openapi: 3.0.1
info:
  title: 3DS
  description: >-

    {% admonition type="danger" name="Preview only" %}

    This is a preview of the next major version and is subject to change.


    Estimated availability: Late 2026

    {% /admonition %}


    Verify your customer's identity to minimize fraud. Use our Strong Customer
    Authentication (SCA) to benefit from liability shift.


    __Authentication__


    Set your headers


    ```

    Authorization: {your_credentials} 

    Content-Type: application/json  

    WP-Api-Version: 2026-12-01

    ```

    Replace `{your_credentials}` with your base64-encoded Basic Auth username
    and password.


    __DNS whitelisting__


    Whitelist the following URLs: 

    * `https://try.access.worldpay.com/`

    * `https://access.worldpay.com/`


    Please ensure you use DNS whitelisting, not explicit IP whitelisting. When
    you make a request within Access Worldpay, you should always cache the
    response returned.
  version: '2026-12-01'
servers:
  - url: https://try.access.worldpay.com/3ds
    description: Test (Try)
  - url: https://access.worldpay.com/3ds
    description: Live
tags:
  - name: authentication
    x-displayName: 3DS Authentication
    description: |-
      3DS authentication request. 

      Merchant facing API.
paths:
  /authentication:
    post:
      tags:
        - authentication
      summary: Authentication
      description: |+
        Authenticate your customer by submitting order and risk data.

      operationId: authenticate
      parameters:
        - $ref: '#/components/parameters/wp_api_version'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/3DS_authenticate_request'
            examples:
              card/plain:
                $ref: '#/components/examples/card'
              card/plain (all key:values):
                $ref: '#/components/examples/card-all'
              card/token:
                $ref: '#/components/examples/token'
              card/networkToken:
                $ref: '#/components/examples/networkToken'
              googlepay/encrypted:
                $ref: '#/components/examples/googlepay-encrypted'
              googlepay/decrypted:
                $ref: '#/components/examples/googlepay-decrypted'
      responses:
        '200':
          description: The authentication has been created.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/3DS_authenticate_200_response_redirect'
              examples:
                redirect:
                  $ref: '#/components/examples/redirect'
        '400':
          description: The request has encountered validation errors.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/3DS_400_response'
              examples:
                The request contains invalid characters:
                  $ref: '#/components/examples/400-invalid-chars'
                The request contains an invalid `Content-Type` header:
                  $ref: '#/components/examples/400-content-type'
                The request is using an invalid HTTP method:
                  $ref: '#/components/examples/400-invalid-method'
        '502':
          description: Invalid response received from upstream.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/3DS_502_response'
              examples:
                An invalid response is received from upstream:
                  $ref: '#/components/examples/502'
        '503':
          description: The requested service is unavailable.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/3DS_503_response'
              examples:
                The requested service is unavailable:
                  $ref: '#/components/examples/503'
  /{authenticationId}:
    get:
      tags:
        - authentication
      summary: Query
      description: Query for the latest authentication state.
      operationId: authenticationQuery
      parameters:
        - $ref: '#/components/parameters/wp_api_version'
        - $ref: '#/components/parameters/authentication_id'
      responses:
        '200':
          description: The authentication has been created
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/3DS_query_200_response'
              examples:
                3dsAuthenticated:
                  $ref: '#/components/examples/3dsAuthenticated'
                3dsAttempted:
                  $ref: '#/components/examples/3dsAttempted'
                3dsRejected:
                  $ref: '#/components/examples/3dsRejected'
                3dsNotAuthenticated:
                  $ref: '#/components/examples/3dsNotAuthenticated'
                3dsUnavailable:
                  $ref: '#/components/examples/3dsUnavailable'
                3dsChallengeFailed:
                  $ref: '#/components/examples/3dsChallengeFailed'
                3dsOutage:
                  $ref: '#/components/examples/3dsOutage'
                3dsBypassed:
                  $ref: '#/components/examples/3dsBypassed'
                3dsDataOnly:
                  $ref: '#/components/examples/3dsDataOnly'
                3dsExempted:
                  $ref: '#/components/examples/3dsExempted'
                3dsRedirect:
                  $ref: '#/components/examples/3dsRedirect'
        '400':
          description: The request has encountered validation errors.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/3DS_400_response'
              examples:
                The request contains invalid characters:
                  $ref: '#/components/examples/400-invalid-chars'
                The request contains an invalid `Content-Type` header:
                  $ref: '#/components/examples/400-content-type'
                The request is using an invalid HTTP method:
                  $ref: '#/components/examples/400-invalid-method'
        '502':
          description: Invalid response received from upstream.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/3DS_502_response'
              examples:
                An invalid response is received from upstream:
                  $ref: '#/components/examples/502'
        '503':
          description: The requested service is unavailable.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/3DS_503_response'
              examples:
                The requested service is unavailable:
                  $ref: '#/components/examples/503'
components:
  schemas:
    device_data_request:
      type: object
      properties:
        collectionReference:
          type: string
          description: ' Add the `sessionId` provided in the [postMessage for the device data collection form (web)](/) or for native (iOS/Android), returned as `consumerSessionId` as part of [SDK initialization](/). <br><br>__Note:__ If device data collection fails you can attempt the payment without this value, but you will see an increased number of `challenged` and even `authenticationFailure` outcomes, if this happens for a lot of requests.'
          example: 0_3XXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXX6b5
        deviceData:
          $ref: '#/components/schemas/device_data'
    challenge:
      type: object
      description: An object that contains challenge related information.
      properties:
        preference:
          enum:
            - noPreference
            - noChallengeRequested
            - challengeRequested
            - challengeMandated
            - noChallengeRequestedTRAPerformed
          type: string
          description: >-
            Preference regarding issuer displaying challenge to the customer.
            The interpretation of this field varies from issuer to issuer, so we
            cannot guarantee any particular behavior on their part as a result
            of you setting this field.
          x-enumDescriptions:
            noPreference: Default (decision to challenge owned by issuer).
            noChallengeRequested: Prefer no challenge performed.
            challengeRequested: Prefer challenge is performed.
            challengeMandated: >-
              Local or regional mandates meaning a challenge must be performed.
              For SCA mandated countries you should use `challengeMandated` in
              the authentication request as part of the first CIT payment in an
              MIT series.
            noChallengeRequestedTRAPerformed: >-
              Prefer no challenge performed due to an exemption to SCA. Only use
              this when Transaction Risk Analysis (TRA) has been performed using
              an approved third party vendor and an SCA exemption has been
              recommended for the authentication.
        windowSize:
          default: 390x400
          enum:
            - 390x400
            - 250x400
            - 500x600
            - 600x400
            - fullPage
          type: string
          description: >-
            Specify the challenge window size (width x height) that the issuer
            should use.
    value:
      required:
        - amount
        - currency
      type: object
      description: >-
        An object that contains information about the value of the
        authentication.
      properties:
        amount:
          maximum: 99999999999
          minimum: 0
          type: integer
          description: >-
            The authentication amount. This is a whole number with an exponent
            e.g. if exponent is two, 250 is 2.50. You can find the relevant
            exponent in our [currency
            table](/products/reference/useful-tables/#currency-codes). The
            authentication amount should be equal to the authorization amount.
            We recommend you delay authentication until the amount is known, or
            ensure it's greater than the total transaction amount.
        currency:
          maxLength: 3
          minLength: 3
          pattern: ^[A-Z]{3}$
          type: string
          description: >-
            The three digit currency code. See list of [supported
            currencies](/products/reference/useful-tables/#currency-codes).
          example: GBP
    device_data:
      type: object
      description: Object containing device data information.
      properties:
        acceptHeader:
          maxLength: 2048
          minLength: 1
          type: string
          description: >-
            Used by the issuer to check if the customer's browser is compatible
            with the issuer challenge display.
        userAgentHeader:
          maxLength: 2048
          minLength: 1
          type: string
          description: >-
            Used by issuers as part of risk analysis and to correctly display
            the challenge. Must conform to RFC 7321 e.g. `Mozilla/5.0 (Windows
            NT 6.1; Win64; x64; rv:47.0)`.
        browserLanguage:
          maxLength: 8
          minLength: 1
          type: string
          description: ' Your customer''s browser language that can be used by the issuer in risk analysis. Must conform to the language tags defined by IETF, e.g. en-GB, fr-FR. '
        ipAddress:
          type: string
          description: |2-
             A unique identifier for your customer's physical location that
                        can be used by the issuer in risk analysis. Must be in IPv4 or IPv6 format,
            e.g. 192.0.0.0. 
        browserJavaEnabled:
          type: boolean
          description: Defines whether Java is enabled on your customer's browser.
        browserColorDepth:
          type: string
          description: The color depth of your customer's browser.
          enum:
            - '1'
            - '4'
            - '8'
            - '15'
            - '16'
            - '24'
            - '32'
            - '48'
        browserScreenHeight:
          type: integer
          description: Defines the pixel height of the customer's browser.
          format: int32
        browserScreenWidth:
          type: integer
          description: Defines the pixel width of the customer's browser.
          format: int32
        timeZone:
          pattern: ^[+-]?\d{1,4}$
          type: string
          description: |2-
             Time zone offset in minutes between UTC and your customer's browser local time.  
            Example time zone offset values in minutes:  
            If UTC -5 hours:  
            `300`  
            `+300`  
            If UTC +5 hours:  
            `-300`  
             
        browserJavascriptEnabled:
          type: boolean
          description: Defines whether Javascript is enabled on your customer's browser.
    shipping:
      type: object
      properties:
        nameMatchesAccountName:
          type: boolean
          description: If customer name on account is identical to the shipping name.
        method:
          type: string
          description: The shipping method used.
          x-enumDescriptions:
            billingAddress: Ship to customer's billing address.
            verifiedAddress: Ship to another verified address on file with merchant.
            otherAddress: Ship to address that is different than billing address.
            store: Ship to store (store address should be populated on request).
            digital: Digital goods.
            unshippedTickets: Travel and event tickets, not shipped.
            other: Other.
          enum:
            - billingAddress
            - verifiedAddress
            - otherAddress
            - store
            - digital
            - unshippedTickets
            - other
        timeFrame:
          type: string
          enum:
            - electronic
            - sameDay
            - nextDay
            - twoDaysPlus
        email:
          maxLength: 128
          minLength: 1
          type: string
          description: The email address used for an electronic delivery.
        phone:
          maxLength: 20
          minLength: 4
          pattern: ^[0-9]*$
          type: string
          description: The phone number used for delivery.
        firstName:
          maxLength: 22
          minLength: 1
          type: string
          description: First name used on the shipping address.
        lastName:
          maxLength: 22
          minLength: 1
          type: string
          description: Last name used on the shipping address.
        address:
          $ref: '#/components/schemas/PaymentsShippingAddress'
    PaymentsShippingAddress:
      required:
        - address1
        - city
        - countryCode
        - postalCode
      type: object
      properties:
        address1:
          maxLength: 80
          minLength: 1
          type: string
          description: Address line 1.
        address2:
          maxLength: 80
          minLength: 1
          type: string
          description: Address line 2.
        address3:
          maxLength: 80
          minLength: 1
          type: string
          description: Address line 3.
        postalCode:
          maxLength: 15
          minLength: 1
          type: string
          description: Address postal code.
        city:
          maxLength: 50
          minLength: 1
          type: string
          description: Address city.
        state:
          maxLength: 30
          minLength: 1
          type: string
          description: Address state.
        countryCode:
          type: string
          description: The supported ISO 3166-1 alpha-2 country code.
          format: ISO 3166-1 alpha-2
    customer:
      type: object
      properties:
        firstName:
          maxLength: 22
          minLength: 1
          type: string
          description: Customer's first name.
        lastName:
          maxLength: 22
          minLength: 1
          type: string
          description: Customer's last name.
        phone:
          maxLength: 20
          minLength: 4
          pattern: ^[0-9]*$
          type: string
          description: Customer's phone number.
        email:
          maxLength: 128
          minLength: 1
          type: string
          description: Customer's email address used for the ecommerce account.
    payments_gift_cards_purchase:
      type: object
      properties:
        totalValue:
          $ref: '#/components/schemas/value'
        quantity:
          type: integer
          description: The number of gift cards being purchased.
          format: int32
      description: If the order is being used to purchase a gift card.
    transaction_history:
      type: object
      properties:
        attemptsLastDay:
          type: integer
          description: ' Number of transactions (successful or abandoned) for this cardholder account within the last 24 hours. '
          format: int32
        attemptsLastYear:
          type: integer
          description: ' Number of transactions (successful or abandoned) for this cardholder account within the last year. '
          format: int32
        completedLastSixMonths:
          type: integer
          description: ' Number of purchases with this customer account during the previous six months. '
          format: int32
        addCardsLastDay:
          type: integer
          description: Number of attempts to add a card in the last 24hrs.
          format: int32
        shippingAddressFirstUsedAt:
          type: string
          description: ' When the shipping address used for the transaction was first used. '
      description: Object containing details of the last transaction.
    account_history:
      type: object
      properties:
        createdAt:
          type: string
          description: Date the customer account was created.
        modifiedAt:
          type: string
          description: Date the customer account was last modified.
        passwordModifiedAt:
          type: string
          description: Date the password for the customer account was last modified.
        paymentAccountEnrolledAt:
          type: string
          description: Date the payment account was added to the cardholder account.
      description: Customer account history.
    order_reference:
      maxLength: 64
      minLength: 1
      pattern: ^[-A-Za-z0-9_!@#$%()*=.:;?\[\]{}~`/+]*$
      type: string
      description: >-
        Merchant specific reference for the order (e.g. generated ecommerce
        system order number). Does not have to be unique as multiple payments
        may apply to a single order.
      example: order-1234
    transaction_reference:
      maxLength: 64
      minLength: 1
      pattern: ^[-A-Za-z0-9_!@#$%()*=.:;?\[\]{}~`/+]*$
      type: string
      description: >-
        A unique reference per authentication request provided by you that is
        used to identify the authentication throughout its lifecycle.
      example: request-5678
    merchant:
      required:
        - entity
      type: object
      description: >-
        An object that contains information about the merchant and API level
        configuration.
      properties:
        entity:
          maxLength: 64
          minLength: 1
          pattern: ^[A-Za-z0-9 ]*$
          type: string
          description: >-
            We use this to route your request. We create the entity as part of
            on-boarding.
          example: default
        overrideName:
          type: string
          description: >-
            Used to override the merchant name that's both submitted to issuers
            as well as displayed to the customer in the authentication process.
            PayFac merchants should submit the name of their submerchant.
        acquirerId:
          type: string
          maxLength: 20
          minLength: 1
          example: '01234567'
          pattern: ^[0-9]*$
          description: >-
            Instructs the issuer that the following authorization will be
            completed with an external acquirer.
    billing_address:
      required:
        - address1
        - city
        - postalCode
        - countryCode
      type: object
      description: An object containing the billing address information.
      properties:
        address1:
          maxLength: 80
          minLength: 1
          type: string
          description: Billing address line 1.
          example: 221B Baker Street
        address2:
          maxLength: 80
          type: string
          description: Billing address line 2.
        address3:
          maxLength: 80
          type: string
          description: Billing address line 3.
        city:
          maxLength: 50
          minLength: 1
          type: string
          description: Billing address city.
          example: London
        state:
          maxLength: 30
          minLength: 1
          type: string
          description: >-
            Billing address state. Should only be provided following the
            `ISO-3611-2` two-character sub division (e.g.“CA” for California).
            We recommend you provide this for US and China addresses.
        postalCode:
          maxLength: 15
          minLength: 1
          type: string
          description: >-
            Billing address postal code. [See country codes with optional
            postalCode](/products/reference/useful-tables/#postalcode-optional).
          example: NW1 6XE
        countryCode:
          maxLength: 2
          minLength: 2
          pattern: ^[A-Z]{2}$
          type: string
          description: Billing address country code.
          example: GB
    card_holder_name:
      maxLength: 255
      minLength: 1
      type: string
      description: >-
        The name on your customer's card. This is not a mandatory field, however
        we recommend that you supply this to improve authentication rates.
      example: Sherlock Holmes
    eci:
      maxLength: 2
      minLength: 1
      type: string
      description: >-
        Commerce Indicator (ECI). Indicates the outcome of the 3DS
        authentication.  


        | ECI | Meaning | 

        |---|---| 

        | 02 or 05 | Fully Authenticated Transaction | 

        | 01 or 06 | Attempted Authentication Transaction | 

        | 00 or 07 | Non 3-D Secure Transaction | 


        | Scheme | Value | 

        |---|---| 

        |  Mastercard | 02, 01, 00 |

        |  Visa | 05, 06, 07 |

        | Amex | 05, 06, 07 | 

        | JCB | 05, 06, 07 |

        |  Diners | 05, 06, 07 |
    authentication_value:
      maxLength: 64
      minLength: 1
      type: string
      description: >
        A cryptographic value that provides evidence of the outcome of a 3DS
        verification. 

        - Visa - Cardholder Authentication Verification Value (CAVV)

        - Mastercard - Universal Cardholder Authentication Field (UCAF)
    ds_transaction_id:
      maxLength: 64
      minLength: 1
      type: string
      description: >-
        Directory server transaction ID, if provided should be used in the
        payment authorization authentication object.
    acs_transaction_id:
      maxLength: 64
      minLength: 1
      type: string
      description: >-
        ACS transaction ID, if provided should be used in the payment
        authorization authentication object.
    enrolled:
      maxLength: 1
      minLength: 1
      type: string
      description: >-
        Status of authentication eligibility.  

        - `Y` - Bank is participating in 3DS

        - `N` - Bank is not participating in 3DS

        - `U` - The Directory Server (DS) or Access Control Server (ACS) were
        not available at the time of the request

        - `B` - Merchant authentication rule is triggered to bypass
        authentication (3DS premium only)
    status:
      maxLength: 2
      minLength: 1
      type: string
      description: >-
        Indicates the outcome of the authentication or verification request.  

        - `Y` - Successful authentication

        - `N` - Failed authentication

        - `U` - Unable to complete authentication

        - `A` - Successful attempts authentication

        - `C` - Challenged authentication

        - `R` - Authentication rejected (merchant _must not_ submit for
        authorization)

        - `I` - Exemption acknowledged
    version:
      maxLength: 10
      minLength: 1
      type: string
      description: The version of 3DS used to process the transaction.
    challenge_response:
      type: object
      description: >-
        Object containing challenge related information in case of a
        "challenged" flow
      properties:
        reference:
          maxLength: 20
          minLength: 1
          type: string
          description: >-
            This links the authentication response to the subsequent challenge
            form and verification request.
        url:
          maxLength: 2048
          minLength: 1
          type: string
          description: >-
            POST action on the challenge form. Used to redirect to the issuers
            challenge page as part of the challenge form.
        jwt:
          maxLength: 2048
          minLength: 1
          type: string
          description: >-
            A digitally signed token that contains additional details, such as
            the URL to return to after the challenge screen. Expires in `10`
            minutes on Try and `30 sec` on Live
        payload:
          maxLength: 2048
          minLength: 1
          type: string
          description: >-
            JSON container with extra data required for the challenge. This is
            used by the native SDK (iOS/Android) only.
    card_front:
      required:
        - type
        - cardNumber
        - expiryDate
      type: object
      properties:
        type:
          type: string
          format: card/plain
          description: An identifier for the `paymentInstrument` being used.
          example: card/plain
        cardHolderName:
          $ref: '#/components/schemas/card_holder_name'
        expiryDate:
          required:
            - month
            - year
          type: object
          description: Object containing card expiry information.
          properties:
            month:
              maximum: 12
              minimum: 1
              type: integer
              description: Card expiry month.
              example: 1
            year:
              maximum: 9999
              minimum: 1
              type: integer
              description: Card expiry year.
              example: 2028
        cardNumber:
          maxLength: 19
          minLength: 10
          pattern: ^[0-9]*$
          type: string
          description: Clear card number (PAN).
          example: '4444333322221111'
        billingAddress:
          $ref: '#/components/schemas/billing_address'
    card_networktoken:
      required:
        - type
        - tokenNumber
        - expiryDate
      type: object
      properties:
        type:
          type: string
          format: card/networkToken
          description: An identifier for the `paymentInstrument` being used.
        expiryDate:
          required:
            - month
            - year
          type: object
          description: Object containing card expiry information
          properties:
            month:
              maximum: 12
              minimum: 1
              type: integer
              description: Card expiry month.
            year:
              maximum: 9999
              minimum: 1
              type: integer
              description: Card expiry year.
        tokenNumber:
          maxLength: 19
          minLength: 10
          pattern: ^[0-9]*$
          type: string
          description: The network token number.
        cardHolderName:
          $ref: '#/components/schemas/card_holder_name'
        billingAddress:
          $ref: '#/components/schemas/billing_address'
    card_tokenized:
      required:
        - type
        - href
      type: object
      properties:
        type:
          type: string
          format: card/token
          description: An identifier for the `paymentInstrument` being used.
        href:
          minLength: 1
          type: string
          description: An `http` address that contains your link to an Access Token.
    googlepay_decrypted:
      required:
        - type
        - tokenNumber
        - expiryDate
      type: object
      properties:
        type:
          type: string
          description: An identifier for the `paymentInstrument` being used.
          enum:
            - googlepay/decrypted
        cardHolderName:
          $ref: '#/components/schemas/card_holder_name'
        expiryDate:
          required:
            - month
            - year
          type: object
          description: Object containing card expiry information
          properties:
            month:
              maximum: 12
              minimum: 1
              type: integer
              description: Card expiry month
              example: 1
            year:
              maximum: 9999
              minimum: 1
              type: integer
              description: Card expiry year
              example: 2028
        tokenNumber:
          maxLength: 19
          minLength: 10
          pattern: ^[0-9]*$
          type: string
          description: The network token number
        billingAddress:
          $ref: '#/components/schemas/billing_address'
    googlepay_encrypted:
      required:
        - type
        - walletToken
      type: object
      properties:
        type:
          enum:
            - googlepay/encrypted
          type: string
          description: An identifier for the `paymentInstrument` being used.
        walletToken:
          type: string
        billingAddress:
          $ref: '#/components/schemas/billing_address'
    self_link:
      type: object
      properties:
        href:
          type: string
      description: ''
    cryptogram_algorithm:
      maxLength: 99999
      minLength: 1
      type: string
      description: >-
        Indicates the algorithm used to generate the cryptogram. __Returned for
        Cartes Bancaires authentications only__ and must be applied in the
        following authorization request.
    challenge_preference:
      maxLength: 64
      minLength: 1
      type: string
      description: >
        Indicates the preferred challenge behavior. __Returned for Cartes
        Bancaires authentications only__ and must be applied in the following
        authorization request.

        - `noPreference`

        - `noChallengeRequested`

        - `challengeRequested`

        - `challengeMandated`   
    authentication_flow:
      maxLength: 64
      minLength: 1
      enum:
        - challenge
        - frictionless
      type: string
      description: >-
        Indicates which flow the customer has been directed to. __Returned for
        Cartes Bancaires authentications only__ and must be applied in the
        following authorization request.
    status_reason:
      maxLength: 2
      minLength: 1
      type: string
      description: >-
        Provides further information relating to the outcome of the
        authentication. Returned for failed authentications only. __Returned for
        Cartes Bancaires authentications only.__
    cancellation_indicator:
      maxLength: 2
      minLength: 0
      type: string
      description: >
        An indicator as to why the authentication was cancelled. __Returned for
        Cartes Bancaires authentications only.__

        - `01` - Cardholder selected cancel

        - `02` - Reserved for future use

        - `03` - Authentication timed out

        - `04` and `05` - Authentication timed out at ACS provider

        - `06` - Transaction error

        - `07` - Unknown

        - `08` - Transaction timed out at SDK
    network_score:
      maxLength: 2
      minLength: 0
      type: string
      description: >-
        The global score calculated by the Cartes Bancaires scoring platform.
        __Returned for Cartes Bancaires authentications only__.
    brand:
      maxLength: 64
      minLength: 0
      type: string
      description: >-
        The card brand used in the authentication. __Returned for Cartes
        Bancaires authentications only__ and must be applied in the following
        authorization.
    decision:
      type: string
      description: >-
        Explains why bypassed was returned, either from manual rules or from
        recommendation by the authentication optimization service.
      enum:
        - authenticationOptimization
        - rules
      x-enumDescriptions:
        authenticationOptimization: Decision from the authentication optimization service.
        rules: Manual rule (applies to Bypassed only).
    3DS_authenticate_request:
      required:
        - orderReference
        - merchant
        - instruction
      type: object
      properties:
        orderReference:
          $ref: '#/components/schemas/order_reference'
        transactionReference:
          $ref: '#/components/schemas/transaction_reference'
        merchant:
          $ref: '#/components/schemas/merchant'
        instruction:
          required:
            - value
            - paymentInstrument
          type: object
          description: >-
            The object that contains all the payment information related to the
            authentication request.
          properties:
            value:
              $ref: '#/components/schemas/value'
            paymentInstrument:
              oneOf:
                - $ref: '#/components/schemas/card_front'
                - $ref: '#/components/schemas/card_tokenized'
                - $ref: '#/components/schemas/card_networktoken'
                - $ref: '#/components/schemas/googlepay_encrypted'
                - $ref: '#/components/schemas/googlepay_decrypted'
              description: An object that contains the card details or token location.
              discriminator:
                mapping:
                  card/plain: '#/components/schemas/card_front'
                  card/token: '#/components/schemas/card_tokenized'
                  card/networkToken: '#/components/schemas/card_networktoken'
                  googlepay/encrypted: '#/components/schemas/googlepay_encrypted'
                  googlepay/decrypted: '#/components/schemas/googlepay_decrypted'
                propertyName: type
        deviceData:
          $ref: '#/components/schemas/device_data'
        customer:
          $ref: '#/components/schemas/customer'
        challenge:
          $ref: '#/components/schemas/challenge'
        previousSuspiciousActivity:
          type: boolean
          description: Has the account been flagged for suspicious activity.
        userType:
          type: string
          enum:
            - guestUser
            - registeredUser
            - federatedAccount
            - issuerCredentials
            - thirdPartyAuthentication
            - fidoAuthenticator
        accountHistory:
          $ref: '#/components/schemas/account_history'
        reorder:
          type: boolean
          description: Repeat of a previous order.
        preOrderDate:
          type: string
          description: Expected date that a pre-ordered purchase will be available.
        transactionHistory:
          $ref: '#/components/schemas/transaction_history'
        giftCardsPurchase:
          $ref: '#/components/schemas/payments_gift_cards_purchase'
        shipping:
          $ref: '#/components/schemas/shipping'
    3DS_query_200_response_authenticated:
      title: 3dsAuthenticated
      required:
        - outcome
      type: object
      properties:
        outcome:
          $ref: '#/components/schemas/outcome_query'
        status:
          $ref: '#/components/schemas/status'
        enrolled:
          $ref: '#/components/schemas/enrolled'
        version:
          $ref: '#/components/schemas/version'
        authenticationValue:
          $ref: '#/components/schemas/authentication_value'
        eci:
          $ref: '#/components/schemas/eci'
        dsTransactionId:
          $ref: '#/components/schemas/ds_transaction_id'
        acsTransactionId:
          $ref: '#/components/schemas/acs_transaction_id'
        cryptogramAlgorithm:
          $ref: '#/components/schemas/cryptogram_algorithm'
        challengePreference:
          $ref: '#/components/schemas/challenge_preference'
        authenticationFlow:
          $ref: '#/components/schemas/authentication_flow'
        statusReason:
          $ref: '#/components/schemas/status_reason'
        cancellationIndicator:
          $ref: '#/components/schemas/cancellation_indicator'
        networkScore:
          $ref: '#/components/schemas/network_score'
        brand:
          $ref: '#/components/schemas/brand'
        _links:
          type: object
          properties:
            self:
              $ref: '#/components/schemas/self_link'
    3DS_query_200_response_attempted:
      title: attempted
      required:
        - outcome
      type: object
      properties:
        outcome:
          $ref: '#/components/schemas/outcome_query'
        status:
          $ref: '#/components/schemas/status'
        enrolled:
          $ref: '#/components/schemas/enrolled'
        version:
          $ref: '#/components/schemas/version'
        authenticationValue:
          $ref: '#/components/schemas/authentication_value'
        eci:
          $ref: '#/components/schemas/eci'
        dsTransactionId:
          $ref: '#/components/schemas/ds_transaction_id'
        acsTransactionId:
          $ref: '#/components/schemas/acs_transaction_id'
        cryptogramAlgorithm:
          $ref: '#/components/schemas/cryptogram_algorithm'
        challengePreference:
          $ref: '#/components/schemas/challenge_preference'
        authenticationFlow:
          $ref: '#/components/schemas/authentication_flow'
        statusReason:
          $ref: '#/components/schemas/status_reason'
        cancellationIndicator:
          $ref: '#/components/schemas/cancellation_indicator'
        networkScore:
          $ref: '#/components/schemas/network_score'
        brand:
          $ref: '#/components/schemas/brand'
        _links:
          type: object
          properties:
            self:
              $ref: '#/components/schemas/self_link'
    3DS_query_200_response_data_only:
      title: dataOnly
      required:
        - outcome
      type: object
      properties:
        outcome:
          $ref: '#/components/schemas/outcome_query'
        decision:
          $ref: '#/components/schemas/decision'
        status:
          $ref: '#/components/schemas/status'
        enrolled:
          $ref: '#/components/schemas/enrolled'
        version:
          $ref: '#/components/schemas/version'
        authenticationValue:
          $ref: '#/components/schemas/authentication_value'
        eci:
          $ref: '#/components/schemas/eci'
        dsTransactionId:
          $ref: '#/components/schemas/ds_transaction_id'
        acsTransactionId:
          $ref: '#/components/schemas/acs_transaction_id'
        cryptogramAlgorithm:
          $ref: '#/components/schemas/cryptogram_algorithm'
        challengePreference:
          $ref: '#/components/schemas/challenge_preference'
        authenticationFlow:
          $ref: '#/components/schemas/authentication_flow'
        statusReason:
          $ref: '#/components/schemas/status_reason'
        cancellationIndicator:
          $ref: '#/components/schemas/cancellation_indicator'
        networkScore:
          $ref: '#/components/schemas/network_score'
        brand:
          $ref: '#/components/schemas/brand'
        _links:
          type: object
          properties:
            self:
              $ref: '#/components/schemas/self_link'
    3DS_query_200_response_exempted:
      title: exempted
      required:
        - outcome
      type: object
      properties:
        outcome:
          $ref: '#/components/schemas/outcome_query'
        status:
          $ref: '#/components/schemas/status'
        enrolled:
          $ref: '#/components/schemas/enrolled'
        version:
          $ref: '#/components/schemas/version'
        authenticationValue:
          $ref: '#/components/schemas/authentication_value'
        eci:
          $ref: '#/components/schemas/eci'
        dsTransactionId:
          $ref: '#/components/schemas/ds_transaction_id'
        acsTransactionId:
          $ref: '#/components/schemas/acs_transaction_id'
        cryptogramAlgorithm:
          $ref: '#/components/schemas/cryptogram_algorithm'
        challengePreference:
          $ref: '#/components/schemas/challenge_preference'
        authenticationFlow:
          $ref: '#/components/schemas/authentication_flow'
        statusReason:
          $ref: '#/components/schemas/status_reason'
        cancellationIndicator:
          $ref: '#/components/schemas/cancellation_indicator'
        networkScore:
          $ref: '#/components/schemas/network_score'
        brand:
          $ref: '#/components/schemas/brand'
        _links:
          type: object
          properties:
            self:
              $ref: '#/components/schemas/self_link'
    3DS_query_200_response_outage:
      title: authenticationOutage
      required:
        - outcome
      type: object
      properties:
        outcome:
          $ref: '#/components/schemas/outcome_query'
        _links:
          $ref: '#/components/schemas/links'
    3DS_device_200_response_authenticated:
      title: authenticated
      required:
        - outcome
      type: object
      properties:
        outcome:
          $ref: '#/components/schemas/outcome_device'
        version:
          $ref: '#/components/schemas/version'
        eci:
          $ref: '#/components/schemas/eci'
        authenticationValue:
          $ref: '#/components/schemas/authentication_value'
        dsTransactionId:
          $ref: '#/components/schemas/ds_transaction_id'
        cryptogramAlgorithm:
          $ref: '#/components/schemas/cryptogram_algorithm'
        challengePreference:
          $ref: '#/components/schemas/challenge_preference'
        authenticationFlow:
          $ref: '#/components/schemas/authentication_flow'
        statusReason:
          $ref: '#/components/schemas/status_reason'
        cancellationIndicator:
          $ref: '#/components/schemas/cancellation_indicator'
        networkScore:
          $ref: '#/components/schemas/network_score'
        brand:
          $ref: '#/components/schemas/brand'
        _links:
          type: object
          properties:
            self:
              $ref: '#/components/schemas/self_link'
    3DS_device_200_response_attempted:
      title: attempted
      required:
        - outcome
      type: object
      properties:
        outcome:
          $ref: '#/components/schemas/outcome_device'
        version:
          $ref: '#/components/schemas/version'
        eci:
          $ref: '#/components/schemas/eci'
        authenticationValue:
          $ref: '#/components/schemas/authentication_value'
        dsTransactionId:
          $ref: '#/components/schemas/ds_transaction_id'
        cryptogramAlgorithm:
          $ref: '#/components/schemas/cryptogram_algorithm'
        challengePreference:
          $ref: '#/components/schemas/challenge_preference'
        authenticationFlow:
          $ref: '#/components/schemas/authentication_flow'
        statusReason:
          $ref: '#/components/schemas/status_reason'
        cancellationIndicator:
          $ref: '#/components/schemas/cancellation_indicator'
        networkScore:
          $ref: '#/components/schemas/network_score'
        brand:
          $ref: '#/components/schemas/brand'
        _links:
          type: object
          properties:
            self:
              $ref: '#/components/schemas/self_link'
    3DS_device_200_response_outage:
      title: authenticationOutage
      required:
        - outcome
      type: object
      properties:
        outcome:
          $ref: '#/components/schemas/outcome_device'
        _links:
          $ref: '#/components/schemas/links'
    3DS_challenge_200_response_authenticated:
      title: authenticated
      required:
        - outcome
      type: object
      properties:
        outcome:
          $ref: '#/components/schemas/outcome_challenge'
        version:
          $ref: '#/components/schemas/version'
        eci:
          $ref: '#/components/schemas/eci'
        authenticationValue:
          $ref: '#/components/schemas/authentication_value'
        dsTransactionId:
          $ref: '#/components/schemas/ds_transaction_id'
        cryptogramAlgorithm:
          $ref: '#/components/schemas/cryptogram_algorithm'
        challengePreference:
          $ref: '#/components/schemas/challenge_preference'
        authenticationFlow:
          $ref: '#/components/schemas/authentication_flow'
        statusReason:
          $ref: '#/components/schemas/status_reason'
        cancellationIndicator:
          $ref: '#/components/schemas/cancellation_indicator'
        networkScore:
          $ref: '#/components/schemas/network_score'
        brand:
          $ref: '#/components/schemas/brand'
        _links:
          type: object
          properties:
            self:
              $ref: '#/components/schemas/self_link'
    3DS_authenticate_200_response_redirect:
      title: 3dsRedirect
      type: object
      properties:
        outcome:
          enum:
            - 3dsRedirect
          type: string
          description: Redirect.
        authenticationId:
          type: string
          example: 3dsLfC-vuhv7J2nEw2m9ca_e0
          description: >-
            Unique identifier generated by us.

            * 25 characters total

            * 3 char prefix `3ds`

            * 21 nanoid 

            * 1 char suffix -  currently always 0 (reserved for global traffic
            routing as part of a future state of Worldpay.)
        redirect:
          type: string
          description: The URL to redirect your customer to.
        _links:
          type: object
          properties:
            self:
              $ref: '#/components/schemas/self_link'
    3DS_query_200_response_redirect:
      title: 3dsRedirect
      type: object
      properties:
        outcome:
          $ref: '#/components/schemas/outcome_query'
        redirect:
          type: string
          description: ''
        _links:
          type: object
          properties:
            self:
              $ref: '#/components/schemas/self_link'
    3DS_device_200_response_challenged:
      title: challenged
      required:
        - outcome
      type: object
      properties:
        outcome:
          $ref: '#/components/schemas/outcome_device'
        version:
          $ref: '#/components/schemas/version'
        challenge:
          $ref: '#/components/schemas/challenge_response'
        _links:
          type: object
          properties:
            self:
              $ref: '#/components/schemas/self_link'
    3DS_query_200_response_not_authenticated:
      title: notAuthenticated
      required:
        - outcome
      type: object
      properties:
        outcome:
          $ref: '#/components/schemas/outcome_query'
        status:
          $ref: '#/components/schemas/status'
        enrolled:
          $ref: '#/components/schemas/enrolled'
        version:
          $ref: '#/components/schemas/version'
        authenticationValue:
          $ref: '#/components/schemas/authentication_value'
        eci:
          $ref: '#/components/schemas/eci'
        dsTransactionId:
          $ref: '#/components/schemas/ds_transaction_id'
        acsTransactionId:
          $ref: '#/components/schemas/acs_transaction_id'
        cryptogramAlgorithm:
          $ref: '#/components/schemas/cryptogram_algorithm'
        challengePreference:
          $ref: '#/components/schemas/challenge_preference'
        authenticationFlow:
          $ref: '#/components/schemas/authentication_flow'
        statusReason:
          $ref: '#/components/schemas/status_reason'
        cancellationIndicator:
          $ref: '#/components/schemas/cancellation_indicator'
        networkScore:
          $ref: '#/components/schemas/network_score'
        brand:
          $ref: '#/components/schemas/brand'
        _links:
          type: object
          properties:
            self:
              $ref: '#/components/schemas/self_link'
    3DS_query_200_response_challenge_failed:
      title: challengeFailed
      required:
        - outcome
      type: object
      properties:
        outcome:
          $ref: '#/components/schemas/outcome_query'
        status:
          $ref: '#/components/schemas/status'
        enrolled:
          $ref: '#/components/schemas/enrolled'
        version:
          $ref: '#/components/schemas/version'
        authenticationValue:
          $ref: '#/components/schemas/authentication_value'
        eci:
          $ref: '#/components/schemas/eci'
        dsTransactionId:
          $ref: '#/components/schemas/ds_transaction_id'
        acsTransactionId:
          $ref: '#/components/schemas/acs_transaction_id'
        cryptogramAlgorithm:
          $ref: '#/components/schemas/cryptogram_algorithm'
        challengePreference:
          $ref: '#/components/schemas/challenge_preference'
        authenticationFlow:
          $ref: '#/components/schemas/authentication_flow'
        statusReason:
          $ref: '#/components/schemas/status_reason'
        cancellationIndicator:
          $ref: '#/components/schemas/cancellation_indicator'
        networkScore:
          $ref: '#/components/schemas/network_score'
        brand:
          $ref: '#/components/schemas/brand'
        _links:
          type: object
          properties:
            self:
              $ref: '#/components/schemas/self_link'
    3DS_query_200_response_rejected:
      title: rejected
      required:
        - outcome
      type: object
      properties:
        outcome:
          $ref: '#/components/schemas/outcome_query'
        status:
          $ref: '#/components/schemas/status'
        enrolled:
          $ref: '#/components/schemas/enrolled'
        version:
          $ref: '#/components/schemas/version'
        authenticationValue:
          $ref: '#/components/schemas/authentication_value'
        eci:
          $ref: '#/components/schemas/eci'
        dsTransactionId:
          $ref: '#/components/schemas/ds_transaction_id'
        acsTransactionId:
          $ref: '#/components/schemas/acs_transaction_id'
        cryptogramAlgorithm:
          $ref: '#/components/schemas/cryptogram_algorithm'
        challengePreference:
          $ref: '#/components/schemas/challenge_preference'
        authenticationFlow:
          $ref: '#/components/schemas/authentication_flow'
        statusReason:
          $ref: '#/components/schemas/status_reason'
        cancellationIndicator:
          $ref: '#/components/schemas/cancellation_indicator'
        networkScore:
          $ref: '#/components/schemas/network_score'
        brand:
          $ref: '#/components/schemas/brand'
        _links:
          type: object
          properties:
            self:
              $ref: '#/components/schemas/self_link'
    3DS_device_200_response_not_authenticated:
      title: notAuthenticated
      required:
        - outcome
      type: object
      properties:
        outcome:
          $ref: '#/components/schemas/outcome_device'
        version:
          $ref: '#/components/schemas/version'
        eci:
          $ref: '#/components/schemas/eci'
        authenticationValue:
          $ref: '#/components/schemas/authentication_value'
        dsTransactionId:
          $ref: '#/components/schemas/ds_transaction_id'
        _links:
          type: object
          properties:
            self:
              $ref: '#/components/schemas/self_link'
    3DS_device_200_response_rejected:
      title: rejected
      required:
        - outcome
      type: object
      properties:
        outcome:
          $ref: '#/components/schemas/outcome_device'
        version:
          $ref: '#/components/schemas/version'
        eci:
          $ref: '#/components/schemas/eci'
        authenticationValue:
          $ref: '#/components/schemas/authentication_value'
        dsTransactionId:
          $ref: '#/components/schemas/ds_transaction_id'
        _links:
          type: object
          properties:
            self:
              $ref: '#/components/schemas/self_link'
    3DS_query_200_response_unavailable:
      title: unavailable
      required:
        - outcome
      type: object
      properties:
        outcome:
          $ref: '#/components/schemas/outcome_query'
        status:
          $ref: '#/components/schemas/status'
        enrolled:
          $ref: '#/components/schemas/enrolled'
        version:
          $ref: '#/components/schemas/version'
        authenticationValue:
          $ref: '#/components/schemas/authentication_value'
        eci:
          $ref: '#/components/schemas/eci'
        dsTransactionId:
          $ref: '#/components/schemas/ds_transaction_id'
        acsTransactionId:
          $ref: '#/components/schemas/acs_transaction_id'
        cryptogramAlgorithm:
          $ref: '#/components/schemas/cryptogram_algorithm'
        challengePreference:
          $ref: '#/components/schemas/challenge_preference'
        authenticationFlow:
          $ref: '#/components/schemas/authentication_flow'
        statusReason:
          $ref: '#/components/schemas/status_reason'
        cancellationIndicator:
          $ref: '#/components/schemas/cancellation_indicator'
        networkScore:
          $ref: '#/components/schemas/network_score'
        brand:
          $ref: '#/components/schemas/brand'
        _links:
          type: object
          properties:
            self:
              $ref: '#/components/schemas/self_link'
    3DS_device_200_response_unavailable:
      title: unavailable
      required:
        - outcome
      type: object
      properties:
        outcome:
          $ref: '#/components/schemas/outcome_device'
        transactionReference:
          $ref: '#/components/schemas/transaction_reference'
        _links:
          type: object
          properties:
            self:
              $ref: '#/components/schemas/self_link'
    3DS_device_200_response_data_only:
      title: dataOnly
      required:
        - outcome
      type: object
      properties:
        outcome:
          $ref: '#/components/schemas/outcome_device'
        decision:
          $ref: '#/components/schemas/decision'
        version:
          $ref: '#/components/schemas/version'
        eci:
          $ref: '#/components/schemas/eci'
        authenticationValue:
          $ref: '#/components/schemas/authentication_value'
        dsTransactionId:
          $ref: '#/components/schemas/ds_transaction_id'
        cryptogramAlgorithm:
          $ref: '#/components/schemas/cryptogram_algorithm'
        challengePreference:
          $ref: '#/components/schemas/challenge_preference'
        authenticationFlow:
          $ref: '#/components/schemas/authentication_flow'
        statusReason:
          $ref: '#/components/schemas/status_reason'
        cancellationIndicator:
          $ref: '#/components/schemas/cancellation_indicator'
        networkScore:
          $ref: '#/components/schemas/network_score'
        brand:
          $ref: '#/components/schemas/brand'
        _links:
          type: object
          properties:
            self:
              $ref: '#/components/schemas/self_link'
    3DS_device_200_response_exempted:
      title: exempted
      required:
        - outcome
      type: object
      properties:
        outcome:
          $ref: '#/components/schemas/outcome_device'
        version:
          $ref: '#/components/schemas/version'
        eci:
          $ref: '#/components/schemas/eci'
        authenticationValue:
          $ref: '#/components/schemas/authentication_value'
        dsTransactionId:
          $ref: '#/components/schemas/ds_transaction_id'
        cryptogramAlgorithm:
          $ref: '#/components/schemas/cryptogram_algorithm'
        challengePreference:
          $ref: '#/components/schemas/challenge_preference'
        authenticationFlow:
          $ref: '#/components/schemas/authentication_flow'
        statusReason:
          $ref: '#/components/schemas/status_reason'
        cancellationIndicator:
          $ref: '#/components/schemas/cancellation_indicator'
        networkScore:
          $ref: '#/components/schemas/network_score'
        brand:
          $ref: '#/components/schemas/brand'
        _links:
          type: object
          properties:
            self:
              $ref: '#/components/schemas/self_link'
    3DS_query_200_response_bypassed:
      title: bypassed
      required:
        - outcome
      type: object
      properties:
        outcome:
          $ref: '#/components/schemas/outcome_query'
        decision:
          $ref: '#/components/schemas/decision'
        enrolled:
          $ref: '#/components/schemas/enrolled'
        version:
          $ref: '#/components/schemas/version'
        eci:
          $ref: '#/components/schemas/eci'
        dsTransactionId:
          $ref: '#/components/schemas/ds_transaction_id'
        acsTransactionId:
          $ref: '#/components/schemas/acs_transaction_id'
        _links:
          type: object
          properties:
            self:
              $ref: '#/components/schemas/self_link'
    3DS_device_200_response_bypassed:
      title: bypassed
      required:
        - outcome
      type: object
      properties:
        outcome:
          $ref: '#/components/schemas/outcome_query'
        decision:
          $ref: '#/components/schemas/decision'
        enrolled:
          $ref: '#/components/schemas/enrolled'
        version:
          $ref: '#/components/schemas/version'
        eci:
          $ref: '#/components/schemas/eci'
        dsTransactionId:
          $ref: '#/components/schemas/ds_transaction_id'
        acsTransactionId:
          $ref: '#/components/schemas/acs_transaction_id'
        _links:
          type: object
          properties:
            self:
              $ref: '#/components/schemas/self_link'
    3DS_400_response:
      required:
        - message
        - errorName
      type: object
      properties:
        path:
          type: string
          maxLength: 2048
          minLength: 1
          description: The request URI path.
        status:
          maxLength: 3
          minLength: 3
          type: integer
          description: The HTTP status returned from server.
        message:
          type: string
          maxLength: 2048
          minLength: 1
          description: The error description message.
        errorName:
          type: string
          maxLength: 2048
          minLength: 1
          description: The unique error name.
        headerName:
          type: string
          maxLength: 2048
          minLength: 1
          description: The name of the header containing invalid value.
        allowedMethods:
          type: array
          description: List of HTTP methods that are allowed.
          items:
            type: string
        validationErrors:
          description: Object containing details of validation errors occurred.
          type: array
          items:
            $ref: '#/components/schemas/validation_errors'
        _links:
          $ref: '#/components/schemas/links'
    3DS_502_response:
      required:
        - message
        - errorName
      type: object
      properties:
        path:
          type: string
          maxLength: 2048
          minLength: 1
          description: The request URI path.
        status:
          maxLength: 3
          minLength: 3
          type: integer
          description: The HTTP status returned from server.
        message:
          type: string
          maxLength: 2048
          minLength: 1
          description: The error description message.
        errorName:
          type: string
          maxLength: 2048
          minLength: 1
          description: The unique error name.
        _links:
          $ref: '#/components/schemas/links'
    3DS_503_response:
      required:
        - message
        - errorName
      type: object
      properties:
        path:
          type: string
          maxLength: 2048
          minLength: 1
          description: The request URI path.
        status:
          maxLength: 3
          minLength: 3
          type: integer
          description: The HTTP status returned from server.
        message:
          type: string
          maxLength: 2048
          minLength: 1
          description: The error description message.
        errorName:
          type: string
          maxLength: 2048
          minLength: 1
          description: The unique error name.
        _links:
          $ref: '#/components/schemas/links'
    3DS_challenge_200_response_not_authenticated:
      title: authenticationFailed
      type: object
      properties:
        outcome:
          $ref: '#/components/schemas/outcome_challenge'
        version:
          $ref: '#/components/schemas/version'
        eci:
          $ref: '#/components/schemas/eci'
        authenticationValue:
          $ref: '#/components/schemas/authentication_value'
        dsTransactionId:
          $ref: '#/components/schemas/ds_transaction_id'
        _links:
          type: object
          properties:
            self:
              $ref: '#/components/schemas/self_link'
    3DS_challenge_200_response_unavailable:
      title: unavailable
      type: object
      properties:
        outcome:
          $ref: '#/components/schemas/outcome_challenge'
        _links:
          type: object
          properties:
            self:
              $ref: '#/components/schemas/self_link'
    links:
      title: Links
      type: object
      additionalProperties: true
    validation_errors:
      type: object
      required:
        - errorName
        - jsonPath
        - message
      properties:
        errorName:
          maxLength: 2048
          minLength: 1
          type: string
          description: Unique name of the validation error.
        jsonPath:
          maxLength: 2048
          minLength: 1
          type: string
          description: Location of the field in request body for which the error occurred.
        message:
          maxLength: 2048
          minLength: 1
          type: string
          description: Error description message.
    3DS_query_200_response:
      type: object
      discriminator:
        propertyName: outcome
        mapping:
          3dsAuthenticated: '#/components/schemas/3DS_query_200_response_authenticated'
          3dsAttempted: '#/components/schemas/3DS_query_200_response_attempted'
          3dsRejected: '#/components/schemas/3DS_query_200_response_rejected'
          3dsNotAuthenticated: '#/components/schemas/3DS_query_200_response_not_authenticated'
          3dsUnavailable: '#/components/schemas/3DS_query_200_response_unavailable'
          3dsChallengeFailed: '#/components/schemas/3DS_query_200_response_challenge_failed'
          3dsOutage: '#/components/schemas/3DS_query_200_response_outage'
          3dsBypassed: '#/components/schemas/3DS_query_200_response_bypassed'
          3dsDataOnly: '#/components/schemas/3DS_query_200_response_data_only'
          3dsExempted: '#/components/schemas/3DS_query_200_response_exempted'
          3dsRedirect: '#/components/schemas/3DS_query_200_response_redirect'
      properties:
        outcome:
          type: string
    3DS_device_200_response:
      type: object
      discriminator:
        propertyName: outcome
        mapping:
          3dsAuthenticated: '#/components/schemas/3DS_device_200_response_authenticated'
          3dsChallenged: '#/components/schemas/3DS_device_200_response_challenged'
          3dsAttempted: '#/components/schemas/3DS_device_200_response_attempted'
          3dsRejected: '#/components/schemas/3DS_device_200_response_rejected'
          3dsNotAuthenticated: '#/components/schemas/3DS_device_200_response_not_authenticated'
          3dsUnavailable: '#/components/schemas/3DS_device_200_response_unavailable'
          3dsOutage: '#/components/schemas/3DS_device_200_response_outage'
          3dsBypassed: '#/components/schemas/3DS_device_200_response_bypassed'
          3dsDataOnly: '#/components/schemas/3DS_device_200_response_data_only'
          3dsExempted: '#/components/schemas/3DS_device_200_response_exempted'
      properties:
        outcome:
          type: string
    3DS_challenge_200_response:
      type: object
      discriminator:
        propertyName: outcome
        mapping:
          3dsAuthenticated: '#/components/schemas/3DS_challenge_200_response_authenticated'
          3dsNotAuthenticated: '#/components/schemas/3DS_challenge_200_response_not_authenticated'
          3dsUnavailable: '#/components/schemas/3DS_challenge_200_response_unavailable'
    3DS_ddi_200_response:
      type: object
      discriminator:
        propertyName: provider
        mapping:
          cardinal: '#/components/schemas/3DS_ddi_200_response_cardinal'
          ravelin: '#/components/schemas/3DS_ddi_200_response_ravelin'
      properties:
        outcome:
          type: string
    3DS_ddi_200_response_cardinal:
      title: cardinal
      required:
        - provider
      type: object
      properties:
        provider:
          enum:
            - cardinal
            - ravelin
          type: string
          description: The outcome of the authentication request.
        jwt:
          maxLength: 2048
          minLength: 1
          type: string
          description: >-
            A digitally signed token that contains additional details required
            for DDC.
        url:
          maxLength: 2048
          minLength: 1
          type: string
          description: >-
            A POST action on the DDC form. Used to redirect to the issuers DDC
            page.
        bin:
          type: string
          description: >-
            First six digits of the card number (Bank Identification Number),
            used as part of DDC. Returned if a token resource, network payment
            token or card number is included in the request.
    3DS_ddi_200_response_ravelin:
      title: ravelin
      required:
        - provider
      type: object
      properties:
        provider:
          enum:
            - cardinal
            - ravelin
          type: string
          description: The outcome of the authentication request.
        acsUrl:
          maxLength: 2048
          minLength: 1
          type: string
          description: Issuer ACS Url to perform device data collection.
    outcome_query:
      type: string
      description: The latest outcome state for a given request authenticationId.
      enum:
        - 3dsAuthenticated
        - 3dsAttempted
        - 3dsRejected
        - 3dsNotAuthenticated
        - 3dsUnavailable
        - 3dsChallengeFailed
        - 3dsOutage
        - 3dsBypassed
        - 3dsDataOnly
        - 3dsExempted
        - 3dsRedirect
      x-enumDescriptions:
        3dsAuthenticated: Cardholder successfully authenticated by card issuer.
        3dsAttempted: >-
          3DS attempted but card issuer not participating. Stand-in
          authentication.
        3dsRejected: Issuer rejects the authentication, do not proceed with payment.
        3dsNotAuthenticated: Authentication failure by card issuer (system issue).
        3dsUnavailable: Authentication unavailable at this current time.
        3dsChallengeFailed: Failed cardholder challenge.
        3dsOutage: Issuer recognized outage. Can attempt authentication outage exemption.
        3dsBypassed: >-
          3DS bypassed based on rules or recommendation from authentication
          optimization service.
        3dsDataOnly: Successful data only authentication.
        3dsExempted: Successful exemption in 3DS authentication.
        3dsRedirect: >-
          3DS hosted redirect Url provided by Worldpay for clientside
          interaction.
    outcome_device:
      type: string
      description: The outcome of the device data complete request
      enum:
        - 3dsAuthenticated
        - 3dsAttempted
        - 3dsChallenged
        - 3dsRejected
        - 3dsNotAuthenticated
        - 3dsUnavailable
        - 3dsOutage
        - 3dsBypassed
        - 3dsDataOnly
        - 3dsExempted
      x-enumDescriptions:
        3dsAuthenticated: Cardholder successfully authenticated by card issuer
        3dsAttempted: >-
          3DS attempted but card issuer not participating. Stand-in
          authentication
        3dsChallenged: Issuer requests an identity check using the challenge screen
        3dsRejected: Issuer rejects the authentication, do not proceed with payment
        3dsNotAuthenticated: Authentication failure by card issuer (system issue)
        3dsUnavailable: Authentication unavailable at this current time
        3dsOutage: Issuer recognized outage. Can attempt authentication outage exemption
        3dsBypassed: >-
          3DS bypassed based on rules or recommendation from authentication
          optimization service
        3dsDataOnly: Successful data only authentication
        3dsExempted: Successful exemption in 3DS authentication
    outcome_challenge:
      type: string
      description: The outcome of the challenge complete request
      enum:
        - 3dsAuthenticated
        - 3dsChallengeFailed
        - 3dsUnavailable
      x-enumDescriptions:
        3dsAuthenticated: Cardholder successfully authenticated by card issuer
        3dsChallengeFailed: Failed cardholder challenge
        3dsUnavailable: Authentication unavailable at this current time
  parameters:
    wp_api_version:
      name: WP-Api-Version
      in: header
      description: The API version.
      required: true
      example: '2026-12-01'
      schema:
        type: string
        enum:
          - '2026-12-01'
    authentication_id:
      name: authenticationId
      description: Unique identifier for a single 3ds authentication. Generated by us.
      in: path
      required: true
      schema:
        type: string
    key:
      name: key
      description: >-
        Unique short lived value generated by us and used as part of the
        redirect url path.
      in: path
      required: true
      schema:
        type: string
  securitySchemes:
    BasicAuth:
      type: http
      scheme: basic
  examples:
    '502':
      description: An invalid response is received from upstream
      value:
        message: Service Unavailable
        errorName: serviceUnavailable
        _links:
          self:
            href: https://try.access.worldpay.com/api/3ds/LfC-Tuhv7J2nEw2m9ca_e
    '503':
      description: The requested service is unavailable
      value:
        message: Service Unavailable
        errorName: serviceUnavailable
        _links:
          self:
            href: https://try.access.worldpay.com/api/3ds/LfC-Tuhv7J2nEw2m9ca_e
    card:
      description: Card authentication request with minimum recommended values
      value:
        orderReference: order-1234
        transactionReference: request-5678
        merchant:
          entity: default
        instruction:
          value:
            amount: 100
            currency: GBP
          paymentInstrument:
            type: card/plain
            cardNumber: '4444333322221111'
            cardHolderName: Sherlock Holmes
            expiryDate:
              month: 1
              year: 2028
            billingAddress:
              address1: 221B Baker Street
              city: London
              postalCode: NW1 6XE
              countryCode: GB
        customer:
          firstName: Sherlock
          lastName: Holmes
          phone: '02031234321'
          email: sherlock.holmes@example.com
    card-all:
      description: Full card authentication request with all key values
      value:
        orderReference: order-1234
        transactionReference: request-5678
        merchant:
          entity: default
          overrideName: string
          acquirerId: '01234567'
        instruction:
          value:
            amount: 100
            currency: GBP
          paymentInstrument:
            type: card/plain
            cardNumber: '4444333322221111'
            cardHolderName: Sherlock Holmes
            expiryDate:
              month: 1
              year: 2028
            billingAddress:
              address1: 221B Baker Street
              city: London
              postalCode: NW1 6XE
              countryCode: GB
        deviceData:
          acceptHeader: text/html
          userAgentHeader: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0)
          browserLanguage: en-GB
          ipAddress: 192.168.1.1
          browserJavaEnabled: true
          browserColorDepth: '15'
          browserScreenHeight: 1200
          browserScreenWidth: 1920
          timeZone: '-300'
          browserJavascriptEnabled: true
        customer:
          firstName: Sherlock
          lastName: Holmes
          phone: '02031234321'
          email: sherlock.holmes@example.com
        challenge:
          preference: noPreference
          windowSize: 390x400
        previousSuspiciousActivity: true
        userType: guestUser
        accountHistory:
          createdAt: string
          modifiedAt: string
          passwordModifiedAt: string
          paymentAccountEnrolledAt: string
        reorder: true
        preOrderDate: string
        transactionHistory:
          attemptsLastDay: 0
          attemptsLastYear: 0
          completedLastSixMonths: 0
          addCardsLastDay: 0
          shippingAddressFirstUsedAt: string
        giftCardsPurchase:
          totalValue:
            amount: 99999999999
            currency: GBP
          quantity: 0
        shipping:
          nameMatchesAccountName: false
          method: billingAddress
          timeFrame: electronic
          email: sherlock.holmes@example.com
          phone: '01911234321'
          firstName: James
          lastName: Moriarty
          address:
            address1: The Palatine Centre
            address2: Durham University
            address3: Stockton Road
            postalCode: DH1 3LE
            city: Durham
            state: County Durham
            countryCode: GB
    token:
      description: Worldpay Token authentication request with minimum recommended values
      value:
        orderReference: order-1234
        transactionReference: request-5678
        merchant:
          entity: default
        instruction:
          value:
            amount: 100
            currency: GBP
          paymentInstrument:
            type: card/token
            href: https://try.access.worldpay.com/tokens/MTIzNDU2Nzg5MDEyMzQ1Ng
        customer:
          firstName: Sherlock
          lastName: Holmes
          phone: '02031234321'
          email: sherlock.holmes@example.com
    networkToken:
      description: Network token authentication request with minimum recommended values
      value:
        orderReference: order-1234
        transactionReference: request-5678
        merchant:
          entity: default
        instruction:
          value:
            amount: 100
            currency: GBP
          paymentInstrument:
            type: card/networkToken
            tokenNumber: '4444333322221111'
            cardHolderName: Sherlock Holmes
            expiryDate:
              month: 1
              year: 2028
            billingAddress:
              address1: 221B Baker Street
              city: London
              postalCode: NW1 6XE
              countryCode: GB
        customer:
          firstName: Sherlock
          lastName: Holmes
          phone: '02031234321'
          email: sherlock.holmes@example.com
    googlepay-encrypted:
      description: Google pay encrypted payment
      value:
        orderReference: order-1234
        transactionReference: request-5678
        merchant:
          entity: default
        instruction:
          value:
            amount: 100
            currency: GBP
          paymentInstrument:
            type: googlepay/encrypted
            walletToken: >-
              {"protocolVersion":"ECv1","signature":"MEQCIH6Q4OwQ0jAceFEkGF0JID6sJNXxOEi4r+mA7biRxqBQAiAondqoUpU/bdsrAOpZIsrHQS9nwiiNwOrr24RyPeHA0Q\u003d\u003d","signedMessage":"{\"tag\":\"jpGz1F1Bcoi/fCNxI9n7Qrsw7i7KHrGtTf3NrRclt+U\\u003d\",\"ephemeralPublicKey\":\"BJatyFvFPPD21l8/uLP46Ta1hsKHndf8Z+tAgk+DEPQgYTkhHy19cF3h/bXs0tWTmZtnNm+vlVrKbRU9K8+7cZs\\u003d\",\"encryptedMessage\":\"mKOoXwi8OavZ\"}"}
            billingAddress:
              address1: 221B Baker Street
              city: London
              postalCode: NW1 6XE
              countryCode: GB
        customer:
          firstName: Sherlock
          lastName: Holmes
          phone: '02031234321'
          email: sherlock.holmes@example.com
    googlepay-decrypted:
      description: Google pay decrypted payment
      value:
        orderReference: order-1234
        transactionReference: request-5678
        merchant:
          entity: default
        instruction:
          value:
            amount: 100
            currency: GBP
          paymentInstrument:
            type: googlepay/decrypted
            tokenNumber: '4444333322221111'
            expiryDate:
              month: 5
              year: 2035
            billingAddress:
              address1: 221B Baker Street
              city: London
              postalCode: NW1 6XE
              countryCode: GB
        customer:
          firstName: Sherlock
          lastName: Holmes
          phone: '02031234321'
          email: sherlock.holmes@example.com
    redirect:
      description: >-
        Use a hosted 3DS page to wrap and perform device data collection, and
        when prompted display a challenge from the issuer
      value:
        outcome: 3dsRedirect
        authenticationId: 3dsLfC-Tuhv7J2nEw2m9ca_e0
        redirect: https://hosted.worldpay.com/xxxxxxxxxx/redirect
        _links:
          self:
            href: https://try.access.worldpay.com/api/3ds/{authenticationId}
    400-invalid-chars:
      description: >-
        The request contains invalid characters in `transactionReference` and
        `merchant.entity` fields
      value:
        message: The json body provided does not match the expected schema
        errorName: bodyDoesNotMatchSchema
        validationErrors:
          - errorName: stringFailedRegexCheck
            jsonPath: $.merchant.entity
            message: Entity must be alphanumeric with optional spaces
          - errorName: stringFailedRegexCheck
            jsonPath: $.transactionReference
            message: >-
              Transaction reference characters must be alphanumeric or one of
              the following: _!@#$%()*=-.:;?[]{}~`/+
        _links:
          self:
            href: https://try.access.worldpay.com/api/3ds/LfC-Tuhv7J2nEw2m9ca_e
    400-content-type:
      description: The request contains an invalid Content-Type header
      value:
        message: Provided request contains a header with an invalid value
        errorName: headerHasInvalidValue
        headerName: Content-Type
        _links:
          self:
            href: https://try.access.worldpay.com/api/3ds/LfC-Tuhv7J2nEw2m9ca_e
    400-invalid-method:
      description: The request is using an invalid HTTP method
      value:
        errorName: methodNotAllowed
        allowedMethods:
          - POST
        message: Method GET not allowed for this request
        _links:
          self:
            href: https://try.access.worldpay.com/api/3ds/LfC-Tuhv7J2nEw2m9ca_e
    3dsAuthenticated:
      description: Successful frictionless authentication
      value:
        outcome: 3dsAuthenticated
        status: 'Y'
        enrolled: 'Y'
        version: 2.2.0
        authenticationValue: MAAAAAAAAAAAAAAAAAAAAAAAAAA=
        eci: '05'
        dsTransactionId: c5b808e7-1de1-4069-a17b-f70d3b3b1645
        acsTransactionId: fe007a6e-315f-4cdf-98ca-28a9e40e3581
        _links:
          self:
            href: https://try.access.worldpay.com/api/3ds/LfC-Tuhv7J2nEw2m9ca_e
    3dsAttempted:
      description: Attempted Authentication, scheme step in
      value:
        outcome: 3dsAttempted
        status: A
        enrolled: 'Y'
        version: 2.2.0
        authenticationValue: MAAAAAAAAAAAAAAAAAAAAAAAAAA=
        eci: '06'
        dsTransactionId: c5b808e7-1de1-4069-a17b-f70d3b3b1645
        acsTransactionId: fe007a6e-315f-4cdf-98ca-28a9e40e3581
        _links:
          self:
            href: https://try.access.worldpay.com/api/3ds/LfC-Tuhv7J2nEw2m9ca_e
    3dsRejected:
      description: Issuer rejected the authentication
      value:
        outcome: 3dsRejected
        status: R
        enrolled: 'Y'
        version: 2.2.0
        eci: '07'
        dsTransactionId: c5b808e7-1de1-4069-a17b-f70d3b3b1645
        acsTransactionId: fe007a6e-315f-4cdf-98ca-28a9e40e3581
        _links:
          self:
            href: https://try.access.worldpay.com/api/3ds/LfC-Tuhv7J2nEw2m9ca_e
    3dsNotAuthenticated:
      description: >-
        Issuer failed the authentication without providing the option for a
        challenge
      value:
        outcome: 3dsNotAuthenticated
        status: 'N'
        enrolled: 'Y'
        version: 2.2.0
        eci: '07'
        dsTransactionId: c5b808e7-1de1-4069-a17b-f70d3b3b1645
        acsTransactionId: fe007a6e-315f-4cdf-98ca-28a9e40e3581
        _links:
          self:
            href: https://try.access.worldpay.com/api/3ds/LfC-Tuhv7J2nEw2m9ca_e
    3dsUnavailable:
      description: Error/Timeout whilst attempting authentication
      value:
        outcome: 3dsUnavailable
        status: U
        enrolled: 'Y'
        version: 2.2.0
        dsTransactionId: c5b808e7-1de1-4069-a17b-f70d3b3b1645
        acsTransactionId: fe007a6e-315f-4cdf-98ca-28a9e40e3581
        _links:
          self:
            href: https://try.access.worldpay.com/api/3ds/LfC-Tuhv7J2nEw2m9ca_e
    3dsChallengeFailed:
      description: Challenge failed
      value:
        outcome: 3dsChallengeFailed
        status: 'N'
        version: 2.2.0
        eci: '07'
        dsTransactionId: c5b808e7-1de1-4069-a17b-f70d3b3b1645
        acsTransactionId: fe007a6e-315f-4cdf-98ca-28a9e40e3581
        _links:
          self:
            href: https://try.access.worldpay.com/api/3ds/LfC-Tuhv7J2nEw2m9ca_e
    3dsOutage:
      description: >-
        A downstream service within the 3DS ecosystem is unavailable; you can
        attempt authorization
      value:
        outcome: 3dsOutage
        _links:
          self:
            href: https://try.access.worldpay.com/api/3ds/LfC-Tuhv7J2nEw2m9ca_e
    3dsBypassed:
      description: Bypass the authentication flow using rules
      value:
        outcome: 3dsBypassed
        decision: rules
        enrolled: B
        version: 2.2.0
        eci: '07'
        dsTransactionId: c5b808e7-1de1-4069-a17b-f70d3b3b1645
        acsTransactionId: fe007a6e-315f-4cdf-98ca-28a9e40e3581
        _links:
          self:
            href: https://try.access.worldpay.com/api/3ds/LfC-Tuhv7J2nEw2m9ca_e
    3dsDataOnly:
      description: Data only authentication
      value:
        outcome: 3dsDataOnly
        decision: authenticationOptimization
        status: I
        enrolled: 'Y'
        version: 2.2.0
        authenticationValue: MAAAAAAAAAAAAAAAAAAAAAAAAAA=
        eci: '05'
        dsTransactionId: c5b808e7-1de1-4069-a17b-f70d3b3b1645
        acsTransactionId: fe007a6e-315f-4cdf-98ca-28a9e40e3581
        _links:
          self:
            href: https://try.access.worldpay.com/api/3ds/LfC-Tuhv7J2nEw2m9ca_e
    3dsExempted:
      description: Exemption in 3DS successful
      value:
        outcome: 3dsExempted
        status: I
        enrolled: 'Y'
        version: 2.2.0
        authenticationValue: MAAAAAAAAAAAAAAAAAAAAAAAAAA=
        eci: '07'
        dsTransactionId: c5b808e7-1de1-4069-a17b-f70d3b3b1645
        acsTransactionId: fe007a6e-315f-4cdf-98ca-28a9e40e3581
        _links:
          self:
            href: https://try.access.worldpay.com/api/3ds/LfC-Tuhv7J2nEw2m9ca_e
    3dsRedirect:
      description: >-
        Use a hosted 3DS page to wrap and perform device data collection, and
        when prompted display a challenge from the issuer
      value:
        outcome: 3dsRedirect
        authenticationId: 3dsLfC-Tuhv7J2nEw2m9ca_e0
        redirect: https://try.{hosted-path-tbc}.worldpay.com/{authenticationId}/redirect
        _links:
          self:
            href: https://try.access.worldpay.com/api/3ds/{authenticationId}
security:
  - BasicAuth: []
