Finalize 3DS Challenge
POST
/v1/payments/{id}/3ds-callbackOptionalComplete a 3DS challenge. The hosted checkout posts the ACS pares + the correlationId returned from the card charge. Idempotent — a duplicate submit returns the winner's row byte-for-byte.
Authentication
Signature Pattern
HMAC-SHA256(secretKey, "{timestamp}\nPOST\n/v1/payments/{id}/3ds-callback\n{sha256(body)}")| Header | Value | Description |
|---|---|---|
X-Api-Key | pk_live_a1b2c3d4e5f6g7h8 | Merchant public API key |
X-Signature | {hmac_sha256_hex} | Hex HMAC-SHA256 request signature (see below) |
X-Timestamp | 2026-04-13T10:00:00Z | ISO 8601 UTC request time, validated within ±5 min |
Request Parameters
| Name | Type | Required | Description |
|---|---|---|---|
pares | string | Required | Signed ACS assertion from the 3DS challenge |
correlationId | string | Required | Value round-tripped from the card charge response |
Request Example
JSONRequest Body
{
"pares": "eyJjaGFsbGVuZ2VJZCI6Ii4uLiJ9.9a8b7c6d",
"correlationId": "c0rr-3f1c-9a2e-6b4d"
}Response Parameters
| Field | Type | Example |
|---|---|---|
id | string | "pay_1a2b3c4d5e6f" |
status | string | "captured" |
amount | integer | 15000 |
currency | string | "TRY" |
commission | integer | 449 |
netAmount | integer | 14551 |
authCode | string | "123456" |
completedAt | string | "2026-04-13T10:00:05Z" |
Response Example
JSONResponse
{
"id": "pay_1a2b3c4d5e6f",
"status": "captured",
"amount": 15000,
"currency": "TRY",
"commission": 449,
"netAmount": 14551,
"authCode": "123456",
"completedAt": "2026-04-13T10:00:05Z"
}Status Codes
200Success
201Created
400Bad Request
401Unauthorized
404Not Found
429Rate Limited
Try itMock
POSThttps://api.pay.sandbox.kvell.group