# 3DS challenge

Triggered when a customer initiates a push notification for 3DS. The provided information can be used to send a push notification to the customer's mobile app.
* Event type: `cards#3ds-challenge`
* Profile level subscriptions: Not Supported
* Application level subscriptions: Supported

Events may not be delivered in the order they occurred. Use `data.occurred_at` to reconcile the order.
See the [Event ordering guide](/guides/developer/webhooks/event-ordering) for details.
See the [Webhooks guide](/guides/developer/webhooks) for setup instructions, signature verification, and best practices.

Endpoint: POST cards#3ds-challenge

## Header parameters:

  - `X-Signature-SHA256` (string)
    RSA-SHA256 signature of the request body, Base64 encoded. Verify this against the [Wise public key](/guides/developer/webhooks/event-handling#requests) to ensure the request is authentic and has not been tampered with.

  - `X-Delivery-Id` (string)
    Unique identifier for this webhook delivery attempt.

  - `X-Test-Notification` (boolean)
    Present with the value `true` if this is a test notification sent to verify your callback URL during subscription setup.

## Request fields (application/json):

  - `schema_version` (string)
    Version of the event schema. Determined by the `schema_version` on your [webhook subscription](/api-reference/legacy/webhook).
    Enum: "4.0.0"

  - `subscription_id` (string)
    ID of the webhook subscription that triggered this event.
    Example: ec6d37c2-4611-457a-b210-d1a5f4e354c7

  - `event_type` (string)
    Event type identifier
    Example: cards#3ds-challenge

  - `sent_at` (string)
    Timestamp when the event was sent.
    Example: 2024-09-05T06:47:15.123Z

  - `data` (object)

  - `data.resource` (object)

  - `data.resource.client_id` (string)
    Your `api_client_id`
    Example: tw-test-card-issuance

  - `data.resource.card_token` (string)
    Card token
    Example: 3ab81206-d258-4caf-cea5-60067ba82404

  - `data.resource.profile_id` (integer)
    Profile ID
    Example: 29751964

  - `data.resource.type` (string)
    Resource type (always `card`).
    Example: card

  - `data.challenge_expires_after` (integer)
    The number of seconds before the challenge expires.
    Example: 300

  - `data.occurred_at` (string)
    When the challenge is triggered.
    Example: 2024-09-05T06:47:15.789Z

  - `data.challenge_method` (string)
    The challenge method chosen by customer (always `PUSH`).
    Example: PUSH

  - `data.transaction` (object)

  - `data.transaction.reference` (string)
    Transaction reference. You should use this field when notifying us of the challenge result.
    Example: 148990660

  - `data.transaction.channel` (string)
    User agent (usually `browser` or `app`).
    Example: browser

  - `data.transaction.merchant` (object)

  - `data.transaction.merchant.category` (string | null)
    Merchant category code
    Example: null

  - `data.transaction.merchant.country` (string)
    Merchant country. Follows ISO 3166-1 alpha-2 standard.
    Example: AD

  - `data.transaction.merchant.name` (string)
    Merchant name
    Example: Cards API BBT

  - `data.transaction.merchant.url` (string | null)
    Merchant url
    Example: http://intrepid-fav.net

  - `data.transaction.money_value` (object)

  - `data.transaction.money_value.value` (number)
    Transaction amount
    Example: 100

  - `data.transaction.money_value.currency` (string)
    Currency code
    Example: EUR

## Response 200 fields (application/json):

  - `status` (string)
    Example: ok