Risk Request

post https://3a878b71-bbcd-4968-9cdb-797642e3d652.mock.pstmn.io/risk

Risk-based authentication requests are sent by VCAS to the partner. The partner receives the request and responds with Success, Failure or Stepup. Note, API requests and responses are for illustration only, check with VCAS reps for more information.

Body Params

Risk Request Object

ProcessorId

string

required

Defaults to 5723ae630063ac1a9c3ab079

Cardinal provided identifier for the partner. 24 characters.

IssuerId

string

required

Defaults to 5723ae630063ac1a9c3ab080

Cardinal provided identifier for the partner. 24 characters.

TransactionId

string

required

Defaults to 00ec043e-40b5-4ce4-95c2-9e83b644f412

VCAS generated transaction reference id. Max. 36 characters. GUID format.

DSTransactionId

string

Defaults to 521fa021-4791-4579-a3e9-76de87c219c0

Directory Server (DS) generated transaction reference id. GUID format.

MerchantChallengeIndicator

string

Indicates whether a challenge is requested from the merchant. Note: Please allow for future values in this field. EMV has reserved up to 99 values for future use.

3RIIndicator

string

Indicates the type of 3RI request for EMV transactions. Note: Please allow for future values in this field. EMV has reserved up to 99 values for future use.

NonPaymentAuthenticationIndicator

string

Defaults to 01

Indicates the type of Non-Payment Authentication.

MessageVersion

string

required

Defaults to 2.2.0

Version of the message based on 3DS spec. Examples - 2.1.0, 2.2.0

RDXMessageVersion

string

Defaults to 2.2.3

Version of the RDX protocol being used. This will be used to enable new features without breaking current integrations. Example: 2.2.2 and 2.2.3

MessageCategory

string

Defaults to 01

Identifies the category of the message for a specific use case; 01=PA, 02=NPA

RiskScore

string

Risk score of the transaction as determined by Cardinal. Max. 2 characters.

RuleOutcome

string

Defaults to Success

If the transaction is configured to evaluate risk rules, this will be the outcome of that evaluation.

ExemptionInfo

object

Object containing information related to EMV exemptions as related to the EEA PSD2 regulations.

MerchantAuthInfo

object

Object containing information related to any Merchant Authentication information on EMV requests.

MerchantInfo

object

required

TransactionInfo

object

required

ExtensionData

object

Responses

Response body

object

ProcessorId

string

required

Defaults to 5723ae630063ac1a9c3ab079

Echoed from Risk Request. 24 characters.

IssuerId

string

required

Defaults to 5723ae630063ac1a9c3ab081

Echoed from Risk Request. 24 characters.

TransactionId

string

required

Defaults to 00ec043e-40b5-4ce4-95c2-9e83b644f412

Echoed from Risk Request. Max. 36 characters.

Status

string

required

Status of Risk Request.

SUCCESS STEPUP FAILURE FAILWITHFEEDBACK ERROR BLOCKED REJECTED

TransStatusReason

string

Provides information on why the Transaction Status field has the specified value. 2 characters.

Language

string

Language to display the instructions and prompt to the cardholder. This value will determine which template is loaded, provided the correct template language is available. If not provided, the language is selected based on issuer configuration and browser preference e.g. en-US. Max. 50 characters.

RiskIndicator

string

If returned, this value will be used in the creation of certain Authentication Values (AV) for EMV 3DS. The value passed must conform to the current AV value the issuer is using. This may also depend on the card brand of the transaction. For example, CAVV and IAV accept different values.
Note: This value will be converted to the Hexadecimal equivalent. Refer to the “VCAS Enhanced Authentication Value Support Guide” for details on supported authentication values.

RiskScore

string

Risk Score or value as determined by the partner or Cardinal Risk Engine. Length - 2 characters.

ExemptionResponse

object

Object containing any information related to the evaluation of the ExemptionInfo on the RiskRequest.

WhitelistStatus

string

Indicates whether the whitelist exemption was accepted. Should be used in conjunction with the RiskResponse.Status. Value can be left null if accepted or if not applicable to transaction.

Y N E P R U

Reason

object

ReasonCode

string

Used by the issuer for informational purposes. Max. 32 characters.

ReasonDescription

string

Used by the issuer for informational purposes. Max. 256 characters.

Error

object

ReferenceNumber

string

System reference number for the error message. Max. 15 characters.

ReasonDescription

string

Used by the issuer for informational purposes. Up to 256 characters.

Description

string

A description of the error. Max. 50 characters.

Message

string

A message that will be displayed to the customer on the error screen. Max. 100 characters.

WhyInfo

object

Object defining dynamic text values that can be shown to the consumer during the challenge flow. These fields will be mapped directly to both browser templates and SDK info fields. Note: this field is also configurable for SDK screens today via our template configuration. If this value is passed on RDX it will override the current configurable value.

Label

string

Label to be displayed to the Cardholder for the "why" information section.

Text

string

Text provided by the issuer to be displayed to the Cardholder to explain why the Cardholder is being asked to perform the authentication task. Note: Carriage return is supported in this data element and is represented by an “\n”.

405

Invalid input

200Successful Risk Response