API Reference
Dashboard LoginRequest a Test Account

Cardholder Authentication API for 3DS

post
https://au.gsc.verifone.cloud/oidc/3ds-service/v2/lookup

The Cardholder Authentication API for 3DS authenticates the cardholder and leads to a challenge flow or a frictionless flow adhering to the Strong Customer Authentication (SCA) directive. For further details, refer to Server-to-Server Payments with 3D Secure.

Body Params
string
enum

Length of time cardholder has had account. Possible Values: * 01 - No account * 02 - Created during transaction * 03 - Less than 30 days * 04 - 30-60 days * 05 - More than 60 days

Allowed:
date

Date the cardholder's account was last changed. This includes changes to the billing or shipping address, new payment accounts or new users added. Format: YYYYMMDD

string
enum

Length of time since the last change to the cardholder account. This includes shipping address, new payment account or new user added. Possible Values: * 01 - Changed during transaction * 02 - Less than 30 days * 03 - 30-60 days * 04 - More than 60 days

Allowed:
date

Date the cardholder opened the account. Format: YYYYMMDD

string
length ≤ 64

Additional cardholder account information.

number
≤ 9999

Number of purchases with this cardholder account during the previous six months.

date

Date the cardholder last changed or reset password on account. Format: YYYYMMDD

string
enum

Length of time since the cardholder changed or reset the password on the account. Possible Values: * 01 - No change * 02 - Changed during transaction * 03 - Less than 30 days * 04 - 30-60 days * 05 - More than 60 days

Allowed:
string
enum

An override field that a merchant can pass in to set the challenge window size to display to the end cardholder.The ACS will reply with content that is formatted appropriately to this window size to allow for the best user experience. The sizes are width x height in pixels of the window displayed in the cardholder browser window. Possible values: * 01 - 250x400 * 02 - 390x400 * 03 - 500x600 * 04 - 600x400 * 05 - Full page

Allowed:
number
≤ 999

Number of add card attempts in the last 24 hours.

string
enum

Indicates whether cardholder billing and shipping addresses match. Possible Values: * Y - Shipping address matches billing address * N - Shipping address does not match billing address

Allowed:
string
length ≤ 128

An alias that uniquely identifies the account. NOTE: This field is required if Tokenization is enabled in the Merchant profile settings.

string
length ≤ 2048

Data that documents and supports a specific authentication process that was sent in the AlternateAuthenticationMethod field.

date

Date and time in UTC of the cardholder authentication. Format: YYYYMMDDHHMM

string
enum

Mechanism used by the cardholder to authenticate to the 3DS requester. Possible Values: * 01 - No authentication occurred (e.g. Guest Checkout) * 02 - Login to the cardholder account at the Merchant system using Merchant system credentials * 03 - Login to the cardholder account at the Merchant system using a Federated ID * 04 - Login to the cardholder account at the Merchant system using Issuer credentials * 05 - Login to the cardholder account at the Merchant system using third-party authentication * 06 - Login to the cardholder account at the Merchant system using FIDO Authenticator

Allowed:
string
enum

Indicates the type of Authentication request. 01 - Payment transaction 02 - Recurring transaction 03 - Installment transaction 04 - Add card 05 - Maintain card 06 - Cardholder verification as part of EMV token ID&V

Allowed:
number
required
≤ 9007199254740991

The amount of the transaction.

string
required
length ≤ 22

Consumer's billing first name.

string
required
length ≤ 22

Consumer's last name.

string
length ≤ 20

Conditional: Consumer's phone number for billing address. This should be unformatted without hyphens. ITU/E.123 format with international prefix (+PPNNNNNNNNN...)

string
required
length ≤ 50

Consumer's billing address information.

string
length ≤ 50

Conditional: Consumer's billing address information.

string
length ≤ 50

Conditional: Consumer's billing address information.

string
required
length ≤ 50

Consumer's city on their billing address.

string
length ≤ 16

Consumer's postal code of their billing address. Required unless market or regional mandate restricts sending this information.

string
length ≤ 50

Consumer's state or province of their billing address. ISO 3166-2 format as sub division code. Required unless market or regional mandate restricts sending this information, or State is not applicable for this country.

string
required

Consumer's alpha 2 digit ISO 3166 country code.

string

The ID of the card that is checked for enrollment.
Note: The card is required if encrypted_card or reuse_token is not provided.

string

Client encrypted cardholder data. The cardholder data encrypted using the OnlinePay provided public key. This needs to be provided in base64 encoded format. The data to encrypt is a JSON with possible tags being cardNumber, sequenceNumber, cardholderName, startMonth, startYear, expiryMonth, expiryYear, cvv. Additionally a tag called captureTime must be presenting indicating the time the card was captured in UTC in format RFC 3339, section 5.6. eg. 2019-08-24T14:15:22Z. Sample JSON to encrypt:

    {
        "captureTime": '2019-08-24T14:15:22Z',
        "cardNumber": '5555555555554444',
        "expiryMonth": 1,
        "expiryYear": 2025,
        "cvv": '123',
    }

Note: encrypted_card is required if card or reuse_token is not provided.

string

The alias for the public key used to encrypt this card.
Note: public_key_alias is required if card or reuse_token is not provided.

string
length between 16 and 255

The OnlinePay issued reuse token used to represent the previously stored cardholder data.
Note: reuse_token is required if card or encrypted_card is not provided.

string
required
length between 3 and 3

Alphabetical ISO 4217 currency code for the sale amount.

string
enum

Type of cards used for purchase. Possible Values: * VSA - Visa * MSC - Mastercard * VSD - Visa Delta/Debit (UK) * VSE - Visa Electron * MAE - Maestro (UK, Spain & Austria) AMX - American Express * DSC - Discover * DIN - Diners * CBLA - Carte Blanche JCB - JCB * ENR - EnRoute * JAL - JAL * CTB - Carte Bleue * DNK - Dankort * CSI - CartaSi * EAN - Encoded Account Number UATP - UATP * MAEI - Maestro (International) * CB - Cartes Bancaires

number
≤ 9999

Merchant category code (MCC) NOTE: This field is required by Mastercard and Visa Brazil extensions.

string
enum

NOTE: This is a 2.0 required field, Cardinal will default to 01 on Merchant Configuration - can be overridden by the merchant. Possible Values: * 01 - No preference * 02 - No challenge requested * 03 - Challenge requested (3DS Requestor Preference) * 04 - Challenge requested (Mandate) * 90 - Used to call the CB Scoring platform

Allowed:
string
required

Device infromation ID that relates to the device data that was previously collected.

string
length ≤ 255

For electronic delivery, email address to which the merchandise was delivered.

string
enum

Indicates the delivery timeframe. Possible Values: * 01 - Electronic delivery * 02 - Same day shipping * 03 - Overnight shipping * 04 - Two or more days shipping

Allowed:
string
enum

Determines the channel that the transaction came through. Possible Values: * SDK * Browser * 3RI NOTE: SDK will dynamically set SDK when using the Mobile SDK or Browser when customer is using our JavaScript SDK. Client will need to set 3RI for Merchant Initiated or 3RI transactions.

Allowed:
device_data_info
object
string
required

Consumer's email address.

string
enum

Indicates whether the merchant experienced suspicious activity (including previous fraud) on the account. Possible Values: * 01 - No suspicious activity * 02 - Suspicious activity observed

Allowed:
number
≤ 999999999999999

The purchase amount total for prepaid gift cards in major units. Example: $123.45 USD = 12345

number
≤ 99

Total count of individual prepaid gift cards purchased.

string
length between 3 and 3

ISO 4217 currency code for the gift card purchased.

number
2 to 999

Indicates the maximum number of authorizations for installment payments. An integer value greater than 1 indicating the maximum number of permitted authorizations for installment payments. ** Required for Recurring and Installment transactions, when authenticationIndicator="02" & "03" **

string
required

Order Number or transaction identifier from the Merchant commerce website.

string
length ≤ 20

The global score calculated by the CB Scoring platform.

string
enum

Category of the message for a specific use case. Possible Values:

  • 01 - PA (payment)/ NPA (non payment) with amount 0
  • 02 - NPA (non payment) NOTE: Default is payment (01). Configured on Merchant account, or can be overridden on transaction.
Allowed:
string

Cardholder's phone number. ITU/E.123 format with international prefix (+PPNNNNNNNNN...). Required unless market or regional mandate restricts sending this information.

date

Date when the payment account was added to the cardholder account. Format: YYYYMMDD

string
enum

Indicates the length of time that the payment account was enrolled in the merchant account. Possible Values: * 01 - No account (guest checkout) * 02 - During the transaction * 03 - Less than 30 days * 04 - 30-60 days * 05 - More than 60 days

Allowed:
string
enum

The value from this field will be mapped to the data field on the CB-USECASE extension. NOTE: Required for CB transactions (required if MessageCategory = PA, or MessageCategory = NPA and AuthenticationIndicator = 02 or 03).

  • Possible Values:
    • 01 - Single Payment
    • 02 - Fixed Amount and Term Subscription
    • 03 - Payment By Instalments
    • 04 - Payment By Shipment
    • 05 - Other Recurring Payments
Allowed:
date

Expected date that a pre-ordered purchase will be available. Format: YYYYMMDD

string
enum

Indicates whether the cardholder is placing an order with a future availability or release date. Possible Values: * 01 - Merchandise available * 02 - Future availability

Allowed:
string
length ≤ 2048

This field carry data that the ACS can use to verify the authentication process

string
enum

Mechanism used by the Cardholder to previously authenticate to the 3DS Requestor. * 01 - Frictionless authentication occurred by ACS * 02 - Cardholder challenge occurred by ACS * 03 - AVS verified * 04 - Other issuer methods

Allowed:
string
length ≤ 36

This data element contains a ACS Transaction ID for a prior authenticated transaction. For example, the first recurring transaction that was authenticated with the cardholder

date

Date and time in UTC of the prior cardholder authentication. Format: YYYYMMDDHHMM

string
enum

Merchant product code. Possible Values: * PHY - Goods/Service Purchase * CHA - Check Acceptance * ACF - Account Funding * QCT - Quasi-Cash Transaction * PAL - Prepaid Activation and Load NOTE: This value defaults to PHY. This field can be used to override that value if applicable.

Allowed:
date

Date of original purchase. Format: YYYYMMDDHHMMSS NOTE: If not passed, SDK will use current date. Required for recurring transactions. ** Required for Recurring and Installment transactions, when authenticationIndicator="02" & "03" **

date

The date after which no further recurring authorizations should be performed. Format: YYYYMMDD ** Required for Recurring and Installment transactions, when authenticationIndicator="02" & "03" **

number
≤ 9999

Conditional: Integer value indicating the minimum number of days between recurring authorizations. A frequency of monthly is indicated by the value 28. Multiple of 28 days will be used to indicate months. Example: 6 months = 168 ** Required for Recurring and Installment transactions, when authenticationIndicator="02" & "03" **

string
enum

Indicates whether the cardholder is placing an order with a future availability or release date. Possible Values: * 01 - Merchandise available * 02 - Future availability

Allowed:
string
length ≤ 35

This value is a Directory Server assigned 3DS Requestor ID value, each DS may provide a unique ID. NOTE: This is a 2.0 value only and if passed will override the Requestor ID value that is, configured on the Merchant's profile.

string
length ≤ 40

This value is a Directory Server assigned 3DS Requestor Name value, each DS may provide a unique ID. NOTE: This is a 2.0 value only and if passed will override the Requestor Name value that is configured on the Merchant's profile.

number
≤ 99

This field indicates the maximum amount of time for all 3DS 2.0 messages to be communicated between all components (in minutes). Possible Values: * Greater than or equal to 05 (05 is the minimum timeout to set) * Cardinal Default is set to 15 * NOTE: This field is a required 3DS 2.0 field and Cardinal sends in a default of 15 if nothing is passed.

string
length ≤ 50

Conditional: Consumer's shipping address information.

string
length ≤ 50

Conditional: Consumer's shipping address information.

string
length ≤ 50

Conditional: Consumer's shipping address information.

date

Date when the shipping address used for this transaction was first used. Format: YYYYMMDD

string
enum

Indicates when the shipping address used for transaction was first used. Possible Values: * 01 - This transaction * 02 - Less than 30 days * 03 - 30-60 days * 04 - More than 60 days

Allowed:
string
length ≤ 50

Conditional: Consumer's city of their shipping address.

string

Conditional: Consumer's alpha 2 digit ISO 3166 country code.

string
enum

Indicates shipping method chosen for the transaction. Possible Values: * 01 - Ship to cardholder billing address * 02 - Ship to another verified address on file with merchant * 03 - Ship to address that is different than billing address * 04 - Ship to store (store address should be populated on request) * 05 - Digital goods * 06 - Travel and event tickets, not shipped * 07 - Other

Allowed:
string
enum

Indicates if the cardholder name on the account is identical to the shipping name used for the transaction. Possible Values: * 01 - Account and shipping name identical * 02 - Account and shipping name differ

Allowed:
string
length ≤ 16

Conditional: Consumer's postal code of their shipping address.

string
length ≤ 50

Conditional: Consumer's state or province of their shipping address. ISO 3166-2 format as sub division code.

string
required

The ID of the threeDSContractId used.

string
enum

Indicates the type of 3RI request. Possible Values: * 01 - Recurring transaction * 02 - Installment transaction * 03 - Add card * 04 - Maintain card * 05 - Account verification * 06 - Split/delayed shipment * 07 - Top-up * 08 - Mail Order * 09 - Telephone Order * 10 - Whitelist status check * 11 - Other payment

string
enum
deprecated

This field contains the 3DS version that can be leveraged to force a transaction down the 1.0 rails.

Allowed:
string
length ≤ 100

The third party token that will be used to process the transaction in place of the actual card number. NOTE: This field is required if Tokenization is enabled in the Merchant profile setting AND the Merchant is using a third party token in place of the Cardinal token.

string
enum

Transaction mode identifier. Identifies the channel the transaction originates from. Available Options: M - Moto (Mail Order Telephone Order) P - Mobile Device R - Retail (Physical Store) S - Computer Device T - Tablet Device

Allowed:
number
≤ 999

Number of transactions (successful or abandoned) for this cardholder account within the last 24 hours.

number
≤ 999

Number of transactions (successful or abandoned) for this cardholder account within the last year.

string
length between 2 and 2

Number of purchased items or services Possible Values:
00-99

string
length ≤ 25

Conditional: Consumer's work phone number. ITU/E.123 format with international prefix (+PPNNNNNNNNN...)

Responses

Updated 8 months ago

Language
Credentials
Basic
base64
:
URL
LoadingLoading…
Response
Click Try It! to start a request and see the response here! Or choose an example:
application/json

Updated 8 months ago

Terms and conditions Website requirements Other fees and charges

This information is a general statement for information purposes only and should only be used as a guide. While all care has been taken in preparation of this document, no member of the Westpac Group, nor any of their employees or directors gives any warranty of accuracy or reliability nor accepts any liability in any other way, including by reason of negligence for any errors or omissions contained herein, to the extent permitted by law. Unless otherwise specified, the products and services described are available only in Australia.

© Westpac Banking Corporation ABN 33 007 457 141 AFSL and Australian credit licence 233714.