# Resolve a 3D Secure hash

Building with an AI agent? Start at https://docs.payme.io/agents.md

- Sandbox: `GET https://sandbox.payme.io/api/sales/{payme_sale_id}/3ds/{hash_3dsecure}`
- Production: `GET https://live.payme.io/api/sales/{payme_sale_id}/3ds/{hash_3dsecure}`

## Credentials

- Header `PayMe-Merchant-Key` (API key)

## Overview

Decodes the `hash_3dsecure` from [Start 3D Secure authentication](/payments/standalone-3d-secure-service/post-initialize-3dsecure-request), or from the challenge page, into the 3DS values to send to your gateway: `eci`, `cavv` and `xid`. Call it from your server: the `PayMe-Merchant-Key` header carries the seller's MPL, which must stay secret. The whole flow: [Standalone 3D Secure: process flow](/payments/standalone-3d-secure-service).

If authentication failed, the result has a non-null `status`, no `cavv`, and `status_code` `1`.

## Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `payme_sale_id` | path | string | yes | Our unique sale ID. |
| `hash_3dsecure` | path | string | yes | The secured hash sent from PayMe (`hash_3dsecure`). |
| `PayMe-Merchant-Key` | header | string | yes | The MPL of the seller. |

## Code samples

### curl

```bash
curl -X GET 'https://sandbox.payme.io/api/sales/<payme_sale_id>/3ds/<hash_3dsecure>' \
  -H 'PayMe-Merchant-Key: <PayMe-Merchant-Key>'
```

### Node.js

```javascript
const response = await fetch("https://sandbox.payme.io/api/sales/<payme_sale_id>/3ds/<hash_3dsecure>", {
  method: "GET",
  headers: {
    "PayMe-Merchant-Key": "<PayMe-Merchant-Key>",
  },
});

console.log(await response.text());
```

### Python

```python
import requests

response = requests.get(
    "https://sandbox.payme.io/api/sales/<payme_sale_id>/3ds/<hash_3dsecure>",
    headers={
        "PayMe-Merchant-Key": "<PayMe-Merchant-Key>",
    },
)

print(response.text)
```

### PHP

```php
<?php

$ch = curl_init('https://sandbox.payme.io/api/sales/<payme_sale_id>/3ds/<hash_3dsecure>');
curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST => 'GET',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'PayMe-Merchant-Key: <PayMe-Merchant-Key>',
    ],
]);

$response = curl_exec($ch);
curl_close($ch);

echo $response;
```

## Responses

### 200 — OK (success)

| Field | Type | Description |
| --- | --- | --- |
| `xid` | string | The XID generated by the credit card issuer. |
| `eci` | string | The ECI generated by the credit card issuer. |
| `cavv` | string | The CAVV generated by the credit card issuer. |
| `version` | string | The 3D Secure version used. |
| `mid` | string | The MID, when there is one. |
| `status` | string | `null` when authentication succeeded. Otherwise the failure status. |
| `payParameters` | object | Payment parameters stored with the authentication, such as `installments`. An empty array (`[]`) when there are none. |
| `status_code` | integer | `0` when `status` is `null`, otherwise `1`. |

```json
{
  "xid": "XXXXXXXXXXXXXXXXXXXXXXXXXXXX",
  "eci": "05",
  "cavv": "XXXXXXXXXXXXXXXXXXXXXXXXXXXX",
  "version": "2.2.0",
  "mid": null,
  "status": null,
  "payParameters": [],
  "status_code": 0
}
```

### 400 — The hash could not be read. Codes: 1, 20. (error)

| Field | Type | Description |
| --- | --- | --- |
| `status_code` | integer | `1` on failure. |
| `status_error_details` | string | What went wrong. |
| `status_additional_info` | string | The field or value concerned; can be `null`. |
| `status_error_code` | integer | PayMe error code. |
| `session` | string | PayMe session ID. |

```json
{
  "status_code": 1,
  "status_error_details": "Validation error",
  "status_additional_info": "eyJpdiI6Ilp...",
  "status_error_code": 20,
  "session": "a1B2c3D4"
}
```

### 401 — The `PayMe-Merchant-Key` header is missing (the body is then only `{"error": "Unauthenticated."}`), or the seller or its partner is unknown or inactive. Codes: 163, 200, 201, 251. (error)

| Field | Type | Description |
| --- | --- | --- |
| `status_code` | integer | `1` on failure. |
| `status_error_details` | string | What went wrong. |
| `status_additional_info` | string | The field or value concerned; can be `null`. |
| `status_error_code` | integer | PayMe error code. |
| `session` | string | PayMe session ID. |

```json
{
  "status_code": 1,
  "status_error_details": "Seller was not found",
  "status_additional_info": "seller_payme_id",
  "status_error_code": 251,
  "session": "a1B2c3D4"
}
```

### 403 — The sale does not belong to this seller, or the hash belongs to another sale. Code: 303. (error)

| Field | Type | Description |
| --- | --- | --- |
| `status_code` | integer | `1` on failure. |
| `status_error_details` | string | What went wrong. |
| `status_additional_info` | string | The field or value concerned; can be `null`. |
| `status_error_code` | integer | PayMe error code. |
| `session` | string | PayMe session ID. |

```json
{
  "status_code": 1,
  "status_error_details": "Could not access sale",
  "status_additional_info": null,
  "status_error_code": 303,
  "session": "a1B2c3D4"
}
```

### 404 — No sale has this ID. Code: 350. (error)

| Field | Type | Description |
| --- | --- | --- |
| `status_code` | integer | `1` on failure. |
| `status_error_details` | string | What went wrong. |
| `status_additional_info` | string | The field or value concerned; can be `null`. |
| `status_error_code` | integer | PayMe error code. |
| `session` | string | PayMe session ID. |

```json
{
  "status_code": 1,
  "status_error_details": "Sale was not found",
  "status_additional_info": "SALEDEMO-SALEDEMO-SALEDEMO-1234567",
  "status_error_code": 350,
  "session": "a1B2c3D4"
}
```