3DS Card Lookup

post

https://api.sb.moneris.io/three-d-secure/card-lookups

Recent Requests

Time	Status	User Agent
Retrieving recent requests…

Loading…

Body Params

The card_lookup request verifies the applicability of 3DS on the card and returns the 3DS version supported by the card. It also returns the 3DS Method URL and 3DS Method Data for submitting a device fingerprinting POST to issuer’s ACS.

idempotencyKey

string

required

length between 1 and 36

A Unique Identifier that is required for handling idempotent requests.

Note: Moneris encourages the use of UUID Version 4 in APIs as an idempotency key."

orderId

string | null

^[a-zA-Z0-9-_]+$

Indicates the merchant-defined transaction identifer or order ID. Identifiers are unique for every Purchase, Pre-Authorization and Independent Refund transaction

Note: No two transactions of these types may have the same order ID. Field only accepts alphanumerical characters, dashes and underscores.

paymentMethod

required

Payment method details

threeDSecureNotificationUrl

string

required

length between 1 and 256

URL-encoded, fully qualified callback URL that receives the response or error message.

Note: Request with URL that is not URL-encoded will be rejected for security reasons.

Example (URL-encoded): https%3A%2F%2Fmerchant.example.com%2Fcallback%3ForderId%3D123

Headers

Api-Version

string

required

Defaults to 2025-08-14

The endpoint's API Version.

Must be provided through the headers section.

X-Correlation-Id

string

Correlates a series of requests within the same flow.

Note: This ID is generated by Moneris with every request or response, if it doesn't exist.
Merchants are to echo back the value with every request that is part of the call flow."

X-Merchant-Id

string

required

length between 13 and 13

Thirteen character identification code.

Note: This code is provided by Moneris and is required to identify the Merchant executing the transaction."

string

enum

Defaults to application/json

Generated from available response content types

Allowed:

Responses

2013D-Secure Card Lookup created successfully

400Bad Request.

401Not authorized. The user does not have a valid API Key or Access Token.

403Forbidden. The user does not have permission to access the requested resource.

409Request could not be completed due to a conflict with resource state or existing idempotency key.

422The API cannot complete the requested action due to semantic or business validation errors.

429Too Many Requests

500Unexpected error.

503Service Temporarily Unavailable