curl --request POST \
--url https://api.banking.v2.portao3.com.br/realms/{realmId}/organizations/{organizationId}/accounts/{accountId}/threeds/submit \
--header 'Content-Type: application/json' \
--data '
{
"threedsTransactionId": "66f2a6d4b4d3e80012c9a101",
"authenticationTime": "2026-11-02T14:31:07Z",
"authenticationResult": "VALID_BIOMETRICS_AND_TRANSACTION"
}
'import requests
url = "https://api.banking.v2.portao3.com.br/realms/{realmId}/organizations/{organizationId}/accounts/{accountId}/threeds/submit"
payload = {
"threedsTransactionId": "66f2a6d4b4d3e80012c9a101",
"authenticationTime": "2026-11-02T14:31:07Z",
"authenticationResult": "VALID_BIOMETRICS_AND_TRANSACTION"
}
headers = {"Content-Type": "application/json"}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {'Content-Type': 'application/json'},
body: JSON.stringify({
threedsTransactionId: '66f2a6d4b4d3e80012c9a101',
authenticationTime: '2026-11-02T14:31:07Z',
authenticationResult: 'VALID_BIOMETRICS_AND_TRANSACTION'
})
};
fetch('https://api.banking.v2.portao3.com.br/realms/{realmId}/organizations/{organizationId}/accounts/{accountId}/threeds/submit', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.banking.v2.portao3.com.br/realms/{realmId}/organizations/{organizationId}/accounts/{accountId}/threeds/submit",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'threedsTransactionId' => '66f2a6d4b4d3e80012c9a101',
'authenticationTime' => '2026-11-02T14:31:07Z',
'authenticationResult' => 'VALID_BIOMETRICS_AND_TRANSACTION'
]),
CURLOPT_HTTPHEADER => [
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.banking.v2.portao3.com.br/realms/{realmId}/organizations/{organizationId}/accounts/{accountId}/threeds/submit"
payload := strings.NewReader("{\n \"threedsTransactionId\": \"66f2a6d4b4d3e80012c9a101\",\n \"authenticationTime\": \"2026-11-02T14:31:07Z\",\n \"authenticationResult\": \"VALID_BIOMETRICS_AND_TRANSACTION\"\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.banking.v2.portao3.com.br/realms/{realmId}/organizations/{organizationId}/accounts/{accountId}/threeds/submit")
.header("Content-Type", "application/json")
.body("{\n \"threedsTransactionId\": \"66f2a6d4b4d3e80012c9a101\",\n \"authenticationTime\": \"2026-11-02T14:31:07Z\",\n \"authenticationResult\": \"VALID_BIOMETRICS_AND_TRANSACTION\"\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.banking.v2.portao3.com.br/realms/{realmId}/organizations/{organizationId}/accounts/{accountId}/threeds/submit")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Content-Type"] = 'application/json'
request.body = "{\n \"threedsTransactionId\": \"66f2a6d4b4d3e80012c9a101\",\n \"authenticationTime\": \"2026-11-02T14:31:07Z\",\n \"authenticationResult\": \"VALID_BIOMETRICS_AND_TRANSACTION\"\n}"
response = http.request(request)
puts response.read_body{
"status": "TRANSACTION_AUTHENTICATED"
}{
"traceId": "1-68ee2a1b-3c4d5e6f7a8b9c0d1e2f3a4b",
"code": "THREE_DS_TRANSACTION_EXPIRED",
"origin": "BANKING",
"message": "3DS transaction has expired"
}{
"traceId": "1-68ee2a1b-3c4d5e6f7a8b9c0d1e2f3a4b",
"code": "THREE_DS_USER_NOT_AUTHORIZED",
"origin": "BANKING",
"message": "User is not authorized to authenticate this transaction"
}{
"traceId": "1-68ee2a1b-3c4d5e6f7a8b9c0d1e2f3a4b",
"code": "THREE_DS_TRANSACTION_NOT_FOUND",
"origin": "BANKING",
"message": "3DS transaction not found"
}{
"traceId": "1-68ee2a1b-3c4d5e6f7a8b9c0d1e2f3a4b",
"code": "THREE_DS_TRANSACTION_ALREADY_PROCESSED",
"origin": "BANKING",
"message": "3DS transaction has already been processed"
}{
"traceId": "1-68ee2a1b-3c4d5e6f7a8b9c0d1e2f3a4b",
"code": "BAD_REQUEST",
"origin": "BANKING",
"message": "Bad Request: Your request is invalid or incomplete. Please make sure you are requesting with the right fields.",
"fields": [
{
"field": "threedsTransactionId",
"message": "Invalid input: expected string, received undefined",
"code": "THREEDSTRANSACTIONID_REQUIRED"
}
]
}{
"traceId": "1-68ee2a1b-3c4d5e6f7a8b9c0d1e2f3a4b",
"code": "BANKING_PROVIDER_UNAVAILABLE",
"origin": "BANKING",
"message": "Banking provider temporarily unavailable, please retry"
}{
"traceId": "1-68ee2a1b-3c4d5e6f7a8b9c0d1e2f3a4b",
"code": "BANKING_PROVIDER_UNAVAILABLE",
"origin": "BANKING",
"message": "Banking provider temporarily unavailable, please retry"
}{
"traceId": "1-68ee2a1b-3c4d5e6f7a8b9c0d1e2f3a4b",
"code": "BANKING_PROVIDER_UNAVAILABLE",
"origin": "BANKING",
"message": "Banking provider temporarily unavailable, please retry"
}{
"traceId": "1-68ee2a1b-3c4d5e6f7a8b9c0d1e2f3a4b",
"code": "BANKING_PROVIDER_UNAVAILABLE",
"origin": "BANKING",
"message": "Banking provider did not respond in time, please retry"
}Answer a 3D Secure challenge
Answers a 3D Secure challenge with the cardholder’s decision.
curl --request POST \
--url https://api.banking.v2.portao3.com.br/realms/{realmId}/organizations/{organizationId}/accounts/{accountId}/threeds/submit \
--header 'Content-Type: application/json' \
--data '
{
"threedsTransactionId": "66f2a6d4b4d3e80012c9a101",
"authenticationTime": "2026-11-02T14:31:07Z",
"authenticationResult": "VALID_BIOMETRICS_AND_TRANSACTION"
}
'import requests
url = "https://api.banking.v2.portao3.com.br/realms/{realmId}/organizations/{organizationId}/accounts/{accountId}/threeds/submit"
payload = {
"threedsTransactionId": "66f2a6d4b4d3e80012c9a101",
"authenticationTime": "2026-11-02T14:31:07Z",
"authenticationResult": "VALID_BIOMETRICS_AND_TRANSACTION"
}
headers = {"Content-Type": "application/json"}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {'Content-Type': 'application/json'},
body: JSON.stringify({
threedsTransactionId: '66f2a6d4b4d3e80012c9a101',
authenticationTime: '2026-11-02T14:31:07Z',
authenticationResult: 'VALID_BIOMETRICS_AND_TRANSACTION'
})
};
fetch('https://api.banking.v2.portao3.com.br/realms/{realmId}/organizations/{organizationId}/accounts/{accountId}/threeds/submit', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.banking.v2.portao3.com.br/realms/{realmId}/organizations/{organizationId}/accounts/{accountId}/threeds/submit",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'threedsTransactionId' => '66f2a6d4b4d3e80012c9a101',
'authenticationTime' => '2026-11-02T14:31:07Z',
'authenticationResult' => 'VALID_BIOMETRICS_AND_TRANSACTION'
]),
CURLOPT_HTTPHEADER => [
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.banking.v2.portao3.com.br/realms/{realmId}/organizations/{organizationId}/accounts/{accountId}/threeds/submit"
payload := strings.NewReader("{\n \"threedsTransactionId\": \"66f2a6d4b4d3e80012c9a101\",\n \"authenticationTime\": \"2026-11-02T14:31:07Z\",\n \"authenticationResult\": \"VALID_BIOMETRICS_AND_TRANSACTION\"\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.banking.v2.portao3.com.br/realms/{realmId}/organizations/{organizationId}/accounts/{accountId}/threeds/submit")
.header("Content-Type", "application/json")
.body("{\n \"threedsTransactionId\": \"66f2a6d4b4d3e80012c9a101\",\n \"authenticationTime\": \"2026-11-02T14:31:07Z\",\n \"authenticationResult\": \"VALID_BIOMETRICS_AND_TRANSACTION\"\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.banking.v2.portao3.com.br/realms/{realmId}/organizations/{organizationId}/accounts/{accountId}/threeds/submit")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Content-Type"] = 'application/json'
request.body = "{\n \"threedsTransactionId\": \"66f2a6d4b4d3e80012c9a101\",\n \"authenticationTime\": \"2026-11-02T14:31:07Z\",\n \"authenticationResult\": \"VALID_BIOMETRICS_AND_TRANSACTION\"\n}"
response = http.request(request)
puts response.read_body{
"status": "TRANSACTION_AUTHENTICATED"
}{
"traceId": "1-68ee2a1b-3c4d5e6f7a8b9c0d1e2f3a4b",
"code": "THREE_DS_TRANSACTION_EXPIRED",
"origin": "BANKING",
"message": "3DS transaction has expired"
}{
"traceId": "1-68ee2a1b-3c4d5e6f7a8b9c0d1e2f3a4b",
"code": "THREE_DS_USER_NOT_AUTHORIZED",
"origin": "BANKING",
"message": "User is not authorized to authenticate this transaction"
}{
"traceId": "1-68ee2a1b-3c4d5e6f7a8b9c0d1e2f3a4b",
"code": "THREE_DS_TRANSACTION_NOT_FOUND",
"origin": "BANKING",
"message": "3DS transaction not found"
}{
"traceId": "1-68ee2a1b-3c4d5e6f7a8b9c0d1e2f3a4b",
"code": "THREE_DS_TRANSACTION_ALREADY_PROCESSED",
"origin": "BANKING",
"message": "3DS transaction has already been processed"
}{
"traceId": "1-68ee2a1b-3c4d5e6f7a8b9c0d1e2f3a4b",
"code": "BAD_REQUEST",
"origin": "BANKING",
"message": "Bad Request: Your request is invalid or incomplete. Please make sure you are requesting with the right fields.",
"fields": [
{
"field": "threedsTransactionId",
"message": "Invalid input: expected string, received undefined",
"code": "THREEDSTRANSACTIONID_REQUIRED"
}
]
}{
"traceId": "1-68ee2a1b-3c4d5e6f7a8b9c0d1e2f3a4b",
"code": "BANKING_PROVIDER_UNAVAILABLE",
"origin": "BANKING",
"message": "Banking provider temporarily unavailable, please retry"
}{
"traceId": "1-68ee2a1b-3c4d5e6f7a8b9c0d1e2f3a4b",
"code": "BANKING_PROVIDER_UNAVAILABLE",
"origin": "BANKING",
"message": "Banking provider temporarily unavailable, please retry"
}{
"traceId": "1-68ee2a1b-3c4d5e6f7a8b9c0d1e2f3a4b",
"code": "BANKING_PROVIDER_UNAVAILABLE",
"origin": "BANKING",
"message": "Banking provider temporarily unavailable, please retry"
}{
"traceId": "1-68ee2a1b-3c4d5e6f7a8b9c0d1e2f3a4b",
"code": "BANKING_PROVIDER_UNAVAILABLE",
"origin": "BANKING",
"message": "Banking provider did not respond in time, please retry"
}_id as threedsTransactionId, when the cardholder answered and what they answered. The card issuer then approves or declines the purchase, and status tells you which. A challenge can be answered only once, within 5 minutes of arriving — unless the issuer doesn’t accept the answer (INVALID_TRANSACTION, NOT_AUTHORIZED), which keeps it pending.
Admins of the organization can answer any challenge of the account; other users only those of the wallets they own.Path Parameters
ID of your realm.
Format: UUID
ID of the organization the account belongs to.
Format: UUID
ID of the organization's account (24 hexadecimal characters).
^[0-9a-fA-F]{24}$Body
ID of the challenge you answer — the _id of a challenge returned by the list-3D-Secure-challenges endpoint.
^[0-9a-fA-F]{24}$"66f2a6d4b4d3e80012c9a101"
When the cardholder answered, as an ISO 8601 date-time (UTC or with an offset).
^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z|([+-](?:[01]\d|2[0-3]):[0-5]\d)))$"2026-11-02T14:31:07Z"
The cardholder's answer: VALID_BIOMETRICS_AND_TRANSACTION (verified, and confirms the purchase), NOT_VALID_BIOMETRICS (the cardholder couldn't be verified) or TRANSACTION_DONT_RECOGNIZED (the cardholder doesn't recognize the purchase).
VALID_BIOMETRICS_AND_TRANSACTION, NOT_VALID_BIOMETRICS, TRANSACTION_DONT_RECOGNIZED "VALID_BIOMETRICS_AND_TRANSACTION"
Response
Successful response
The card issuer's verdict on an answered challenge.
TRANSACTION_AUTHENTICATED (the purchase is approved), TRANSACTION_DECLINED (it is declined), INVALID_TRANSACTION or NOT_AUTHORIZED (the answer wasn't accepted — the challenge stays pending and you can answer it again while it is valid).
TRANSACTION_AUTHENTICATED, TRANSACTION_DECLINED, INVALID_TRANSACTION, NOT_AUTHORIZED "TRANSACTION_AUTHENTICATED"