Complete 3-D Secure after fingerprinting

Call this only after charge returned data.status of fingerprint_required, once the device-fingerprint iframe has reported completion or timed out. No session ID is needed, because it was stored against the payment during charge.

The response has the same shape as a charge. data.status is success, failed, or 3ds_required with data.threeDsHtml for the issuer challenge. Calling this at any other time is rejected.

When the issuer challenges the customer, the challenge frame posts back to Vestrapay’s 3-D Secure callback, which then sends your parent window a message with type set to vestrapay.3ds.complete. Listen for it, then confirm with verify on your server. As a fallback, watch the checkout.completed event on the checkout events stream.

POST

payment

checkout

charge

card

authenticate

Complete 3-D Secure after fingerprinting

curl --request POST \
  --url https://api.sandbox.vestrapay.app/v1/payment/checkout/charge/card/authenticate \
  --header 'Content-Type: application/json' \
  --header 'x-access-code: <api-key>' \
  --data '
{
  "browser": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36"
}
'

const options = {
  method: 'POST',
  headers: {'x-access-code': '<api-key>', 'Content-Type': 'application/json'},
  body: JSON.stringify({browser: 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36'})
};

fetch('https://api.sandbox.vestrapay.app/v1/payment/checkout/charge/card/authenticate', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

import requests

url = "https://api.sandbox.vestrapay.app/v1/payment/checkout/charge/card/authenticate"

payload = { "browser": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36" }
headers = {
    "x-access-code": "<api-key>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.sandbox.vestrapay.app/v1/payment/checkout/charge/card/authenticate",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'browser' => 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36'
  ]),
  CURLOPT_HTTPHEADER => [
    "Content-Type: application/json",
    "x-access-code: <api-key>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

{
  "status": "success",
  "data": {
    "status": "3ds_required",
    "reference": "VPY_TXN_ACME001",
    "threeDsHtml": "<iframe …></iframe>"
  }
}

Authorizations

x-access-code

string

header

required

The accessCode returned by initialise. Scoped to one payment and valid for 60 minutes. Safe to give to the customer's browser.

Body

application/json

Browser details for the 3-D Secure step. No session ID is needed.

browser

string

The browser user agent string.

browserDetails

object

The same browser details as on charge.

Response

Authentication result. Read data.status.

The outer status is success whenever the call worked, even when the card was declined. The outcome is data.status.

status

enum<string>

required

Available options:

success

data

object

required

Show child attributes

Complete 3-D Secure after fingerprinting

curl --request POST \
  --url https://api.sandbox.vestrapay.app/v1/payment/checkout/charge/card/authenticate \
  --header 'Content-Type: application/json' \
  --header 'x-access-code: <api-key>' \
  --data '
{
  "browser": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36"
}
'

const options = {
  method: 'POST',
  headers: {'x-access-code': '<api-key>', 'Content-Type': 'application/json'},
  body: JSON.stringify({browser: 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36'})
};

fetch('https://api.sandbox.vestrapay.app/v1/payment/checkout/charge/card/authenticate', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

import requests

url = "https://api.sandbox.vestrapay.app/v1/payment/checkout/charge/card/authenticate"

payload = { "browser": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36" }
headers = {
    "x-access-code": "<api-key>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.sandbox.vestrapay.app/v1/payment/checkout/charge/card/authenticate",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'browser' => 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36'
  ]),
  CURLOPT_HTTPHEADER => [
    "Content-Type: application/json",
    "x-access-code: <api-key>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

{
  "status": "success",
  "data": {
    "status": "3ds_required",
    "reference": "VPY_TXN_ACME001",
    "threeDsHtml": "<iframe …></iframe>"
  }
}

Payments

Checkout

Complete 3-D Secure after fingerprinting

Authorizations

Body

Response