
    - `amex` ScaProviderCardDetails — A nested object containing merchant info per card brand that is to be registered with the 3DS server. See `acquirer_bin`, `merchant_url`, and `merchant_password` below for nested field information
      - `acquirer_bin` string, required — The Acquirer Bank Identification Number (BIN) is identifying BIN for an acquiring bank. The BIN is used to submit authorization requests and ensure that payments are routed to the correct institution.
      - `merchant_url` string, required — Fully qualified URL of the merchant’s main website or customer care site that contains a method of contact.
      - `merchant_password` string — An old parameter for 3DS v1, unrelated to 3DS2. We support this parameter for those merchants who already have it activated and are migrating to our 3DSS, not for new ones. If you do not know the parameter, don’t take it into account.
    - `discover` ScaProviderCardDetails — A nested object containing merchant info per card brand that is to be registered with the 3DS server. See `acquirer_bin`, `merchant_url`, and `merchant_password` below for nested field information
      - `acquirer_bin` string, required — The Acquirer Bank Identification Number (BIN) is identifying BIN for an acquiring bank. The BIN is used to submit authorization requests and ensure that payments are routed to the correct institution.
      - `merchant_url` string, required — Fully qualified URL of the merchant’s main website or customer care site that contains a method of contact.
      - `merchant_password` string — An old parameter for 3DS v1, unrelated to 3DS2. We support this parameter for those merchants who already have it activated and are migrating to our 3DSS, not for new ones. If you do not know the parameter, don’t take it into account.
    - `diners` ScaProviderCardDetails — A nested object containing merchant info per card brand that is to be registered with the 3DS server. See `acquirer_bin`, `merchant_url`, and `merchant_password` below for nested field information
      - `acquirer_bin` string, required — The Acquirer Bank Identification Number (BIN) is identifying BIN for an acquiring bank. The BIN is used to submit authorization requests and ensure that payments are routed to the correct institution.
      - `merchant_url` string, required — Fully qualified URL of the merchant’s main website or customer care site that contains a method of contact.
      - `merchant_password` string — An old parameter for 3DS v1, unrelated to 3DS2. We support this parameter for those merchants who already have it activated and are migrating to our 3DSS, not for new ones. If you do not know the parameter, don’t take it into account.
    - `jcb` ScaProviderCardDetails — A nested object containing merchant info per card brand that is to be registered with the 3DS server. See `acquirer_bin`, `merchant_url`, and `merchant_password` below for nested field information
      - `acquirer_bin` string, required — The Acquirer Bank Identification Number (BIN) is identifying BIN for an acquiring bank. The BIN is used to submit authorization requests and ensure that payments are routed to the correct institution.
      - `merchant_url` string, required — Fully qualified URL of the merchant’s main website or customer care site that contains a method of contact.
      - `merchant_password` string — An old parameter for 3DS v1, unrelated to 3DS2. We support this parameter for those merchants who already have it activated and are migrating to our 3DSS, not for new ones. If you do not know the parameter, don’t take it into account.
    - `dankort` ScaProviderCardDetails — A nested object containing merchant info per card brand that is to be registered with the 3DS server. See `acquirer_bin`, `merchant_url`, and `merchant_password` below for nested field information
      - `acquirer_bin` string, required — The Acquirer Bank Identification Number (BIN) is identifying BIN for an acquiring bank. The BIN is used to submit authorization requests and ensure that payments are routed to the correct institution.
      - `merchant_url` string, required — Fully qualified URL of the merchant’s main website or customer care site that contains a method of contact.
      - `merchant_password` string — An old parameter for 3DS v1, unrelated to 3DS2. We support this parameter for those merchants who already have it activated and are migrating to our 3DSS, not for new ones. If you do not know the parameter, don’t take it into account.
    - `union_pay` ScaProviderCardDetails — A nested object containing merchant info per card brand that is to be registered with the 3DS server. See `acquirer_bin`, `merchant_url`, and `merchant_password` below for nested field information
      - `acquirer_bin` string, required — The Acquirer Bank Identification Number (BIN) is identifying BIN for an acquiring bank. The BIN is used to submit authorization requests and ensure that payments are routed to the correct institution.
      - `merchant_url` string, required — Fully qualified URL of the merchant’s main website or customer care site that contains a method of contact.
      - `merchant_password` string — An old parameter for 3DS v1, unrelated to 3DS2. We support this parameter for those merchants who already have it activated and are migrating to our 3DSS, not for new ones. If you do not know the parameter, don’t take it into account.
    - `cartes_bancaires` ScaProviderCardDetails — A nested object containing merchant info per card brand that is to be registered with the 3DS server. See `acquirer_bin`, `merchant_url`, and `merchant_password` below for nested field information
      - `acquirer_bin` string, required — The Acquirer Bank Identification Number (BIN) is identifying BIN for an acquiring bank. The BIN is used to submit authorization requests and ensure that payments are routed to the correct institution.
      - `merchant_url` string, required — Fully qualified URL of the merchant’s main website or customer care site that contains a method of contact.
      - `merchant_password` string — An old parameter for 3DS v1, unrelated to 3DS2. We support this parameter for those merchants who already have it activated and are migrating to our 3DSS, not for new ones. If you do not know the parameter, don’t take it into account.

## Other responses

- `401` — Unauthorized
- `422` — Unprocessable

---

[API](https://skmtc.net/spreedly/apis/spreedly-api-v1.md) · [All operations](https://skmtc.net/spreedly/apis/spreedly-api-v1/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/spreedly/spreedly-api-v1/versions/72ba4e23e65c/schema)