List 3D Secure challenges
curl --request GET \
--url https://api.banking.v2.portao3.com.br/realms/{realmId}/organizations/{organizationId}/accounts/{accountId}/threedsimport requests
url = "https://api.banking.v2.portao3.com.br/realms/{realmId}/organizations/{organizationId}/accounts/{accountId}/threeds"
response = requests.get(url)
print(response.text)const options = {method: 'GET'};
fetch('https://api.banking.v2.portao3.com.br/realms/{realmId}/organizations/{organizationId}/accounts/{accountId}/threeds', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.banking.v2.portao3.com.br/realms/{realmId}/organizations/{organizationId}/accounts/{accountId}/threeds",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "GET",
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://api.banking.v2.portao3.com.br/realms/{realmId}/organizations/{organizationId}/accounts/{accountId}/threeds"
req, _ := http.NewRequest("GET", url, nil)
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.get("https://api.banking.v2.portao3.com.br/realms/{realmId}/organizations/{organizationId}/accounts/{accountId}/threeds")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.banking.v2.portao3.com.br/realms/{realmId}/organizations/{organizationId}/accounts/{accountId}/threeds")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Get.new(url)
response = http.request(request)
puts response.read_body[
{
"_id": "66f2a6d4b4d3e80012c9a101",
"realmId": "f495ff0c-ab54-4f99-8e92-ca8682e4de9b",
"organizationId": "c4bd3f21-dfbd-44e8-8055-68ba15bed410",
"accountId": "66f2a1c7b4d3e80012c9a0b4",
"walletId": "66f2a3d1b4d3e80012c9a0d2",
"cardId": "66f2a4b8b4d3e80012c9a0e1",
"panMasked": "524674******4821",
"txnAmount": 18990,
"txnCurrency": 986,
"mcc": "5968",
"merchantId": "000000000473921",
"merchantName": "LOJA EXEMPLO",
"merchantCountry": "BRA",
"external": {
"cardId": "3f1c9a52-7d4e-4b8a-9e21-6c0d8b7a5f43",
"threedsTransactionId": "c7e9a1b3-5d2f-4e6a-8b0c-9d1e2f3a4b5c",
"status": "TRANSACTION_DECLINED"
},
"environment": "LIVE",
"status": "REQUESTED",
"createdAt": "2026-11-02T14:30:41.000Z",
"updatedAt": "2026-11-02T14:30:41.000Z",
"__v": 0,
"answeredBy": "SYSTEM",
"authenticationTime": "2026-11-02T14:31:07Z"
}
]{
"traceId": "1-68ee2a1b-3c4d5e6f7a8b9c0d1e2f3a4b",
"code": "BAD_REQUEST",
"origin": "BANKING",
"message": "Bad Request: Your request is invalid or incomplete. Please make sure you are requesting with the right fields.",
"fields": [
{
"field": "organizationId",
"message": "Invalid UUID",
"code": "ORGANIZATIONID_UUID"
}
]
}List 3D Secure challenges
Lists the account’s 3D Secure challenges waiting for your answer, newest first.
GET
/
realms
/
{realmId}
/
organizations
/
{organizationId}
/
accounts
/
{accountId}
/
threeds
List 3D Secure challenges
curl --request GET \
--url https://api.banking.v2.portao3.com.br/realms/{realmId}/organizations/{organizationId}/accounts/{accountId}/threedsimport requests
url = "https://api.banking.v2.portao3.com.br/realms/{realmId}/organizations/{organizationId}/accounts/{accountId}/threeds"
response = requests.get(url)
print(response.text)const options = {method: 'GET'};
fetch('https://api.banking.v2.portao3.com.br/realms/{realmId}/organizations/{organizationId}/accounts/{accountId}/threeds', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.banking.v2.portao3.com.br/realms/{realmId}/organizations/{organizationId}/accounts/{accountId}/threeds",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "GET",
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://api.banking.v2.portao3.com.br/realms/{realmId}/organizations/{organizationId}/accounts/{accountId}/threeds"
req, _ := http.NewRequest("GET", url, nil)
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.get("https://api.banking.v2.portao3.com.br/realms/{realmId}/organizations/{organizationId}/accounts/{accountId}/threeds")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.banking.v2.portao3.com.br/realms/{realmId}/organizations/{organizationId}/accounts/{accountId}/threeds")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Get.new(url)
response = http.request(request)
puts response.read_body[
{
"_id": "66f2a6d4b4d3e80012c9a101",
"realmId": "f495ff0c-ab54-4f99-8e92-ca8682e4de9b",
"organizationId": "c4bd3f21-dfbd-44e8-8055-68ba15bed410",
"accountId": "66f2a1c7b4d3e80012c9a0b4",
"walletId": "66f2a3d1b4d3e80012c9a0d2",
"cardId": "66f2a4b8b4d3e80012c9a0e1",
"panMasked": "524674******4821",
"txnAmount": 18990,
"txnCurrency": 986,
"mcc": "5968",
"merchantId": "000000000473921",
"merchantName": "LOJA EXEMPLO",
"merchantCountry": "BRA",
"external": {
"cardId": "3f1c9a52-7d4e-4b8a-9e21-6c0d8b7a5f43",
"threedsTransactionId": "c7e9a1b3-5d2f-4e6a-8b0c-9d1e2f3a4b5c",
"status": "TRANSACTION_DECLINED"
},
"environment": "LIVE",
"status": "REQUESTED",
"createdAt": "2026-11-02T14:30:41.000Z",
"updatedAt": "2026-11-02T14:30:41.000Z",
"__v": 0,
"answeredBy": "SYSTEM",
"authenticationTime": "2026-11-02T14:31:07Z"
}
]{
"traceId": "1-68ee2a1b-3c4d5e6f7a8b9c0d1e2f3a4b",
"code": "BAD_REQUEST",
"origin": "BANKING",
"message": "Bad Request: Your request is invalid or incomplete. Please make sure you are requesting with the right fields.",
"fields": [
{
"field": "organizationId",
"message": "Invalid UUID",
"code": "ORGANIZATIONID_UUID"
}
]
}When an online store asks for 3D Secure on a card purchase, the cardholder must confirm it. A challenge can be answered for 5 minutes after it arrives — answer it with the answer-a-3D-Secure-challenge endpoint; after that it is no longer listed. Organizations that don’t ask their users to confirm purchases have them answered automatically, and never see them here.
You see the challenges you may answer: all of them as an admin of the organization, otherwise those of the wallets you own. The list is not paginated, and it covers both environments.
Path Parameters
ID of your realm.
Format: UUID
ID of the organization the account belongs to.
Format: UUID
ID of the organization's account (24 hexadecimal characters).
Pattern:
^[0-9a-fA-F]{24}$Response
Successful response
ID of the challenge. Send it as threedsTransactionId to answer it.
Example:
"66f2a6d4b4d3e80012c9a101"
ID of the realm the card belongs to.
Example:
"f495ff0c-ab54-4f99-8e92-ca8682e4de9b"
ID of the organization the card belongs to.
Example:
"c4bd3f21-dfbd-44e8-8055-68ba15bed410"
ID of the organization's account.
Example:
"66f2a1c7b4d3e80012c9a0b4"
ID of the card's wallet.
Example:
"66f2a3d1b4d3e80012c9a0d2"
ID of the card used in the purchase.
Example:
"66f2a4b8b4d3e80012c9a0e1"
Masked number of the card used.
Example:
"524674******4821"
Amount of the purchase, in cents of txnCurrency.
Example:
18990
Currency of the purchase, as an ISO 4217 numeric code (986 is the Brazilian real).
Example:
986
Merchant category code (MCC) of the merchant.
Example:
"5968"
Identifier of the merchant.
Example:
"000000000473921"
Name of the merchant.
Example:
"LOJA EXEMPLO"
Country of the merchant.
Example:
"BRA"
Identifiers of the challenge at the card issuer.
Show child attributes
Show child attributes
Environment of the card: LIVE (production) or TEST (sandbox).
Available options:
LIVE, TEST Example:
"LIVE"
Status of the challenge. Always REQUESTED here — the challenges listed are the ones waiting for an answer.
Available options:
REQUESTED, AUTHENTICATED, DECLINED, INVALID_BIOMETRIC, ERROR Example:
"REQUESTED"
When the challenge arrived. You can answer it for 5 minutes after this.
Example:
"2026-11-02T14:30:41.000Z"
When the challenge last changed.
Example:
"2026-11-02T14:30:41.000Z"
Version of the record.
Example:
0
Who answered the challenge: a user ID, or SYSTEM when it was answered automatically. Absent while it waits for an answer.
Example:
"SYSTEM"
When the challenge was answered, as sent in the answer. Absent while it waits for an answer.
Example:
"2026-11-02T14:31:07Z"