Create payment request

• true - the billing and shipping addresses are identical
• false - the billing and shipping addresses are different

Deprecated - please use order.shipping.addressIndicator to indicate that the billing and shipping address are identical.

The website from which the purchase was made

Moved from fraudFields.website and renamed to make it more clear we expect an URL.

This property is not used for 3-D Secure version 2.

Required for merchants from Brazil in case order.amountOfMoney.amount is not 0

Identifies the type of transaction being authenticated.

• purchase = The purpose of the transaction is to purchase goods or services
• check-acceptance = The purpose of the transaction is to accept a 'check'/'cheque'
• account-funding = The purpose of the transaction is to fund an account
• quasi-cash = The purpose of the transaction is buy a quasi cash type product that is representative of actual cash such as money orders, traveler's checks, foreign currency, lottery tickets or casino gaming chips.
• prepaid-activation-or-load = The purpose of the transaction is to activate or load a prepaid card

The date (YYYYMMDD) on which the consumer created their account with you

We will calculate the CustomerAccountAgeIndicator using this property and the order.customer.accountType.

The last date (YYYYMMDD) on which the consumer made changes to their account with you. These are changes to billing & shipping address details, new payment account (tokens), or new users(s) added.

We will use the data from this property and the order.customer.account.changedDuringCheckout to determine the 'age' of the changes. For 3-D Secure version 2 this property and the 'age' of the changes are used.

• true = the consumer made changes to their account during this checkout
• false = the consumer didn't change anything to their account during this checkout

The changes meant here are changes to billing & shipping address details, new payment account (tokens), or new users(s) added.

We will use the data from this property and the order.customer.account.changeDate to determine the 'age' of the changes. For 3-D Secure version 2 only the resulting 'age' of the changes is used.

The last date (YYYYMMDD) on which the consumer changed their password for the account used in this transaction

We will use the data from this property and the order.customer.account.passwordChangedDuringCheckout to determine the 'age' of the changes. For 3-D Secure version 2 this property and the 'age' of the password change are used.

• true = the consumer made changes to their password of the account used during this checkout
• false = the consumer didn't change anything to their password of the account used during this checkout

We will use the data from this property and the order.customer.account.passwordChangeDate to determine the 'age' of the password change. For 3-D Secure version 2 only the resulting 'age' of the password change is used.

Specifies if the consumer (initially) had forgotten their password

• true - The consumer has forgotten their password
• false - The consumer has not forgotten their password

Moved (and renamed) existing property order.fraudFields.hasForgottenPwd to the order.customer.account object

This property is not used for 3-D Secure version 2.

Specifies if you have experienced suspicious activity on the account of the consumer

• true = you have experienced suspicious activity (including previous fraud) on the consumer account used for this transaction
• false = you have experienced no suspicious activity (including previous fraud) on the consumer account used for this transaction

Authentication used by the consumer on your website

• guest = no login occurred, consumer is 'logged in' as guest
• merchant-credentials = the consumer logged in using credentials that are specific to you
• federated-id = the consumer logged in using a federated ID
• issuer-credentials = the consumer logged in using credentials from the card issuer (of the card used in this transaction)
• third-party-authentication = the consumer logged in using third-party authentication
• fido-authentication = the consumer logged in using a FIDO authenticator
• fido-authentication-signed-assurance = the consumer logged in using a FIDO authenticator and you have signed FIDO assurance data
• src-assurance-data = SRC Assurance Data

• not-applicable = the card used doesn't support multiple card products
• credit = the card used is a credit card
• debit = the card used is a debit card

The date (YYYYMMDD) when the payment account on file was first created.

In case a token is used for the transaction we will use the creation date of the token in our system in case you leave this property empty.

• none = None (guest)
• created = Account was created during this transaction
• existing = Existing account was used for this transaction

We will try to automatically determine the value for this field:

• in case cardPaymentMethodSpecificInput.tokenize is set to true we will set the value of this property to created (even though there might be an existing token matching the card details)
• in case a token is used for this transaction the value will be set to existing
• in case cardPaymentMethodSpecificInput.tokenize is set to false and no token is used for this transaction we will default to none

Local VAT number of the 'consumer'

Moved from order.customer

This property is not used for 3-D Secure version 2.

Required for 3-D Secure version 2 for the authenticationFlow "browser"

The accept-header of the consumer client from the HTTP Headers.

Required for 3-D Secure version 2 for the authenticationFlow "browser"

The IP address of the consumer client from the HTTP Headers.

Moved from fraudFields, increased in size (to also accommodate IPv6 addresses) and renamed (previously fraudFields.customerIpAddress)

One must use the deviceFingerprintTransactionId received by the response of the endpoint /{merchant}/products/{paymentProductId}/deviceFingerprint which was also used by the JavaScript code

Moved from fraudFields.deviceFingerprintTransactionId

This property is not used for 3-D Secure version 2, although in the future we might use this service to populate the device and browser related properties.

Degree of default form fill, with the following possible values:

• automatically - All form fields filled automatically
• automatically-but-modified - All form fields filled automatically, but some form fields were modified manually
• manually - All form fields were entered manually

Moved from fraudFields.defaultFormFill

This property is not used for 3-D Secure version 2.

Required for 3-D Secure version 2 for the authenticationFlow "browser"

Offset in minutes of timezone of the client vs the UTC. Value is returned by the JavaScript getTimezoneOffset() Method.

If you use the latest version of our JavaScript Client SDK, we will collect this data and include it in the encryptedCustomerInput property. We will then automatically populate this data if available.

Note: This data can only be collected if JavaScript is enabled in the browser. This means that 3-D Secure version 2.1 requires the use of JavaScript to be enabled. In the upcoming version 2.2 of the specification this is no longer a requirement. As we currently support version 2.1 it means that this property is required when cardPaymentMethodSpecifInput.threeDSecure.authenticationFlow is set to "browser".

Required for 3-D Secure version 2 for the authenticationFlow "browser"

Locale of the client device/browser. Returned in the browser from the navigator.language property.

If you use the latest version of our JavaScript Client SDK, we will collect this data and include it in the encryptedCustomerInput property. We will then automatically populate this data if available.

Note: This data can only be collected if JavaScript is enabled in the browser. This means that 3-D Secure version 2.1 requires the use of JavaScript to be enabled. In the upcoming version 2.2 of the specification this is no longer a requirement. As we currently support version 2.1 it means that this property is required when cardPaymentMethodSpecifInput.threeDSecure.authenticationFlow is set to "browser".

Required for 3-D Secure version 2 for the authenticationFlow "browser"

User-Agent of the client device/browser from the HTTP Headers.

As a fall-back we will use the userAgent that might be included in the encryptedCustomerInput, but this is captured client side using JavaScript and might be different.

Object containing information regarding the browser of the consumer

Required for 3-D Secure version 2 for the authenticationFlow "browser"

• true = Java is enabled in the browser
• false = Java is not enabled in the browser

Value is returned from the navigator.javaEnabled property.

If you use the latest version of our JavaScript Client SDK, we will collect this data and include it in the encryptedCustomerInput property. We will then automatically populate this data if available.

Note: This data can only be collected if JavaScript is enabled in the browser. This means that 3-D Secure version 2.1 requires the use of JavaScript to be enabled. In the upcoming version 2.2 of the specification this is no longer a requirement. As we currently support version 2.1 it means that this property is required when cardPaymentMethodSpecifInput.threeDSecure.authenticationFlow is set to "browser".

Required for 3-D Secure version 2 for the authenticationFlow "browser"

• true = JavaScript is enabled in the browser
• false = JavaScript is not enabled in the browser

Note: Required in future 3-D Secure version 2.2

Required for 3-D Secure version 2 for the authenticationFlow "browser"

ColorDepth in bits. Value is returned from the screen.colorDepth property.

If you use the latest version of our JavaScript Client SDK, we will collect this data and include it in the encryptedCustomerInput property. We will then automatically populate this data if available.

Note: This data can only be collected if JavaScript is enabled in the browser. This means that 3-D Secure version 2.1 requires the use of JavaScript to be enabled. In the upcoming version 2.2 of the specification this is no longer a requirement. As we currently support version 2.1 it means that this property is required when cardPaymentMethodSpecifInput.threeDSecure.authenticationFlow is set to "browser".

Required for 3-D Secure version 2 for the authenticationFlow "browser"

Height of the screen in pixels. Value is returned from the screen.height property.

If you use the latest version of our JavaScript Client SDK, we will collect this data and include it in the encryptedCustomerInput property. We will then automatically populate this data if available.

Note: This data can only be collected if JavaScript is enabled in the browser. This means that 3-D Secure version 2.1 requires the use of JavaScript to be enabled. In the upcoming version 2.2 of the specification this is no longer a requirement. As we currently support version 2.1 it means that this property is required when cardPaymentMethodSpecifInput.threeDSecure.authenticationFlow is set to "browser".

Required for 3-D Secure version 2 for the authenticationFlow "browser"

Width of the screen in pixels. Value is returned from the screen.width property.

If you use the latest version of our JavaScript Client SDK, we will collect this data and include it in the encryptedCustomerInput property. We will then automatically populate this data if available.

Note: This data can only be collected if JavaScript is enabled in the browser. This means that 3-D Secure version 2.1 requires the use of JavaScript to be enabled. In the upcoming version 2.2 of the specification this is no longer a requirement. As we currently support version 2.1 it means that this property is required when cardPaymentMethodSpecifInput.threeDSecure.authenticationFlow is set to "browser".

The innerHeight of the frame in case you are capturing your payments in a frame. We will use this to validate if the height provided in the cardPaymentMethodSpecifInput.threeDSecure.challengeCanvasSize will actually fit in the iFrame you use.

If you use the latest version of our JavaScript Client SDK, we will collect this data and include it in the encryptedCustomerInput property. We will then automatically populate this data if available.

Note: This data can only be collected if JavaScript is enabled in the browser.

The innerWidth of the frame in case you are capturing your payments in a frame. We will use this to validate if the width provided in the cardPaymentMethodSpecifInput.threeDSecure.challengeCanvasSize will actually fit in the iFrame you use.

If you use the latest version of our JavaScript Client SDK, we will collect this data and include it in the encryptedCustomerInput property. We will then automatically populate this data if available.

Note: This data can only be collected if JavaScript is enabled in the browser.

International version of the mobile phone number of the consumer including the leading + (i.e. +16127779311)

Official max length is N15 making it AN16 to include the leading + sign

International version of the home phone number of the consumer including the leading + (i.e. +16127779311)

Official max length is N15 making it AN16 to include the leading + sign

International version of the work phone number of the consumer including the leading + (i.e. +31235671500)

Official max length is N15 making it AN16 to include the leading + sign

• electronic = electronic delivery (services or digital goods)
• same-day = same day delivery
• overnight = overnight delivery
• 2-day-or-more = two day or more deliveries

Date (YYYYMMDD) when the shipping details for this transaction where first used

We will use the data from this property and the order.shipping.isFirstUsage to determine the 'age' of the shipping details. For 3-D Secure version 2 this property and the 'age' of the shipping details change are used.

• true = the shipping details are used for the first time with this transaction
• false = the shipping details have been used for other transactions in the past

We will use the data from this property and the order.shipping.firstUsageDate to determine the 'age' of the shipping details. For 3-D Secure version 2 only the resulting 'age' of the shipping details is used.

• same-as-billing = the shipping address and the billing address are identical
• another-verified-address-on-file-with-merchant = another verified address of the consumer that is on file with you
• different-than-billing = shipping address is different from the billing address
• ship-to-store = goods are shipped to a store (shipping address = store address)
• digital-goods = electronic delivery of digital goods
• travel-and-event-tickets-not-shipped = travel and/or event tickets that are not shipped
• other = other means of delivery

Additional address information

Moved from order.customer.shippingaddress

City

Moved from order.customer.shippingaddress

ISO 3166-1 alpha-2 country code

Moved from order.customer.shippingaddress

House number

Moved from order.customer.shippingaddress

Object containing the name elements

Moved from order.customer.shippingaddress.name

Given name(s) or first name(s) of the consumer

Moved from order.customer.shippingaddress.name.firstName

This property is not used for 3-D Secure version 2.

Surname(s) or last name(s) of the consumer

Moved from order.customer.shippingaddress.name.surname

This property is not used for 3-D Secure version 2.

Middle name - In between first name and surname - of the consumer

Moved from order.customer.shippingaddress.name.surnamePrefix

This property is not used for 3-D Secure version 2.

Title of consumer

Moved from order.customer.shippingaddress.name.title

This property is not used for 3-D Secure version 2.

State of the consumer 

Moved from order.customer.shippingaddress.state

This property is not used for 3-D Secure version 2.

ISO 3166-2 alpha-3 state code
Please note that the max length used for 3-D Secure version 2 is AN3.

Moved from order.customer.shippingaddress.stateCode

Street name

Moved from order.customer.shippingaddress.street

Zip code

Moved from order.customer.shippingaddress.zip

Shipment tracking number

Moved from fraudFields and renamed (old name = shipmentTrackingNumber) to bundle all the shipping related properties together.

This property is not used for 3-D Secure version 2.

Comments included during shipping

Moved from fraudFields and renamed (old name = shipComments) to bundle all the shipping related properties together.

This property is not used for 3-D Secure version 2.

The consumer is pre-ordering one or more items

• true = the consumer is re-ordering at least one of the items again
• false = this is the first time the consumer is ordering these items

• ECOMMERCE - The transaction is a regular E-Commerce transaction (default)
• MAIL - The transaction is a Mail Order
• MOTO - The transaction is a Mail Order/Telephone Order
• TELEPHONE - The transaction is a Telephone Order

This is used to determine if the transaction is eligible for 3-D Secure. All transactions flagged as MAIL, MOTO or TELEPHONE are out of scope for PSD2 Strong Customer Authentication.

The complete credit/debit card number (also know as the PAN)

The card number is always obfuscated in any of our responses

Required for 3-D Secure version 2, except when a token or encryptedCustomerInput that includes this data is provided.

The card holder's name on the card.

This property was optional for payments on the GlobalCollect platform, but will be required for transactions that utilize 3-D Secure version 2.

Expiry date of the card
Format: MMYY

Required, except when a token or encryptedCustomerInput that includes this data is provided.

• true - This is recurring
• false - This is one-off (default if left empty)

This is used with property recurringPaymentSequenceIndicator to determine if the transaction is a first of recurring

Date (YYYYMMDD) in the future after which no further authorisations shall be performed.

Note: This property is required when isRecurring is set to true, property recurringPaymentSequenceIndicator is set to first and 3-D Secure version 2 is enabled for the merchant.

This indicates the number of days between the recurring authorizations. Can be set to "1" to indicate that the frequency is variable.

Note: This property is required when isRecurring is set to true, property recurringPaymentSequenceIndicator is set to first and 3-D Secure version 2 is enabled for the merchant.

• first = This transaction is the first of a series of recurring transactions
• recurring = This transaction is a subsequent transaction in a series of recurring transactions

Note: For any first of a recurring the system will automatically create a token as you will need to use a token for any subsequent recurring transactions. In case a token already exists this is indicated in the response with a value of False for the isNewToken property in the response.

Note: This property is required when isRecurring is set to true.

3-D Secure will not be used when this property is set to recurring

Moved from cardPaymentMethodSpecificInput.recurringPaymentSequenceIndicator

Enum

(String)

Indicates whether a transaction is performed in-app using an EMVco certified mobile SDK or inside a browser.

• browser = Consumer is using a browser to complete the checkout (default)
• in-app = Consumer is using an app with a 3-D Secure SDK to complete the checkout

Note: We will add support for the in-app flow in a future release.

Required for 3-D Secure version 2 for the browser flow.

Dimensions of the challenge window that potentially will be displayed to the consumer. The challenge content is formatted to appropriately render in this window to provide the best possible user experience.

Preconfigured sizes are width x height in pixels of the window displayed in the consumer browser window. Possible values are:

• 250x400 (default)
• 390x400
• 500x600
• 600x400
• full-screen

Allows you to indicate if you want the consumer to be challenged for extra security on this transaction.

• no-preference = You have no preference whether or not to challenge the consumer (default)
• no-challenge-requested = you prefer the cardholder not to be challenged
• challenge-requested = you prefer the consumer to be challenged
• challenge-required = you require the consumer to be challenged

Allows you to indicate if you want us to request a certain type of exemption.

• none = No exemption flagging is to be used of this transaction (Default)
• automatic = Our systems will determine the best possible exemption based on the transaction parameters and the risk scores
• transaction-risk-analysis = You have determined that this transaction is of low risk and are willing to take the liability. Please note that your fraud rate needs to stay below thresholds to allow your use of this exemption.
• low-value = The value of the transaction is below 30 EUR. Please note that the issuer will still require every 5th low-value transaction in 24 hours to be strongly authenticated. The issuer will also keep track of the cumulative amount authorized on the card. When this exceeds 150 EUR strong customer authentication is also required.
• whitelist = You have been whitelisted by the customer at the issuer

Object containing results of an external authentication (not performed by Worldline)

Moved from cardPaymentMethodSpecificInput

The CAVV (cardholder authentication verification value) or AAV (accountholder authentication value) provides an authentication validation value.

This is mandatory for ECI 1, 2, 5 and 6.

Moved from cardPaymentMethodSpecificInput.externalCardHolderAuthenticationData

The algorithm, from your 3D Secure provider, used to generate the authentication CAVV.

• The 3D Secure authentication for the transaction is managed by a non-Worldline 3D Secure authentication provider
• You process the transaction through Atos

Moved from cardPaymentMethodSpecificInput.externalCardHolderAuthenticationData

• 0 = No authentication, Internet (no liability shift, not a 3D Secure transaction)
• 1 = Authentication attempted (MasterCard)
• 2 = Successful authentication (MasterCard)
• 5 = Successful authentication (Visa, Diners Club, Amex)
• 6 = Authentication attempted (Visa, Diners Club, Amex)
• 7 = No authentication, Internet (no liability shift, not a 3D Secure transaction)
• (empty) = Not checked or not enrolled

Moved from cardPaymentMethodSpecificInput.externalCardHolderAuthenticationData

The 3D Secure authentication result from your 3D Secure provider.

• The 3D Secure authentication for the transaction is managed by a non-Worldline 3D Secure authentication provider
• You process the transaction through Atos

Moved from cardPaymentMethodSpecificInput.externalCardHolderAuthenticationData

The transaction ID that is used for the 3D Authentication version 1

Moved from cardPaymentMethodSpecificInput.externalCardHolderAuthenticationData

Object containing data regarding the consumer authentication that occurred prior to the current transaction

The ACS Transaction ID for a prior 3-D Secure authenticated transaction (for example, the first recurring transaction that was authenticated with the consumer).

enum (string)

• frictionless = frictionless authentication
• challenged = cardholder was challenged
• avs-verified = AVS verified
• other = another issuer method was used to authenticate this transaction

Timestamp in UTC (YYYYMMDDHHmm) of the prior 3-D Secure authentication

Required for 3-D Secure version 2 for the browser flow.

Object containing browser specific redirection related data

Moved from cardPaymentMethodSpecificInput

Required for 3-D Secure version 2 for the browser flow.

The URL that the consumer is redirect to after the payment flow has finished. You can add any number of key value pairs in the query string that, for instance help you to identify the consumer when they return to your site. Please note that we will also append some additional key value pairs that will also help you with this identification process.
Note: The provided URL should be absolute and contain the protocol to use, e.g. http:// or https://. For use on mobile devices a custom protocol can be used in the form of protocol://. This protocol must be registered on the device first.
URLs without a protocol will be rejected.

Moved from cardPaymentMethodSpecificInput

Using the Configuration Center it is possible to create multiple variations of your MyCheckout payment pages. The redirection flow for 3-D Secure uses the MyCheckout payment pages to display the following types of pages:

• Redirection page - All redirection using a POST method will load a page in the browser of the consumer that performs the actual redirection. This page contains a message to the consume explaining what is happening.
• MethodURL page - Certain Issuers will use a specific flow in case of 3-D Secure version 2 to directly collect information from the consumer browser. This page contains a spinner indicating that this process is going on in.

By specifying a specific variant you can force the use of another variant then the default. This allows you to test out the effect of certain changes to your MyCheckout payment pages in a controlled manner. Please note that you need to specify the ID instead of the name of the variant.

Required for 3-D Secure version 2 for the in-app flow.

Universally unique ID created upon all installations and updates of your app on a consumer Device. This will be newly generated and stored by the 3DS SDK for each installation or update.

Required for 3-D Secure version 2 for the in-app flow.

Device information gathered by the 3DS SDK on a consumer device. This is JSON name/value pairs that as a whole is Base64url encoded.

Object containing rendering options of the device

Enum

(string)

Required for 3-D Secure version 2 for the in-app flow.

Lists all of the SDK Interface types that the device supports for displaying specific challenge user interfaces within the SDK.

• native = The app supports only a native user interface
• html = The app supports only an HTML user interface
• both = Both Native and HTML user interfaces are supported by the app

Enum

(string)

Required for 3-D Secure version 2 for the in-app flow.

Lists all UI types that the device supports for displaying specific challenge user interfaces within the SDK.

• text = Text interface
• single-select = Select a single option
• multi-select = Select multiple options
• oob = Out of bounds
• html-other = HTML Other (only valid when cardPaymentMethodSpecificInput.threeDSecure.sdkData.deviceRenderOptions.sdkInterface is set to html)

Note: Currently, all 3-D Secure SDKs need to support all UI Types. In the future, however, this may change (for example, smart watches may support a UI Type not yet defined by this specification).

Required for 3-D Secure version 2 for the in-app flow.

JWE Object containing data encrypted by the 3-D Secure SDK.

Required for 3-D Secure version 2 for the in-app flow.

Public key component of the ephemeral key pair generated by the 3-D Secure SDK and used to establish session keys between the 3-D Secure SDK and ACS.

Required for 3-D Secure version 2 for the in-app flow, except when order.amountOfMoney.amount is zero.

Indicates maximum amount of time (in minutes) for all exchanges. Minimum amount of minutes is 5.

Required for 3-D Secure version 2 for the in-app flow.

Identifies the vendor and version for the 3-D Secure SDK that is integrated in your app, assigned by EMVCo when the 3-D Secure SDK is approved.

Required for 3-D Secure version 2 for the in-app flow.

Universally unique transaction identifier assigned by the 3-D Secure SDK to identify a single transaction.

• true = 3D Secure authentication will be skipped for this transaction. This setting should be used when isRecurring is set to true and recurringPaymentSequenceIndicator is set to recurring.
• false = 3D Secure authentication will not be skipped for this transaction.

Note: This is only possible if your account in our system is setup for 3D Secure authentication and if your configuration in our system allows you to override it per transaction.

Note: Any configured Dynamic 3D rules will be ignored when you submit this property.

Moved from cardPaymentMethodSpecificInput

Enum

(string)

Indicates which party initiated the unscheduled recurring transaction. Allowed values:

• merchantInitiated - Merchant Initiated Transaction.
• cardholderInitiated - Cardholder Initiated Transaction.

Note: this property is not allowed if isRecurring is true.

Required if unscheduledCardOnFileIndicator is 'subsequent'. Otherwise it must not be 'merchantInitiated'.

3-D Secure will not be used when this property is set to cardholderInitiated

• first = This transaction is the first of a series of unscheduled recurring transactions
• subsequent = This transaction is a subsequent transaction in a series of unscheduled recurring transactions

Note: this property is not allowed if isRecurring is true.

Renamed from unscheduledCardOnFileIndicator

The unique scheme transactionId of the initial transaction that was performed with SCA. In case this is unknown a scheme transactionId of an earlier transaction part of the same sequence can be used as a fall-back.
Strongly advised to be submitted for any MerchantInitiated or recurring transaction (a subsequent one).