Posted to by the issuer ACS at the end of a 3DS challenge. Captures the 3DS2 cres:<base64>… envelope (or 3DS1 PaRes) from the form body, persists it on the verified-card row, runs Ecentric cardsVerify, and renders an HTML page that postMessages the outcome to the iframe parent or popup opener and self-closes when possible. Returns 200 even on application errors so the customer always gets a closeable page; 400 is reserved for malformed callbacks (missing state or cres/PaRes) where there is nothing to postMessage anyway.

Access: Public endpoint.