# ThreeDSAuthenticationData A model the API reference uses in a request or a response. The operation pages link every field typed as this model here. The 3-D Secure authentication record persisted on a transaction: the merchant-safe outcome the directory server and issuer reported, plus the issuer credential the authorization forwards to claim the liability shift. ## Fields - `providerType` ([ThreeDSProviderType](https://devportal.demo.winkpg.io/docs/api/models/ThreeDSProviderType.md)): Which 3-D Secure provider produced this authentication. (nullable) Values: - `Fake`: Deterministic in-memory provider that performs no network calls. The local-dev, CI, and default-selection provider, and the safe landing spot for an absent configuration value. - `Paay`: Paay (API brand "3DS Integrator"), reached over its Direct API. Supports authentication, the 3DS Method step, the cardholder challenge, and 3RI; it documents no decoupled or Secure Payment Confirmation capability, so the registry refuses those. - `messageCategory` ([ThreeDSMessageCategory](https://devportal.demo.winkpg.io/docs/api/models/ThreeDSMessageCategory.md)): The EMVCo message category the authentication ran under: a payment authentication or a non-payment one (adding a card on file, verifying an account). (nullable) Values: - `Payment`: Wire value 01: a payment authentication. - `NonPayment`: Wire value 02: a non-payment authentication, such as adding a card on file or verifying an account without an amount. - `threeDSVersion` (string): The 3DS message version the flow negotiated, in EMVCo dotted form (for example `2.2.0`). A string because the wire field is a string and a new version must not need a code change here. (nullable) - `threeDSServerTransactionId` (string): The 3DS server transaction identifier that correlates every message in this authentication. The one identifier a support agent needs to trace a 3DS flow end to end with the provider. (nullable) - `dsTransactionId` (string): The directory server transaction identifier, which most schemes require on the authorization and which a later merchant-initiated (3RI) authentication quotes as its prior reference. (nullable) - `acsTransactionId` (string): The access control server (issuer) transaction identifier, used to correlate a challenge with its authentication. (nullable) - `transactionStatus` ([ThreeDSTransactionStatus](https://devportal.demo.winkpg.io/docs/api/models/ThreeDSTransactionStatus.md)): The normalized EMVCo `transStatus` (wire values `Y`, `N`, `U`, `A`, `C`, `D`, `R`, `I`). This, not `liabilityShifted`, is the protocol answer; the liability flag is the interpretation. (nullable) Values: - `Unknown`: No status was reported, or the value could not be mapped. Treated as "no authentication happened": never liability-shifting. - `Authenticated`: Wire value Y: authentication or account verification succeeded. - `NotAuthenticated`: Wire value N: not authenticated, or the transaction was denied. - `Unavailable`: Wire value U: authentication could not be performed (technical or other problem). - `AttemptsProcessed`: Wire value A: an authentication attempt was performed and proof is supplied, but the cardholder was not actually authenticated (the "attempts" / stand-in path). - `ChallengeRequired`: Wire value C: a cardholder challenge is required to complete authentication. - `DecoupledChallengeRequired`: Wire value D: a decoupled cardholder challenge is required (3DS 2.2 and later). - `Rejected`: Wire value R: authentication was rejected by the issuer. - `InformationalOnly`: Wire value I: informational only. The 3DS requestor asked for information and no authentication was performed. - `transactionStatusReason` (string): The EMVCo `transStatusReason`, present when the issuer explains a non-authenticated status. (nullable) - `eci` (string): The electronic commerce indicator to forward on the authorization. Scheme-specific: Visa and Amex use `05` / `06` / `07`, Mastercard uses `02` / `01` / `00`. Distinct from the wallet `CardData.EciIndicator`, which a wallet decryption writes. (nullable) - `cavvResultCode` (string): The scheme's CAVV result code, describing how the issuer validated the credential. Metadata about the credential, not the credential, so it is merchant-safe. (nullable) - `cavvAlgorithm` (string): The algorithm the issuer used to generate the credential, where the scheme reports one. Metadata about the credential, not the credential, so it is merchant-safe. (nullable) - `liabilityShifted` (boolean): `true` when this outcome shifts chargeback liability to the issuer under the scheme's rules for the reported status and ECI. Set by the provider so the rule lives in one place per vendor; readers must not re-derive it. (nullable) - `challengeRequired` (boolean): `true` when the issuer required a cardholder challenge to complete the authentication. (nullable) - `challengeCompleted` (boolean): `true` when a required challenge ran to completion and the issuer reported its result; `false` when the cardholder abandoned it or it timed out; `null` when no challenge was required. (nullable) - `authenticationType` ([ThreeDSAuthenticationType](https://devportal.demo.winkpg.io/docs/api/models/ThreeDSAuthenticationType.md)): How the authentication reached its outcome: frictionless, challenged, an attempts stand-in, or merchant-initiated. (nullable) Values: - `Frictionless`: The issuer authenticated the cardholder from the risk data alone; no challenge was presented. - `Challenge`: The issuer required a cardholder challenge and the flow completed it (or the challenge was attempted and the issuer reported its result). - `Attempt`: The directory server or the scheme stood in for an issuer that could not authenticate and produced attempts proof (wire status A). Liability may still shift under scheme rules. - `RequestorInitiated`: A merchant-initiated (3RI) authentication with no cardholder present, run against a prior authentication. - `authenticatedAtUtc` (string(date-time)): UTC instant the authentication outcome was recorded on the transaction. (nullable) - `cavv` (string): The base64-encoded cardholder authentication verification value the issuer returned (Visa, Discover, Amex). Always sensitive: never logged, never delivered on a webhook, never written into transaction history, and masked on every read surface. `null` on a Mastercard authentication, which carries `aav` instead. (nullable) - `aav` (string): The base64-encoded accountholder authentication value (Mastercard's spelling of the same credential as `cavv`). Handled identically: always sensitive. (nullable) ## See also - [All documentation](https://devportal.demo.winkpg.io/llms.txt): the machine-readable index of every public page on this site.