3ds session status changed

Triggered once per 3DS session, when it reaches its outcome: auth_status moves from ACTION_REQUIRED to AUTHENTICATED or FAILED. It is the server-side signal of the outcome, so you do not depend on the cardholder’s browser returning to your page. Not every session sends it: when the cardholder leaves before the challenge starts, the 3DS provider may never report an outcome. If your backend needs an answer by a given time, pick a cutoff of your own, such as the session’s expires_at, and read the session once with GET /v1/3ds-sessions/{id} when the event has not arrived by then. ACTION_REQUIRED at that read means the cardholder has not completed the challenge so far; if the provider reports an outcome later, this event is sent then. A session that already has its outcome when it is created, such as a card not enrolled in 3-D Secure (FAILED), sends no event: the create response carries it. payload.entity is the session as GET /v1/3ds-sessions/{id} returns it. An AUTHENTICATED session with authentication_flow: attempt was not authenticated by the cardholder: only proof of the attempt exists. payload.entity.expires_at bounds the session’s use in a payment: an event delivered late, after an incident on our side or a retry to your endpoint, can arrive with it already past, and a payment with that session is then rejected. Sent to the company the session was created for and, when that company is a merchant, to its organization.