3DS API Testing Manual.
This manual has been created to assist you in testing the 3DS API in your development environment. With this manual, you will be able to understand how the API works and how to use it to perform tests on your payment system.
By following the instructions in this manual, you will be able to ensure that your integration with the 3DS API is reliable and secure for your users.
Attention:
The tests will be conducted in a CARAT staging environment, which provides a more controlled and secure environment for conducting the tests.
Table with different cards for testing:
| ID | BRAND | CARD NUMBER |
|---|---|---|
1 | Visa | 4551820000009478 |
2 | Mastercard | 5555555555555555 |
41 | Elo | 5091490000009011 |
3 | Amex | 3766001349171000 |
Table with values in cents that can be used to simulate different statuses in 3DS:
| AMOUNT | STATUS | DESCRIPTION |
|---|---|---|
10000 | AUY | Successful Authentication |
10004 | AUC | Challenge Required, following the "challenge" flow |
10001 | AUN | Not Authenticated/Account Not Verified; Transaction Denied |
Examples#
Below, we will provide examples of tests in the Frictionless and Challenge flows, as well as a test with a card number that is not within the range of cards supported for 3DS 2.0 authentication. All tests will be performed using the cURL tool.
Frictionless [Creating the Transaction]#
Request Type: POST
URL: https://mpi-homolog.softwareexpress.com.br/3ds-server/v2/authentication
Headers:
- Content-Type:
application/json - merchant_id: {Please request your store code from the support team.}
- merchant_key: {Please request your merchant key from the support team.}
Mastercard Card: 5555555555555555
Request:
Response:
Learn more about this service.
Frictionless [Performing the authentication.]#
Request Type: PUT
In the above URL, the 3DS Server transaction ID was filled with the value fb26dfb6-2486-442a-8887-d1241c940a61, which was obtained during the transaction creation.
Headers:
- Content-Type:
application/json - merchant_id: {Please request your store code from the support team.}
- merchant_key: {Please request your merchant key from the support team.}
Request:
Response:
Learn more about this service.
Card not supported for 3DS 2.0 authentication. [Creating the transaction]#
Request Type: POST
URL: https://mpi-homolog.softwareexpress.com.br/3ds-server/v2/authentication
Headers:
- Content-Type:
application/json - merchant_id: {Please request your store code from the support team.}
- merchant_key: {Please request your merchant key from the support team.}
Mastercard Card: 5251743209931344
Request:
Response:
Learn more about this service.
Challenge [Creating the transaction.]#
Request Type: POST
URL: https://mpi-homolog.softwareexpress.com.br/3ds-server/v2/authentication
Headers:
- Content-Type:
application/json - merchant_id: {Please request your store code from the support team.}
- merchant_key: {Please request your merchant key from the support team.}
Mastercard Card: 5555555555555555
Request:
Response:
Learn more about this service.
Challenge [Performing the authentication.]#
Request Type: PUT
In the above URL, the 3DS Server transaction ID was filled with the value fb26dfb6-2486-442a-8887-d1241c940a61, which was obtained during the transaction creation.
Attention
To simulate the Challenge flow, it is necessary to pass the value
10014in thepurchase.amountfield of the transaction, as indicated in the table presented at the beginning of this manual.
Headers:
- Content-Type:
application/json - merchant_id: {Please request your store code from the support team.}
- merchant_key: {Please request your merchant key from the support team.}
Request:
Response:
Challenge#
Request Type: POST
URL: https://mpi-homolog.softwareexpress.com.br/e-sitef-homologacao/acs/challenge.se?brandId=2
In the above URL, you need to insert the value of brandId, which in our test is defined as 2, as we are using a Mastercard card.
Headers:
- Content-Type:
application/x-www-form-urlencoded
Sending the CReq.
To obtain the challenge, the parameter creq must be sent, which contains the CReq encoded in Base64 URL-safe encoding.
CReq Json
In this JSON, we include the same transaction ID from the 3DS Server three_ds_server.trans_id and the transaction ID from the ACS acs.trans_id, which were obtained in the previous two steps.
CReq Base64:
Learn more about this service.
After encoding the CReq JSON in Base64, we create the following request.
Request:
Response:
The response will return a script from our simulator that simulates an ACS (Issuer) challenge. Normally, this script would be added to the application in an iframe, but for testing purposes, let's save it as an HTML file and open it in the browser. After that, select the desired challenge status - let's choose Status Y, indicating success - and click the submit button.
HTML file opened in the browser:
Attention
This is just a CARAT simulator to simulate the challenge.
Script response to simulate the challenge as represented in the image above.:
Attention
This script is returned to the response of the CReq submission.
Query the transaction status after the challenge.
Request Type: GET
In the URL above, the ID of the 3DS Server transaction was filled with the value fb26dfb6-2486-442a-8887-d1241c940a61, which was obtained during the transaction creation.
Headers:
- Content-Type:
application/json - merchant_id: {Please request your store code from the support team.}
- merchant_key: {Please request your merchant key from the support team.}
Request:
Response:
E para saber mais sobre essas nomenclaturas (Bin, Software Express, Carat, e-Sitef) Saiba mais