# MerchantThreeDSBinding

A model the API reference uses in a request or a response. The operation pages link every field typed as this model here.

Per-merchant 3-D Secure provider binding, one element of `Merchant.ThreeDSBindings`.
            


The binding is independent of the acquiring processor. The directory server and access control
server a card authenticates against belong to the card network, not the acquirer, so a merchant
can change processor without changing 3-D Secure vendor and vice versa.

            


Collection membership decides whether the merchant is boarded with that provider at all, and
`isEnabled` decides whether it is currently switched on: the same two-level shape
`MerchantDigitalWallet` uses, so a merchant can be switched off without losing credentials.

## Fields
- `providerType` ([ThreeDSProviderType](https://devportal.demo.winkpg.io/docs/api/models/ThreeDSProviderType.md)): Which 3-D Secure provider this entry binds the merchant to. A null provider type is treated  as no binding at all rather than as `Fake`, so an incompletely  boarded row cannot silently become a live selection. (nullable)
  Values:
  - `Fake`: Deterministic in-memory provider that performs no network calls. The local-dev, CI, and default-selection provider, and the safe landing spot for an absent configuration value.
  - `Paay`: Paay (API brand "3DS Integrator"), reached over its Direct API. Supports authentication, the 3DS Method step, the cardholder challenge, and 3RI; it documents no decoupled or Secure Payment Confirmation capability, so the registry refuses those.
- `isEnabled` (boolean): Master enable flag for this provider on this merchant. When `false` or null, the binding  is not used even though the row exists. (nullable)
- `policyMode` ([ThreeDSPolicyMode](https://devportal.demo.winkpg.io/docs/api/models/ThreeDSPolicyMode.md)): How hard the merchant wants authentication applied. Null means the platform default, which  callers read as `Off`. (nullable)
  Values:
  - `Off`: Do not attempt 3-D Secure at all. The safe landing spot for an absent stored value.
  - `Attempt`: Attempt authentication, but continue with the payment when it cannot be completed. Liability shift is taken where the issuer grants it and forgone where it does not.
  - `Require`: Attempt authentication and refuse the payment when it cannot be completed. The merchant has chosen never to process an unauthenticated transaction on the surfaces this applies to.
- `apiKey` (string): The vendor API key. Not a secret in the sense the JWT secret is (it is sent as a request  header and appears as a JWT audience), so it round-trips on reads; it is still never logged. Required: When IsEnabled is true. (nullable, max length 256)
- `jwtSecret` (string): The shared secret the request JWT is signed with.                   <b>Stored encrypted.</b> It is stripped, not decrypted, on every read that leaves the server:  the admin UI and the API both see null here and re-send the secret only when the operator  changes it. Only the server-side call to the provider ever uses the plaintext. (nullable, max length 512)
- `jwtSecretConfigured` (boolean): Whether a JWT secret is stored for this binding, for the editor that is never allowed to see the  secret itself. (nullable)
- `endpointEnvironment` ([ThreeDSEndpointEnvironment](https://devportal.demo.winkpg.io/docs/api/models/ThreeDSEndpointEnvironment.md)): Which of the vendor's environments this binding points at. Null reads as  `Sandbox`. (nullable)
  Values:
  - `Sandbox`: The vendor's test environment. The safe landing spot for an absent stored value.
  - `Live`: The vendor's production environment.
- `requestorUrl` (string): The merchant-facing origin the vendor validates authentication requests against: the HPP or  checkout origin the cardholder's browser is on. HTTPS only. Conditional: When RequestorUrl is not empty. Required: When IsEnabled is true. (nullable, max length 512)
- `challengeEnabled` (boolean): Whether the merchant permits the vendor to raise an interactive challenge. Null reads as not  enabled. (nullable)
- `protocolVersion` (string): The 3-D Secure protocol version to request, from  `SupportedProtocolVersions`. Null means the provider's own  default. Conditional: When ProtocolVersion is not empty. (nullable, max length 16)
- `providerRegistrationId` (string(uuid)): Optional pointer at a vendor-side registration record for this merchant, for vendors that  board a merchant out of band and hand back an identifier. Nullable because most bindings  carry credentials and nothing else, and because a deleted registration should leave an  inspectable dangling reference rather than a hard failure. (nullable)

## See also

- [All documentation](https://devportal.demo.winkpg.io/llms.txt): the machine-readable index of every public page on this site.