Start 3DS verification for a tokenised card

post

https://megsapp-nova-stg.85.group/api/v1/purchases/cards/{cardToken}/verify

Initiates Ecentric 3DS lookup. Returns either a frictionless verified result, a challenge with redirectUrl (caller pops the URL in a popup so the ACS can POST PARes back to /purchases/cards/3ds/term-callback), or a failure with reason. The appUserId field is the customer's app_user.uuid; the controller resolves it to the internal BIGINT before persistence.

Access: Auth methods: JWT bearer. Requires permissions: purchase:admin.

Recent Requests

Time	Status	User Agent
Retrieving recent requests…

Loading…

Path Params

cardToken

string

required

Tokenised card identifier

Body Params

securityCode

string

required

length ≤ 4

CVV/CVC printed on the card. Threaded through to the AVS Payment (cardsVerify) — Ecentric requires CVV on the verification leg of AVS even when the issuer ran a frictionless 3DS lookup. Never persisted, never logged.

appUserId

string

required

App user UUID — app_user.uuid of the customer this verified card belongs to. Nova exposes UUIDs externally; the controller resolves this to the internal BIGINT before persistence. Note: this sandbox/admin route runs as purchase:admin testing on behalf of users. When Prism (production customer flow) is wired, that route will source the user from the JWT instead.

ecentricUserId

string

required

length ≤ 64

Ecentric userId previously used when generating the hosted add-card form for this customer. Required for token lookup.

screenHeight

number

0 to 32767

Cardholder browser screen height in pixels. EMVCo 3DS2 risk-engine input. Must be supplied by the partner client (window.screen.height).

screenWidth

number

0 to 32767

Cardholder browser screen width in pixels. EMVCo 3DS2 risk-engine input. Must be supplied by the partner client (window.screen.width).

browserIp

string

Cardholder browser IPv4/IPv6 address. EMVCo 3DS2 risk-engine input. When omitted, the controller derives it from the request socket (X-Forwarded-For / req.ip).

threeDSCompInd

string

enum

EMVCo 3DS2 challenge-completion indicator. Y = completed, N = not completed, U = unavailable. Defaults to Y (completed).

Allowed:

debugTrace

boolean

Super Admin sandbox diagnostics only. The admin verify endpoint includes a sanitized per-step Ecentric/Nexus trace by default for Super Admin callers; set false to suppress it. Ignored for non-Super Admin callers.

verificationStrategy

string

enum

Defaults to avs

Super Admin purchase sandbox only. Defaults to avs, which runs Nexus cards3dsLookup followed by cardsVerify. r2_payment uses Nexus cards3dsPaymentLookup with amount R2.00, then runs a normal R2.00 paymentsCit and stores that payment transaction as the follow-on purchase anchor.

Allowed:

Responses

400

Invalid request body

401

Unauthorized

403

Forbidden

404

App user not found

Language

Credentials

Bearer

JWT

URL

Loading…

Response

Click Try It! to start a request and see the response here! Or choose an example:

application/json

200