curl --request POST \
--url https://api-sandbox.rinne.com.br/core/v1/transactions/{transactionId}/authenticate \
--header 'Content-Type: application/json' \
--header 'x-api-key: <api-key>' \
--data '
{
"three_d_secure_session_id": "550e8400-e29b-41d4-a716-446655440000"
}
'import requests
url = "https://api-sandbox.rinne.com.br/core/v1/transactions/{transactionId}/authenticate"
payload = { "three_d_secure_session_id": "550e8400-e29b-41d4-a716-446655440000" }
headers = {
"x-api-key": "<api-key>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {'x-api-key': '<api-key>', 'Content-Type': 'application/json'},
body: JSON.stringify({three_d_secure_session_id: '550e8400-e29b-41d4-a716-446655440000'})
};
fetch('https://api-sandbox.rinne.com.br/core/v1/transactions/{transactionId}/authenticate', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api-sandbox.rinne.com.br/core/v1/transactions/{transactionId}/authenticate",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'three_d_secure_session_id' => '550e8400-e29b-41d4-a716-446655440000'
]),
CURLOPT_HTTPHEADER => [
"Content-Type: application/json",
"x-api-key: <api-key>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api-sandbox.rinne.com.br/core/v1/transactions/{transactionId}/authenticate"
payload := strings.NewReader("{\n \"three_d_secure_session_id\": \"550e8400-e29b-41d4-a716-446655440000\"\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("x-api-key", "<api-key>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api-sandbox.rinne.com.br/core/v1/transactions/{transactionId}/authenticate")
.header("x-api-key", "<api-key>")
.header("Content-Type", "application/json")
.body("{\n \"three_d_secure_session_id\": \"550e8400-e29b-41d4-a716-446655440000\"\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api-sandbox.rinne.com.br/core/v1/transactions/{transactionId}/authenticate")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["x-api-key"] = '<api-key>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"three_d_secure_session_id\": \"550e8400-e29b-41d4-a716-446655440000\"\n}"
response = http.request(request)
puts response.read_body{
"id": "tx_123456789",
"provider": "CELCOIN",
"affiliation_id": "a3dbd0c2-9f79-4f86-8caa-47779b3f2793",
"request_id": "request-123",
"mcc": "5411",
"amount": 10050,
"currency": "BRL",
"pricing": {
"fee": {
"percentage": 2.5,
"flat": 50,
"minimum_price": 100
},
"cost": {
"percentage": 2.5,
"flat": 50,
"minimum_price": 100
}
},
"status": "APPROVED",
"capture_method": "EMV",
"installments": 1,
"payment_method": "PIX",
"automatic_anticipation": false,
"origin": "INTERNAL",
"company_id": "a3dbd0c2-9f79-4f86-8caa-47779b3f2793",
"created_at": "2023-12-01T10:00:00.000Z",
"fee_policy_id": "fee_policy_123",
"cost_policy_id": "cost_policy_123",
"approved_amount": 10050,
"refunded_amount": 0,
"three_d_secure_session_id": "550e8400-e29b-41d4-a716-446655440000",
"acquirer_response_code": "00",
"pix_data": {
"pix_key_id": "pix_key_123",
"description": "Payment for order #123",
"qr_code": "00020126580014br.gov.bcb.pix0136a3dbd0c2-9f79-4f86-8caa-47779b3f2793520400005303986540510.005802BR5913Test Company6008São Paulo62070503***6304E2CA",
"expires_at": "2023-12-02T10:00:00.000Z",
"identification": "order_123",
"expiration_in_seconds": 86400,
"end_to_end_id": "E12345678202312101234567890123456",
"pix_payment_id": "27bff30a-3470-4e8e-a4f5-a16cf25be0e3",
"due_date": "2025-12-31",
"expiration_in_days_after_due_date": 30,
"interest": {
"modality": "PERCENTAGE_PER_MONTH",
"amount": 1000,
"percentage": 10.5
},
"fine": {
"modality": "PERCENTAGE",
"amount": 2000,
"percentage": 2.5
},
"discount": {
"modality": "PERCENTAGE_UNTIL_DATE",
"amount": 2,
"percentage": 50,
"discount_dates_config": [
{
"until_date": "2025-12-15",
"percentage": 10
},
{
"until_date": "2025-12-20",
"percentage": 5
}
]
},
"abatement": {
"modality": "FIXED",
"amount": 5000,
"percentage": 5
}
},
"bolepix_data": {
"pix_key_id": "pix_key_123",
"external_request_id": "ext-req-123",
"due_date": "2025-12-31",
"expiration_in_days_after_due_date": 30,
"boleto_transaction_id": "boleto-123",
"bank_issuer": "Banco do Brasil",
"bank_code": "001",
"bank_branch": "1234",
"bank_account_number": "12345-6",
"bar_code": "00190000090299993600000000000000185830000010000",
"bank_line": "00190.00009 02999.936001 00000.000001 8 58300000010000",
"bank_assignor": "Company Name",
"pix_transaction_id": "pix-123",
"pix_identification": "txid123456789",
"pix_emv": "00020126580014br.gov.bcb.pix...",
"paid_via": "PIX",
"paid_amount": 50000,
"paid_at": "2025-12-20T10:00:00.000Z",
"discount": {
"amount": 5000,
"percentage": 10,
"modality": "FIXED",
"until_date": "2025-12-25"
},
"fine_percentage": 2,
"monthly_interest_percentage": 1
},
"card_data": {
"last_digits": "1111",
"expiry_month": "12",
"expiry_year": "2028",
"brand": "VISA",
"device_id": "device-123",
"cardholder_name": "John Doe",
"country": "BR",
"wallet_type": "APPLE_PAY",
"display_name": "Visa •••• 1111",
"authentication_type": "3DS"
},
"soft_descriptor": "MYSTORE",
"serial_number": "12345678",
"nsu": "000123",
"metadata": "<unknown>",
"latest_refund_at": "2023-12-01T10:00:00.000Z",
"status_reason": "PROVIDER",
"approved_at": "2023-12-01T10:00:00.000Z",
"company_full_name": "Test Company",
"company_name": "Test Company",
"organization_id": "tx_organization_123456",
"consumer": {
"document_type": "CPF",
"full_name": "João Silva",
"email": "[email protected]",
"pix_key": "[email protected]",
"document_number": "81146431023",
"phone": "+5511999999999",
"birth_date": "15-08-1990",
"address": {
"street": "Rua das Flores",
"neighborhood": "Centro",
"zipcode": "12345678",
"country": "076",
"state": "SP",
"city": "São Paulo",
"street_number": "123",
"complement": "Apt 101"
}
},
"updated_at": "2023-12-01T10:00:00.000Z"
}{
"error": {
"code": "VALIDATION_ERROR",
"message": "Validation error",
"status": 400,
"details": {
"issues": [
{
"field": "email",
"type": "REQUIRED",
"message": "Field 'email' is required",
"value": "invalid_value",
"constraints": {
"min": 18,
"max": 120
}
}
]
},
"path": "/companies",
"timestamp": "2023-12-01T10:00:00.000Z",
"requestId": "req_123456789"
}
}{
"error": {
"code": "AUTHENTICATION_ERROR",
"message": "Authentication required to access this resource",
"status": 401,
"details": {
"reason": "Invalid API key"
},
"path": "/companies/me",
"timestamp": "2023-12-01T10:00:00.000Z",
"requestId": "req_123456789"
}
}{
"error": {
"code": "AUTHORIZATION_ERROR",
"message": "You need 'admin' permissions to access this resource",
"status": 403,
"path": "/companies",
"timestamp": "2023-12-01T10:00:00.000Z",
"requestId": "req_123456789"
}
}{
"error": {
"code": "RESOURCE_NOT_FOUND",
"message": "Company with ID '123' not found",
"status": 404,
"path": "/companies/me",
"timestamp": "2023-12-01T10:00:00.000Z",
"requestId": "req_123456789"
}
}{
"error": {
"code": "INTERNAL_SERVER_ERROR",
"message": "An unexpected error occurred",
"status": 500,
"path": "/companies",
"timestamp": "2023-12-01T10:00:00.000Z",
"requestId": "req_123456789"
}
}Authenticate a transaction with 3D Secure
Authenticates a transaction that is in AWAITING_3DS status using a 3D Secure session. Links the authenticated session to the transaction, updates card data with 3DS authentication details (cryptogram, ECI, authentication_type), and processes the payment with the provider. Requires the transaction.create permission.
This endpoint is used in the transaction-first 3DS flow:
- Transaction is created and enters AWAITING_3DS status
- Authenticated company creates a 3DS session and completes authentication
- Authenticated company calls this endpoint to link the session and process the payment
The session must be authenticated, not consumed, not expired, and match the transaction’s company, amount, and currency.
curl --request POST \
--url https://api-sandbox.rinne.com.br/core/v1/transactions/{transactionId}/authenticate \
--header 'Content-Type: application/json' \
--header 'x-api-key: <api-key>' \
--data '
{
"three_d_secure_session_id": "550e8400-e29b-41d4-a716-446655440000"
}
'import requests
url = "https://api-sandbox.rinne.com.br/core/v1/transactions/{transactionId}/authenticate"
payload = { "three_d_secure_session_id": "550e8400-e29b-41d4-a716-446655440000" }
headers = {
"x-api-key": "<api-key>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {'x-api-key': '<api-key>', 'Content-Type': 'application/json'},
body: JSON.stringify({three_d_secure_session_id: '550e8400-e29b-41d4-a716-446655440000'})
};
fetch('https://api-sandbox.rinne.com.br/core/v1/transactions/{transactionId}/authenticate', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api-sandbox.rinne.com.br/core/v1/transactions/{transactionId}/authenticate",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'three_d_secure_session_id' => '550e8400-e29b-41d4-a716-446655440000'
]),
CURLOPT_HTTPHEADER => [
"Content-Type: application/json",
"x-api-key: <api-key>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api-sandbox.rinne.com.br/core/v1/transactions/{transactionId}/authenticate"
payload := strings.NewReader("{\n \"three_d_secure_session_id\": \"550e8400-e29b-41d4-a716-446655440000\"\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("x-api-key", "<api-key>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api-sandbox.rinne.com.br/core/v1/transactions/{transactionId}/authenticate")
.header("x-api-key", "<api-key>")
.header("Content-Type", "application/json")
.body("{\n \"three_d_secure_session_id\": \"550e8400-e29b-41d4-a716-446655440000\"\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api-sandbox.rinne.com.br/core/v1/transactions/{transactionId}/authenticate")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["x-api-key"] = '<api-key>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"three_d_secure_session_id\": \"550e8400-e29b-41d4-a716-446655440000\"\n}"
response = http.request(request)
puts response.read_body{
"id": "tx_123456789",
"provider": "CELCOIN",
"affiliation_id": "a3dbd0c2-9f79-4f86-8caa-47779b3f2793",
"request_id": "request-123",
"mcc": "5411",
"amount": 10050,
"currency": "BRL",
"pricing": {
"fee": {
"percentage": 2.5,
"flat": 50,
"minimum_price": 100
},
"cost": {
"percentage": 2.5,
"flat": 50,
"minimum_price": 100
}
},
"status": "APPROVED",
"capture_method": "EMV",
"installments": 1,
"payment_method": "PIX",
"automatic_anticipation": false,
"origin": "INTERNAL",
"company_id": "a3dbd0c2-9f79-4f86-8caa-47779b3f2793",
"created_at": "2023-12-01T10:00:00.000Z",
"fee_policy_id": "fee_policy_123",
"cost_policy_id": "cost_policy_123",
"approved_amount": 10050,
"refunded_amount": 0,
"three_d_secure_session_id": "550e8400-e29b-41d4-a716-446655440000",
"acquirer_response_code": "00",
"pix_data": {
"pix_key_id": "pix_key_123",
"description": "Payment for order #123",
"qr_code": "00020126580014br.gov.bcb.pix0136a3dbd0c2-9f79-4f86-8caa-47779b3f2793520400005303986540510.005802BR5913Test Company6008São Paulo62070503***6304E2CA",
"expires_at": "2023-12-02T10:00:00.000Z",
"identification": "order_123",
"expiration_in_seconds": 86400,
"end_to_end_id": "E12345678202312101234567890123456",
"pix_payment_id": "27bff30a-3470-4e8e-a4f5-a16cf25be0e3",
"due_date": "2025-12-31",
"expiration_in_days_after_due_date": 30,
"interest": {
"modality": "PERCENTAGE_PER_MONTH",
"amount": 1000,
"percentage": 10.5
},
"fine": {
"modality": "PERCENTAGE",
"amount": 2000,
"percentage": 2.5
},
"discount": {
"modality": "PERCENTAGE_UNTIL_DATE",
"amount": 2,
"percentage": 50,
"discount_dates_config": [
{
"until_date": "2025-12-15",
"percentage": 10
},
{
"until_date": "2025-12-20",
"percentage": 5
}
]
},
"abatement": {
"modality": "FIXED",
"amount": 5000,
"percentage": 5
}
},
"bolepix_data": {
"pix_key_id": "pix_key_123",
"external_request_id": "ext-req-123",
"due_date": "2025-12-31",
"expiration_in_days_after_due_date": 30,
"boleto_transaction_id": "boleto-123",
"bank_issuer": "Banco do Brasil",
"bank_code": "001",
"bank_branch": "1234",
"bank_account_number": "12345-6",
"bar_code": "00190000090299993600000000000000185830000010000",
"bank_line": "00190.00009 02999.936001 00000.000001 8 58300000010000",
"bank_assignor": "Company Name",
"pix_transaction_id": "pix-123",
"pix_identification": "txid123456789",
"pix_emv": "00020126580014br.gov.bcb.pix...",
"paid_via": "PIX",
"paid_amount": 50000,
"paid_at": "2025-12-20T10:00:00.000Z",
"discount": {
"amount": 5000,
"percentage": 10,
"modality": "FIXED",
"until_date": "2025-12-25"
},
"fine_percentage": 2,
"monthly_interest_percentage": 1
},
"card_data": {
"last_digits": "1111",
"expiry_month": "12",
"expiry_year": "2028",
"brand": "VISA",
"device_id": "device-123",
"cardholder_name": "John Doe",
"country": "BR",
"wallet_type": "APPLE_PAY",
"display_name": "Visa •••• 1111",
"authentication_type": "3DS"
},
"soft_descriptor": "MYSTORE",
"serial_number": "12345678",
"nsu": "000123",
"metadata": "<unknown>",
"latest_refund_at": "2023-12-01T10:00:00.000Z",
"status_reason": "PROVIDER",
"approved_at": "2023-12-01T10:00:00.000Z",
"company_full_name": "Test Company",
"company_name": "Test Company",
"organization_id": "tx_organization_123456",
"consumer": {
"document_type": "CPF",
"full_name": "João Silva",
"email": "[email protected]",
"pix_key": "[email protected]",
"document_number": "81146431023",
"phone": "+5511999999999",
"birth_date": "15-08-1990",
"address": {
"street": "Rua das Flores",
"neighborhood": "Centro",
"zipcode": "12345678",
"country": "076",
"state": "SP",
"city": "São Paulo",
"street_number": "123",
"complement": "Apt 101"
}
},
"updated_at": "2023-12-01T10:00:00.000Z"
}{
"error": {
"code": "VALIDATION_ERROR",
"message": "Validation error",
"status": 400,
"details": {
"issues": [
{
"field": "email",
"type": "REQUIRED",
"message": "Field 'email' is required",
"value": "invalid_value",
"constraints": {
"min": 18,
"max": 120
}
}
]
},
"path": "/companies",
"timestamp": "2023-12-01T10:00:00.000Z",
"requestId": "req_123456789"
}
}{
"error": {
"code": "AUTHENTICATION_ERROR",
"message": "Authentication required to access this resource",
"status": 401,
"details": {
"reason": "Invalid API key"
},
"path": "/companies/me",
"timestamp": "2023-12-01T10:00:00.000Z",
"requestId": "req_123456789"
}
}{
"error": {
"code": "AUTHORIZATION_ERROR",
"message": "You need 'admin' permissions to access this resource",
"status": 403,
"path": "/companies",
"timestamp": "2023-12-01T10:00:00.000Z",
"requestId": "req_123456789"
}
}{
"error": {
"code": "RESOURCE_NOT_FOUND",
"message": "Company with ID '123' not found",
"status": 404,
"path": "/companies/me",
"timestamp": "2023-12-01T10:00:00.000Z",
"requestId": "req_123456789"
}
}{
"error": {
"code": "INTERNAL_SERVER_ERROR",
"message": "An unexpected error occurred",
"status": 500,
"path": "/companies",
"timestamp": "2023-12-01T10:00:00.000Z",
"requestId": "req_123456789"
}
}Authorizations
Company API key for authentication
Path Parameters
Transaction ID (must be in AWAITING_3DS status)
Body
ID of an authenticated 3D Secure session to link to the transaction
"550e8400-e29b-41d4-a716-446655440000"
Response
Transaction authenticated and processed successfully
Transaction data returned by the API
Transaction unique identifier
"tx_123456789"
Payment provider
CELCOIN, RINNE, CAPPTA "CELCOIN"
Affiliation ID for this transaction
"a3dbd0c2-9f79-4f86-8caa-47779b3f2793"
Unique request ID for this transaction used for idempotency
"request-123"
Merchant Category Code
"5411"
Transaction amount in cents
10050
Transaction currency
BRL "BRL"
Transaction pricing information
Show child attributes
Show child attributes
Transaction status
PROCESSING, AUTHORIZED, APPROVED, REFUNDED, PARTIALLY_REFUNDED, PENDING_REFUND, CHARGEDBACK, WAITING_PAYMENT, AWAITING_3DS, RISK_ANALYSIS, REFUSED, FAILED, EXPIRED, PENDING_CANCELLATION, CANCELLED "APPROVED"
Transaction capture method
EMV, MAGSTRIPE, ECOMMERCE, CONTACTLESS_ICC "EMV"
Number of installments
1
Payment method
CREDIT_CARD, DEBIT_CARD, PIX, BOLEPIX "PIX"
Whether this transaction was automatically anticipated at creation time. Set to true when the affiliation's anticipation_type is AUTOMATIC; false otherwise.
false
Where the transaction originated. INTERNAL: created through the Rinne API. EXTERNAL: originated outside the platform and registered from a provider event, such as an inbound Pix sent directly to a Pix key or a POS (card machine) transaction.
INTERNAL, EXTERNAL "INTERNAL"
Company ID that owns this transaction
"a3dbd0c2-9f79-4f86-8caa-47779b3f2793"
Transaction creation timestamp
"2023-12-01T10:00:00.000Z"
Fee policy ID applied to this transaction
"fee_policy_123"
Cost policy ID applied to this transaction
"cost_policy_123"
Approved amount in cents
10050
Total amount refunded in cents (sum of completed refunds)
0
ID of the 3DS session linked to this transaction, if any. Set when the transaction was created with a 3DS session (session-first flow) or authenticated via the /authenticate endpoint (transaction-first flow).
"550e8400-e29b-41d4-a716-446655440000"
Acquirer response code
"00"
PIX-specific data (present if payment_method is PIX)
Show child attributes
Show child attributes
Bolepix-specific data (present if payment_method is BOLEPIX)
Show child attributes
Show child attributes
Card-specific data (present if payment_method is CREDIT_CARD or DEBIT_CARD)
Show child attributes
Show child attributes
The soft_descriptor sent with the create request, as sent. Null when the request had none.
"MYSTORE"
Terminal serial number
"12345678"
Network Sequential Number
"000123"
Additional metadata
Latest refund timestamp (for the most recent completed refund)
"2023-12-01T10:00:00.000Z"
Status reason details. REVERSED indicates a failed card transaction whose charge was later found at the acquirer and reversed by reconciliation.
PROVIDER, ACQUIRER, ANTIFRAUD, INTERNAL_ERROR, NO_ACQUIRER, ACQUIRER_TIMEOUT, CHALLENGE_NOT_ALLOWED, REVERSED "PROVIDER"
Transaction approval timestamp
"2023-12-01T10:00:00.000Z"
Company full name
"Test Company"
Company name
"Test Company"
Organization transaction ID (for refunds/chargebacks)
"tx_organization_123456"
Consumer information
Show child attributes
Show child attributes
Transaction last update timestamp
"2023-12-01T10:00:00.000Z"

