Skip to main content
GET
Get a 3D Secure session

Authorizations

x-api-key
string
header
required

Company API key for authentication

Path Parameters

id
string<uuid>
required

3DS session ID (id from the create response)

Example:

"550e8400-e29b-41d4-a716-446655440000"

Response

The 3DS session

id
string<uuid>

Internal 3DS session ID (use as three_d_secure_session_id when creating a transaction)

Example:

"550e8400-e29b-41d4-a716-446655440000"

tds_session_id
string

Provider session ID (use with the client-side SDK for challenge flows)

Example:

"tds_visa_e7c2yfa3867c"

card_id
string<uuid> | null

The stored card this session authenticated, or null when the card was sent inline. When both this and the transaction's card_data.card_id are set, they must match or the transaction is rejected.

Example:

"123e4567-e89b-12d3-a456-426614174000"

auth_status
enum<string>

Current authentication status:

  • ACTION_REQUIRED: Cardholder must complete 3DS challenge
  • AUTHENTICATED: Authentication successful (frictionless or completed challenge), or only attempted: with authentication_flow: attempt the cardholder was not authenticated and only proof of the attempt exists
  • FAILED: Authentication failed
Available options:
ACTION_REQUIRED,
AUTHENTICATED,
FAILED
Example:

"AUTHENTICATED"

consumption_status
enum<string>

Whether this session has been used for a transaction:

  • NOT_CONSUMED: Available for use
  • PROCESSING: Currently being used (atomic claim)
  • CONSUMED: Already used for a transaction
Available options:
NOT_CONSUMED,
PROCESSING,
CONSUMED
Example:

"NOT_CONSUMED"

amount
integer

Amount in minor units (cents)

Example:

10000

currency
string

ISO 4217 currency code

Example:

"BRL"

failure_reason
string | null

Reason for authentication failure (only present when auth_status is FAILED)

Example:

null

liability_shift
boolean | null

Whether liability has shifted to the issuer

Example:

true

authentication_flow
string | null

3DS authentication flow type (frictionless, challenge, attempt). attempt comes with auth_status: AUTHENTICATED, but the cardholder was not authenticated: only proof of the authentication attempt exists.

Example:

"frictionless"

expires_at
string<date-time>

Session expiration time

Example:

"2026-02-06T20:35:00.000Z"

created_at
string<date-time>
Example:

"2026-02-06T19:35:00.000Z"

updated_at
string<date-time>
Example:

"2026-02-06T19:35:00.000Z"