🔒 Requires mutual TLS (mTLS)
Clients must present a valid client certificate registered with Apata 3DSS.

Authenticate a cardholder

The /authenticate endpoint accepts customer and transaction data required to complete 3DS authentication.
Apata will validate that the data provided meets 3DS specification requirements for the given version, and produce an AReq (Authentication Request) message. A 3DS authentication with the customer’s card issuer will then be initiated.

Sending an AReq

The richer the data included in the AReq, the more likely it is that the issuer will approve the transaction without requiring a challenge. For browser payments, be sure to include thebrowser* fields; for in-app payments, include the SDK fields.

📘

Check the version first

Call Version before attempting authentication to find out which 3DS version
(messageVersion) a given card supports. Sending an authentication request unsupported version returns a
400.

Receiving an ARes

Every ARes (Authentication Response) message includes a transStatus field that will describe the authentication result for that transaction.

✅ Frictionless approval — transStatus is Y (authenticated) or A
(attempted). The cardholder will not be challenged. An authenticationValue and eci will also be returned in the response. liabilityShifted describes whether or not financial responsibility for fraud-related chargebacks lies with the online merchant or the card-issuing bank.

🔐 Challenge required — transStatus is C (challenge) or D (decoupled).
The issuer wants to verify the cardholder directly via a challenge. Either an acsURL (redirect the shopper's browser there) or acsSignedContent (hand this to your mobile SDK) will be included in the response, depending on the transaction browser channel. Once the cardholder completes the challenge, poll Result to receive the RRes.

🔐 SPC challenge — transStatus is S (Secure Payment Confirmation, 2.3.1 only).
The cardholder is challenged using SPC. The response includes spcTransData to drive the SPC authentication ceremony on the client. Once the cardholder completes the challenge, poll Result to receive the RRes.

❌ Not approved — transStatus of N (not authenticated), U (unavailable),
or R (rejected) means authentication did not succeed and you should not proceed
with the payment.

At a glance