> ## Documentation Index > Fetch the complete documentation index at: https://developers.portao3.com.br/llms.txt > Use this file to discover all available pages before exploring further. # List 3D Secure challenges > Lists the account's 3D Secure challenges waiting for your answer, newest first. When an online store asks for 3D Secure on a card purchase, the cardholder must confirm it. A challenge can be answered for 5 minutes after it arrives — answer it with the answer-a-3D-Secure-challenge endpoint; after that it is no longer listed. Organizations that don't ask their users to confirm purchases have them answered automatically, and never see them here. You see the challenges you may answer: all of them as an admin of the organization, otherwise those of the wallets you own. The list is not paginated, and it covers both environments. ## OpenAPI ````yaml /api-reference/banking.openapi.json get /realms/{realmId}/organizations/{organizationId}/accounts/{accountId}/threeds openapi: 3.0.3 info: title: Banking version: 1.0.0 description: >- Portão 3 banking API. Every endpoint requires a bearer token in the Authorization header (Authorization: Bearer ) unless its page states otherwise; see the Authentication guide. That requirement is not repeated per endpoint. Generated by tools/openapi from code (routes + security) and the hand-written spec (request/response bodies). Banking attaches a zod validationSchema at the route; request bodies are resolved from it (object + array roots). Responses have no presenter layer, so they stay tier=unknown. Confidence tiers: generated:typed=215 copied:manual=4 unknown=52. servers: - url: https://api.banking.v2.portao3.com.br/ description: production - url: https://api.banking.dev.3pers.com.br/ description: development security: [] tags: - name: Accounts - name: Account Limits - name: Wallets - name: Cards - name: Card Limits - name: Cards 3DS - name: PIX - name: PIX Keys (DICT) - name: PIX Charges - name: PIX Automatic - name: PIX Initiation (Open Finance) - name: PIX Infractions (MED) - name: Boleto - name: Boleto Charges - name: TED - name: Transfers - name: Transactions - name: Cashback - name: Currency Codes - name: Reversals paths: /realms/{realmId}/organizations/{organizationId}/accounts/{accountId}/threeds: get: tags: - Cards 3DS summary: List 3D Secure challenges description: >- Lists the account's 3D Secure challenges waiting for your answer, newest first. operationId: >- getRealmsByRealmIdOrganizationsByOrganizationIdAccountsByAccountIdThreeds parameters: - name: realmId in: path required: true description: |- ID of your realm. Format: `UUID` schema: type: string format: uuid example: f495ff0c-ab54-4f99-8e92-ca8682e4de9b - name: organizationId in: path required: true description: |- ID of the organization the account belongs to. Format: `UUID` schema: type: string format: uuid example: c4bd3f21-dfbd-44e8-8055-68ba15bed410 - name: accountId in: path required: true description: ID of the organization's account (24 hexadecimal characters). schema: type: string pattern: ^[0-9a-fA-F]{24}$ example: 66f2a1c7b4d3e80012c9a0b4 responses: '200': description: Successful response content: application/json: schema: type: array items: type: object properties: _id: type: string description: >- ID of the challenge. Send it as `threedsTransactionId` to answer it. example: 66f2a6d4b4d3e80012c9a101 realmId: type: string description: ID of the realm the card belongs to. example: f495ff0c-ab54-4f99-8e92-ca8682e4de9b format: uuid organizationId: type: string description: ID of the organization the card belongs to. example: c4bd3f21-dfbd-44e8-8055-68ba15bed410 format: uuid accountId: type: string description: ID of the organization's account. example: 66f2a1c7b4d3e80012c9a0b4 walletId: type: string description: ID of the card's wallet. example: 66f2a3d1b4d3e80012c9a0d2 cardId: type: string description: ID of the card used in the purchase. example: 66f2a4b8b4d3e80012c9a0e1 panMasked: type: string description: Masked number of the card used. example: 524674******4821 txnAmount: type: number description: Amount of the purchase, in cents of `txnCurrency`. example: 18990 txnCurrency: type: number description: >- Currency of the purchase, as an ISO 4217 numeric code (`986` is the Brazilian real). example: 986 mcc: type: string description: Merchant category code (MCC) of the merchant. example: '5968' merchantId: type: string description: Identifier of the merchant. example: '000000000473921' merchantName: type: string description: Name of the merchant. example: LOJA EXEMPLO merchantCountry: type: string description: Country of the merchant. example: BRA external: type: object properties: cardId: type: string description: Identifier of the card at the issuer. example: 3f1c9a52-7d4e-4b8a-9e21-6c0d8b7a5f43 threedsTransactionId: type: string description: Identifier of the challenge at the issuer. example: c7e9a1b3-5d2f-4e6a-8b0c-9d1e2f3a4b5c status: type: string enum: - TRANSACTION_AUTHENTICATED - TRANSACTION_DECLINED - INVALID_TRANSACTION - NOT_AUTHORIZED description: >- The issuer's verdict, once the challenge was answered: `TRANSACTION_AUTHENTICATED`, `TRANSACTION_DECLINED`, `INVALID_TRANSACTION` or `NOT_AUTHORIZED`. Absent while it waits for an answer. example: TRANSACTION_DECLINED required: - cardId - threedsTransactionId description: Identifiers of the challenge at the card issuer. environment: type: string enum: - LIVE - TEST description: >- Environment of the card: `LIVE` (production) or `TEST` (sandbox). example: LIVE status: type: string enum: - REQUESTED - AUTHENTICATED - DECLINED - INVALID_BIOMETRIC - ERROR description: >- Status of the challenge. Always `REQUESTED` here — the challenges listed are the ones waiting for an answer. example: REQUESTED answeredBy: type: string description: >- Who answered the challenge: a user ID, or `SYSTEM` when it was answered automatically. Absent while it waits for an answer. example: SYSTEM authenticationTime: type: string description: >- When the challenge was answered, as sent in the answer. Absent while it waits for an answer. example: '2026-11-02T14:31:07Z' createdAt: type: string description: >- When the challenge arrived. You can answer it for 5 minutes after this. example: '2026-11-02T14:30:41.000Z' format: date-time updatedAt: type: string description: When the challenge last changed. example: '2026-11-02T14:30:41.000Z' format: date-time __v: type: number description: Version of the record. example: 0 required: - _id - realmId - organizationId - accountId - walletId - cardId - panMasked - txnAmount - txnCurrency - mcc - merchantId - merchantName - merchantCountry - external - environment - status - createdAt - updatedAt - __v description: >- An online card purchase waiting for the cardholder to confirm it (3D Secure). '422': description: >- `BAD_REQUEST` — A path parameter is not a valid ID; `fields` lists each one. content: application/json: schema: type: object properties: traceId: type: string description: >- Identifier of the request that failed. Quote it when contacting support. example: 1-68ee2a1b-3c4d5e6f7a8b9c0d1e2f3a4b code: type: string enum: - BAD_REQUEST description: >- Stable, machine-readable error code. Branch on this, never on `message`. origin: type: string enum: - BANKING description: Service that produced the error. message: type: string description: >- Human-readable explanation. Its wording may change without notice. fields: type: array description: >- One entry per invalid request field (validation errors only). items: type: object properties: field: type: string description: >- Path of the invalid field, e.g. `label` or `values[0].value`. example: label message: type: string description: Why the field was rejected. example: label is required code: type: string description: >- `_` — e.g. `LABEL_REQUIRED`, `TYPE_ONE_OF`, `VALUES_VALUE_TYPE_ERROR`. example: LABEL_REQUIRED values: type: array items: type: string description: >- The accepted values, when the field is an enumeration. required: - field - message - code required: - traceId - code - origin - message example: traceId: 1-68ee2a1b-3c4d5e6f7a8b9c0d1e2f3a4b code: BAD_REQUEST origin: BANKING message: >- Bad Request: Your request is invalid or incomplete. Please make sure you are requesting with the right fields. fields: - field: organizationId message: Invalid UUID code: ORGANIZATIONID_UUID ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.