Affected endpoints
GET https://developers.payrexx.com/reference/retrieve-a-transaction
GET https://developers.payrexx.com/reference/retrieve-transactions
Also affected: the transaction webhook payload, as of webhook version 2026-08-20 (selectable per webhook in the merchant backend under API & Integrations).
What has changed?
Starting with API version 1.17, the transaction object exposes the authentication result of a card payment through the new 3dsecure field. The same field is added to the transaction webhook payload as of webhook version 2026-08-20.
This allows merchant systems (e.g. risk engines) to automatically verify that a payment was 3-D Secure authenticated and whether the liability shift applies, without parsing any human-readable fields.
The change is strictly additive: no existing field names, structures or semantics have changed. Integrations that ignore the new field are unaffected.
The 3dsecure object
| Field | Type | Description |
|---|---|---|
eci | string | The raw ECI (Electronic Commerce Indicator) value as returned by the card network, e.g. 05 (fully authenticated), 06 (attempted) or 07 (not authenticated) for Visa. Mastercard uses 02/01/00 respectively. |
source | string | 3ds when the ECI stems from a 3-D Secure authentication, token when only a network-token (wallet) ECI exists. A token ECI states the assurance level of the tokenisation — no 3-D Secure flow ran for it. |
version | string | null | The 3-D Secure protocol version, e.g. 2.2.0. Only present for source = 3ds, otherwise null. |
flow | string | null | The authentication flow: frictionless or challenge. Only present for source = 3ds, otherwise null. |
3dsecure is null when no ECI is resolvable for the transaction. This is the case for payment methods without card-network authentication (e.g. POS, TWINT, invoice, crypto, Apple Pay, Google Pay) and for transactions processed before the authentication data was collected. Historical transactions are not backfilled.
Note: the payload intentionally carries no cryptogram (CAVV) and no 3-D Secure transaction identifiers — the ECI fully covers the liability-shift verification use case.
Examples
A fully authenticated 3-D Secure payment (challenge flow):
"3dsecure": {
"eci": "05",
"source": "3ds",
"version": "2.2.0",
"flow": "challenge"
}A payment where only a network-token (wallet) ECI exists:
"3dsecure": {
"eci": "06",
"source": "token",
"version": null,
"flow": null
}A payment without resolvable authentication data:
"3dsecure": null