---
title: "Create 3DS2 Setup"
method: POST
path: "/three-d-secure/setups"
---

# Create 3DS2 Setup

`POST /three-d-secure/setups`

Register the 3D Secure 2 setup data your integration has collected — the cardholder's browser environment and any pre-computed device fingerprints — and receive a `three_d_secure_setup_id` to reference on the subsequent `POST /v1/payments`.

## Request body

- object
  - `account_id` string, uuid, required — Account UUID that owns this 3DS2 setup.
  - `type` 'MERCHANT_PROVIDED', required — Source of the device data. `MERCHANT_PROVIDED` means you collected the browser/device data on your side and are passing it in directly.
  - `browser_info` object, required — Browser environment captured from the cardholder's session. Forwarded verbatim to the 3DS2 server for risk scoring and frictionless decisioning.
    - `user_agent` string, required — `navigator.userAgent` of the cardholder's browser.
    - `accept_header` string, required — Value of the `Accept` HTTP header sent by the browser.
    - `color_depth` string, required — `screen.colorDepth`, e.g. `"24"`.
    - `screen_height` string, required — `screen.height` in pixels.
    - `screen_width` string, required — `screen.width` in pixels.
    - `language` string, required — BCP-47 language tag from `navigator.language`, e.g. `"es-CO"`.
    - `javascript_enabled` boolean — Whether JavaScript is enabled. Defaults to `true` when omitted.
    - `java_enabled` boolean — Whether the Java plugin is enabled. Almost always `false` on modern browsers.
    - `browser_time_difference` string — UTC offset of the browser in minutes, signed (e.g. `"-300"` for UTC-5). Equivalent to `new Date().getTimezoneOffset()`.
    - `platform` 'WEB' | 'IOS' | 'ANDROID' — Channel that captured the data.
    - `accept_content` string — Optional `Accept-Encoding` value if you capture it.
    - `accept_browser` string — Optional `Accept-Language` value if you capture it.
  - `device_fingerprints` object[] — One or more provider-scoped device fingerprints already collected on your side. Yuno will not run device collection again for any `provider_id` you include here.
    - `provider_id` string, uuid, required — UUID of the fraud or device-intelligence connection in your Yuno account that produced this fingerprint. Find it in **Dashboard → Connections** or via `GET /v1/connections`.
    - `id` string, required — The fingerprint value as returned by that provider's collector.

## Response `201`

201

- object
  - `three_d_secure_setup_id` string — Generated identifier of the 3DS2 setup. Pass this under `payment_method.detail.card.three_d_secure.three_d_secure_setup_id` on the subsequent `POST /v1/payments`.
  - `account_id` string — Echo of the request `account_id`.
  - `type` string — Echo of the request `type`.
  - `browser_info` object — Echo of the request `browser_info`.
    - `user_agent` string
    - `accept_header` string
    - `color_depth` string
    - `screen_height` string
    - `screen_width` string
    - `language` string
    - `javascript_enabled` boolean
    - `java_enabled` boolean
    - `browser_time_difference` string
    - `platform` string
  - `device_fingerprints` object[] — Echo of the request `device_fingerprints`.
    - `provider_id` string
    - `id` string

## Other responses

- `400` — 400
- `401` — 401
- `403` — 403

---

[API](https://skmtc.net/y/apis/ai-caller.md) · [All operations](https://skmtc.net/y/apis/ai-caller/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/y/ai-caller/revisions/05b629819b49/schema)