> ## Documentation Index
> Fetch the complete documentation index at: https://docs.fastpaybrasil.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Submit 3DS authentication

> Submits a 3DS authentication after optional fingerprinting.
Pass `fingerprintingResult` if you received it from the iframe postMessage.
Returns updated status and may include `challengeUrl` if a challenge is required.

**Authentication:** Uses the merchant's public/publishable key (`pk_...`).



## OpenAPI

````yaml /api-reference/openapi.yaml post /v1/three-ds/submit
openapi: 3.0.0
info:
  title: FastPay API
  version: 1.0.0
  description: >-
    API for creating and managing payment charges.


    ## Authentication


    This API uses **Basic Authentication** for direct API access, such as
    creating charges.

    Use your API key as the username and an empty string as password.

    The header should be formatted as:


    `Authorization: Basic {base64(apiKey:)}`.


    For example:


    ```

    Authorization: Basic YWxleG91dG9uOiIi

    ```


    ## Webhooks


    FastPay sends webhooks to notify your application about charge status
    changes in real-time.

    Webhooks are sent via HTTP POST requests to your configured webhook
    endpoints.


    ### Webhook Events


    The following webhook events are available for charges:


    - `charge.created` - Sent when a new charge is created

    - `charge.pending` - Sent when a charge is pending payment

    - `charge.paid` - Sent when a charge is successfully paid

    - `charge.updated` - Sent when a charge is updated


    ### Webhook Payload Structure


    All webhook payloads follow this structure:


    ```json

    {
      "id": "webhook_event_id",
      "event": "charge.paid",
      "data": {
        // Complete charge object
      }
    }

    ```


    ### Webhook Delivery


    - Webhooks are sent via HTTP POST requests

    - Content-Type: `application/json`

    - Retry logic is implemented for failed deliveries

    - Webhook events are stored in the database for audit purposes

    - Delivery logs are maintained for debugging and monitoring


    ### Webhook Security


    - Webhooks are sent to pre-configured endpoints

    - Endpoints can be enabled/disabled per merchant

    - Event filtering is supported (only receive specific events)

    - Failed deliveries are retried with exponential backoff
servers:
  - url: https://api-global.fastpaybrasil.com
    description: Produção e Sandbox (diferenciados pela API key)
security: []
paths:
  /v1/three-ds/submit:
    post:
      tags:
        - 3D Secure
      summary: Submit 3DS authentication
      description: >-
        Submits a 3DS authentication after optional fingerprinting.

        Pass `fingerprintingResult` if you received it from the iframe
        postMessage.

        Returns updated status and may include `challengeUrl` if a challenge is
        required.


        **Authentication:** Uses the merchant's public/publishable key
        (`pk_...`).
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ThreeDSSubmitRequest'
      responses:
        '200':
          description: Authentication submitted successfully
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ThreeDSSubmitResponse'
        '404':
          description: No 3DS provider configured or authentication not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      security:
        - basic: []
components:
  schemas:
    ThreeDSSubmitRequest:
      type: object
      required:
        - authenticationId
      properties:
        authenticationId:
          type: string
          description: 3DS Authentication ID from POST /v1/three-ds/authenticate
          example: tdsa_1QmCRMJM0r9zBvr4OVmMRa6X
        fingerprintingResult:
          type: string
          description: |-
            Base64-encoded fingerprinting result obtained from the hidden iframe
            postMessage. Omit if no fingerprinting step occurred.
          example: VGhpcyBpcyBhIHNhbXBsZSciAzRFMgTWV0aG9kIFJlc3VsdA==
    ThreeDSSubmitResponse:
      type: object
      properties:
        authenticationId:
          type: string
          description: 3DS Authentication ID
          example: tdsa_1QmCRMJM0r9zBvr4OVmMRa6X
        status:
          type: string
          enum:
            - requires_challenge
            - succeeded
            - failed
            - error
            - processing
          description: Updated authentication status after submit
          example: requires_challenge
        challengeUrl:
          type: string
          nullable: true
          description: Challenge URL — render in iframe when status is `requires_challenge`
          example: https://hooks.stripe.com/three_d_secure/challenge/acct_xxx/tdsa_xxx
        outcome:
          type: string
          nullable: true
          description: Authentication outcome (only present in terminal states)
          example: authenticated
    ErrorResponse:
      type: object
      properties:
        statusCode:
          type: integer
          description: HTTP status code
          example: 422
        message:
          type: string
          description: Descriptive error message
          example: SubMerchant is not active
        error:
          type: string
          description: Error type
          example: Unprocessable Entity
  securitySchemes:
    basic:
      type: http
      scheme: basic
      description: |-
        HTTP Basic authentication. Use your secret key as the
        username and an empty string as password. The API key
        should be base64 encoded in the format 'username:' when
        sending the Authorization header.

````