# Initiate an integrated authentication request

Authenticates an integrated 3D Secure transaction request. In integrated mode, PXP processes the transaction in conjunction with the 3D Secure authentication data. This ensures that the transaction is authenticated securely, leveraging the full authentication data collected during the pre-initiation phase. The request payload must include comprehensive details about the transaction, card information, merchant information, and additional contextual data necessary for the 3D Secure authentication flow.

Endpoint: PUT /threedsecure/integrated/authentications/{authenticationId}/browser-authentication
Version: 1.0.0

## Path parameters:

  - `authenticationId` (string, required)

## Request fields (application/json):

  - `fingerprintNotification` (string)
    The URL for notifying the fingerprinting result. Base64 of `{"threeDSMethodNotificationURL":"method url value","threeDSServerTransID":"transaction id value"}`.

  - `merchantCountryNumericCode` (string, required)
    The three-digit country code of the merchant, following ISO 3166-1 numeric standard.
    Example: 840

  - `merchantLegalName` (string, required)
    The legal name of the merchant.
    Example: ACME Ltd

  - `challengeWindowSize` (integer, required)
    The desired size of the challenge window displayed to the cardholder during authentication.
Possible values:
- `1`: 250x400
- `2`: 390x400
- `3`: 500x600
- `4`: 600x400
- `5`: FullScreen

  - `requestorChallengeIndicator` (string, required)
    Indicator of whether a challenge is requested for this transaction (Integrated authentication).
Possible values:
- `01`: NoPreference
- `02`: NoChallengeRequested
- `03`: ChallengeRequested3dsRequestorPreference
- `04`: ChallengeRequestedMandate
- `05`: NoChallengeRequestedTRAPerformed
- `10`: NoChallengeRequestedLowValueExemption
    Enum: "01", "02", "03", "04", "05", "10"

  - `challengeCallbackUrl` (string, required)
    The fully qualified URL of the system that receives the CRes message or error message. The CRes message is posted by the ACS through the cardholder's browser at the end of the challenge and receipt of the RRes message.

  - `recurring` (object)
    Details related to recurring transactions for 3D Secure authentication.

  - `recurring.expirationDate` (string)
    The expiration date of the recurring transaction plan.
    Example: 2024-12-31T23:59:59Z

  - `recurring.frequencyInDays` (integer)
    The frequency of the recurring transactions in days.
    Example: 30

  - `billingAddress` (object)
    Details of the address used in browser-based authentication.

  - `billingAddress.city` (string)
    The city of the address.
    Example: San Francisco

  - `billingAddress.countryNumericCode` (string)
    The numeric code representing the country of the address, following ISO 3166-1 numeric standard.
    Example: 840

  - `billingAddress.line1` (string)
    The first line of the address, typically representing the street address or PO box number.
    Example: 123 Market St

  - `billingAddress.line2` (string)
    The second line of the address, if applicable, for additional address information.
    Example: Apt 456

  - `billingAddress.line3` (string)
    The third line of the address, if applicable, for additional address information.
    Example: Building B

  - `billingAddress.postalCode` (string)
    The postal or ZIP code of the address, which can vary in length based on the country.
    Example: 94105

  - `billingAddress.stateCode` (string)
    The state or province of the address.
    Example: CA

  - `browserData` (object, required)
    Information about the browser used in the authentication process.

  - `browserData.acceptHeader` (string, required)
    The Accept HTTP header field from the browser.
    Example: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8

  - `browserData.colorDepth` (integer, required)
    The colour depth of the browser's screen, measured in bits per pixel.
    Example: 24

  - `browserData.ipAddress` (string)
    The IP address of the device running the browser, if available.
    Example: 192.168.1.1

  - `browserData.javaEnabled` (boolean, required)
    Whether the browser has Java enabled.
    Example: true

  - `browserData.javaScriptEnabled` (boolean, required)
    Whether the browser has JavaScript enabled.
    Example: true

  - `browserData.language` (string, required)
    The IETF BCP 47 language tag.
    Example: en-US

  - `browserData.screenHeight` (integer, required)
    The height of the browser's screen in pixels.
    Example: 1080

  - `browserData.screenWidth` (integer, required)
    The width of the browser's screen in pixels.
    Example: 1920

  - `browserData.timeZoneOffsetInMinutes` (integer, required)
    The difference, in minutes, between UTC and the local time of the browser.
    Example: -420

  - `browserData.userAgent` (string, required)
    The User-Agent string of the browser.
    Example: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36

  - `shopper` (object, required)
    Details about the shopper involved in the authentication.

  - `shopper.email` (string)
    The email address of the shopper.
    Example: johndoe@example.com

  - `shopper.homePhoneNumber` (string)
    The home phone number of the shopper.
    Example: +1234567890

  - `shopper.mobilePhoneNumber` (string)
    The mobile phone number of the shopper.
    Example: +0987654321

  - `shopper.workPhoneNumber` (string)
    The work phone number of the shopper.
    Example: +1123456789

## Response 200 fields (application/json):

  - `uniqueId` (string)

  - `state` (string)
    The current state of the authentication request. `PendingClientData` isn't returned during initiation.
    Enum: "AuthenticationSuccessful", "AuthenticationFailed", "AuthenticationRejected", "AuthenticationError", "PendingCustomerChallenge"

  - `transactionStatus` (string)
    The status of the transaction.
Possible values include:
- `Y`: AuthenticationVerificationSuccessful
- `N`: NotAuthenticated_NotVerified
- `U`: AuthenticationCouldNotBePerformed
- `A`: AttemptsProcessingPerformed
- `C`: ChallengeRequired
- `R`: AuthenticationRejected
- `I`: InformationalOnly
    Enum: "Y", "N", "U", "A", "C", "R", "I"

  - `electronicCommerceIndicator` (string)
    The indicator used to signify the level of security used in the authentication, often used in electronic commerce transactions.
    Example: 05

  - `exemptionGranted` (boolean)
    Whether an exemption from Strong Customer Authentication (SCA) was granted.

  - `exemptionGrantedByIssuer` (string)
    Specifies if the exemption was granted by the issuer.
Possible values:
- `05`: TransactionRiskAnalysisExemption
- `08`: TrustListExemption
- `10`: LowValueExemption
- `11`: SecureCorporatePaymentsExemption
- `79`: NoExemptionApplied

  - `acsUrl` (string)
    The URL of the Access Control Server (ACS) where the cardholder is redirected for challenge authentication.
    Example: https://acs.example.com/challenge

  - `challengeData` (string)
    Data required for the challenge authentication process, typically a base64 encoded string.
    Example: eyJjaGFsbGVuZ2VEYXRhIjoiQUJDIn0=

  - `stateData` (object)
    Details about the state. This is returned only when the `transactionStatus` is different from `Y` or `A`.

  - `stateData.code` (string)
    The state code.
Possible values:
- `01`
- `02`
- `03`
- `04`
- `05`
- `06`
- `07`
- `08`
- `09`
- `10`
- `11`
- `12`
- `13`
- `14`
- `15`
- `16`
- `17`
- `18`
- `19`
- `20`
- `21`
- `22`
- `23`
- `24`
- `25`
- `26`
- `27`
- `28`
- `29`
- `30`
    Enum: "01", "02", "03", "04", "05", "06", "07", "08", "09", "10", "11", "12", "13", "14", "15", "16", "17", "18", "19", "20", "21", "22", "23", "24", "25", "26", "27", "28", "29", "30"

  - `stateData.reason` (string)
    The state reason.
Possible values:
- Card authentication failed
- Unknown device
- Unsupported device
- Exceeds authentication frequency limit
- Expired card
- Invalid card number
- Invalid transaction
- No card record
- Security failure
- Stolen card
- Suspected fraud
- Transaction not permitted to Cardholder
- Cardholder not enrolled in service
- Transaction timed out at the ACS
- Low confidence
- Medium confidence
- High confidence
- Very high confidence
- Exceeds ACS maximum challenges
- Non-Payment transaction not supported
- 3RI transaction not supported
- ACS technical issue
- Decoupled Authentication required by ACS but not requested by 3DS Requestor
- 3DS Requestor Decoupled Max Expiry Time exceeded
- Decoupled Authentication was provided insufficient time to authenticate Cardholder. ACS will not make attempt
- Authentication attempted but not performed by the Cardholder
- Preferred Authentication Method not supported
- Validation of content security policy failed
- Authentication attempted but not completed by the Cardholder. Fall back to Decoupled Authentication
- Authentication completed successfully but additional authentication of the Cardholder required. Reinitiate as Decoupled Authentication
    Example: Card authentication failure

  - `cardholderInfo` (string)
    The text provided by the ACS/issuer to the cardholder during a transaction.

## Response 400 fields (application/json):

  - `errorCode` (string)

  - `errorReason` (string)

  - `correlationId` (string)

  - `details` (array)

## Response 401 fields (application/json):

  - `errorCode` (string)

  - `errorReason` (string)

  - `correlationId` (string)

  - `details` (array)

## Response 403 fields (application/json):

  - `errorCode` (string)

  - `errorReason` (string)

  - `correlationId` (string)

  - `details` (array)

## Response 404 fields (application/json):

  - `errorCode` (string)

  - `errorReason` (string)

  - `correlationId` (string)

  - `details` (array)

## Response 500 fields (application/json):

  - `errorCode` (string)

  - `errorReason` (string)

  - `correlationId` (string)

  - `details` (array)