Out-of-Band (OOB)

Possession Factor

The cardholder's enrolled device is used to approve the transaction, satisfying the possession SCA factor.

Inherence Factor

Physical biometrics (Face ID or fingerprint) satisfy the inherence SCA factor, making this the strongest single challenge method.

Highest Acceptance Rate

OOB has the highest cardholder completion rate of all challenge methods available in Apata.

📘
See the Delegate SCA (OOB) challenge method for configuration details and the Delegate SCA webhook API reference for the webhook payload schema.

How It Works

Apata receives an AReq and calls the issuer's Card Link endpoint to fetch card details.
The Risk Profile is evaluated and a challenge is determined to be required.
Apata sends an ARes with transStatus: C to the DS.
On receiving the CReq, Apata calls the Delegate SCA webhook with the transaction details, and simultaneously renders the Challenge Interface to the cardholder.
The issuer sends a push notification to the cardholder's banking app.
The cardholder approves or rejects the transaction using biometrics.
The issuer calls the Apata Authenticate or Decline endpoint to report the result.
Apata completes the RReq/RRes exchange with the DS and redirects the cardholder to the merchant.

Sequence Diagram

sequenceDiagram
    autonumber
    participant ch as Cardholder
    participant 3ds as 3DS Server
    participant ds as Directory Server
    participant acs as Apata ACS
    participant issuer as Issuer
    ch->>3ds: Initiate transaction
    3ds->>ds: AReq
    ds->>acs: AReq
    acs->>issuer: Card Link request
    issuer->>acs: Card details
    acs->>acs: Evaluate Risk Profile - challenge required
    acs->>ds: ARes (transStatus C)
    ds->>3ds: ARes (transStatus C)
    3ds->>acs: CReq
    acs->>issuer: Delegate SCA (OOB) webhook
    acs->>ch: Render Challenge Interface
    issuer->>ch: Push notification to banking app
    ch->>issuer: Approve or reject via biometrics
    issuer->>acs: Callback - authenticate or decline
    acs->>ds: RReq
    ds->>3ds: RReq
    3ds->>ds: RRes
    ds->>acs: RRes
    acs->>ch: Redirect to merchant
    opt Finalised Event
        acs->>issuer: Finalised Event notification
    end

API References

Delegate SCA Webhook

Called by Apata when a challenge is required. The issuer uses this to trigger the push notification to the cardholder's app.

Authenticate / Decline Endpoints

Called by the issuer after the cardholder responds. Informs Apata of the OOB authentication outcome.

📘
The Finalised Event webhook is optional and delivers the full transaction outcome to the issuer once authentication is complete. See the Finalised Event guide for details.