---
title: "Get all 3-D Secure operations"
method: GET
path: "/issuers/{issuerId}/cards/{cardId}/3ds/operations"
tags: ["3-D Secure Operations"]
---

# Get all 3-D Secure operations

`GET /issuers/{issuerId}/cards/{cardId}/3ds/operations`

This request is used by the issuer backend to  retrieve all operations related to a card. The API specifies the starting point (offset) and the number of operations (limit) to be retrieved. Offset 0 (the default) corresponds to the most recent operation. For example a limit of 5 and an offset of 2 would return the five most recent operations before the most recent two”.

If no operations are available for the given cardId, an empty list is returned.

Operations that are older than one year are removed.

## Query parameters

- `offset` integer
- `limit` integer

## Response `200`

Successful

- object
  - `operations` 3dsCardOperation[]
    - `operationId` string, required — Unique identifier of the operation
    - `operation` '3DS_FRICTIONLESS' | '3DS_CHALLENGE_OOB' | '3DS_CHALLENGE_OOB_ISSUER' | '3DS_CHALLENGE_OTP_SMS', required — The operation type.
    - `status` 'SUCCESSFUL' | 'FAILED', required — Status of the operation
    - `startTime` string, required — The time the request has been processed. Format ISO 8601 YYYY-MM-DDThh:mm:ssTZD
    - `consumerId` string — Unique identifier of the end user.
    - `details` object
      - `acsTransactionId` string — The ACS transaction identifier.
      - `threeDSServerTransId` string — The authentication session identifier from the 3DS server.
      - `dsTransId` string — The authentication session identifier from the directory server.
      - `purchase` object
        - `merchantName` string — The merchant name.
        - `merchantType` string — The merchant category code.
        - `amount` string — The nominal transaction amount value. Value without the decimal operator. Use the currency exponent to display amount with decimal. For example, an display amount of 789.99€ Euro is sent as 78999.
        - `currencyCode` string — The transaction currency code. Currency code in ISO 4217 alpha code format.
        - `merchantId` string — The acquirer merchantId.
        - `countryCode` string — The merchant country code.
        - `merchantUrl` string, uri — The merchant URL.
      - `acquirer` object
        - `bin` string
        - `countryCode` string — The merchant country code.
      - `device` object
        - `deviceChannel` '01' | '02' | '03' — The device channel. '01' is App-based, '02' is Browser, '03' is 3DS Requestor Initiated.
        - `appInstanceId` string — Unique identifier of the issuer application instance.
        - `authnType` 'BIOMETRIC' | 'PLATFORM'
      - `eci` string — The Electronic Commerce Indicator.
      - `authenticationMethod` '02' | '07' | '09' — The Authentication method used in case of challenge flow. '02' is SMS OTP, '07' is OOB Biometrics, '09' is OOB Other.'
      - `transStatus` 'Y' | 'N' | 'U' | 'R' — Indicates whether a transaction qualifies as an authenticated transaction or account verification. |Operation Status|TransStatus Possible Values|TransStatus Description| |----|----|----| |SUCCESSFUL|Y|Authentication/account verification is successful| |FAILED|N|Not authenticated/account not verified; transaction denied| |FAILED|U|Authentication/account verification could not be performed; technical or other problem| |FAILED|R|Authentication/account verification rejected|
      - `transStatusReason` string — Provides information on why the Transaction Status field has the specified value.
      - `rba` object
        - `evaluatedRule` unknown[]
          - unknown
        - `selectedRule` unknown[]
          - unknown
        - `appliedExemption` unknown[]
          - unknown
      - `protocolVersion` string — Version of the 3DS protocol used for the transaction.
    - `error` string — Human readable string representing the error, only present in case of operation failure
  - `remainingOperations` integer

## Other responses

- `400` — Bad Request, Invalid request URI or header, or unsupported non-standard parameter
- `401` — The provided Authorization header is missing or invalid
- `404` — Resource not found
- `500` — Internal Server Error

---

[API](https://skmtc.net/thalescloud/apis/d1-oauth-api.md) · [All operations](https://skmtc.net/thalescloud/apis/d1-oauth-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/thalescloud/d1-oauth-api/revisions/96089514858c/schema)