Endpoints you implement

The Cake ACS calls three endpoints on your platform during an authentication. This page covers what they have in common; each endpoint's own page covers its specific fields.

POST {your_base_url}/step_up
POST {your_base_url}/initiate_action
POST {your_base_url}/validate

All three take Content-Type: application/json and expect a JSON response with HTTP 200.

Common fields

Every request carries these. Echo all four back in your response — the ACS uses them to match your reply to the in-flight authentication.

Field	Type	Description
ProcessorId	string	Identifies the calling ACS. Agreed during onboarding
IssuerId	string	Identifies you. Agreed during onboarding
TransactionId	string	Unique per authentication, stable across all three endpoints
StepupRequestId	string	Unique per challenge session, stable across resends

Two version fields are also sent on every request:

Field	Example	Description
MessageVersion	2.2.0	The EMV 3-D Secure version the merchant is using
RDXMessageVersion	2.2.4	The version of this contract

Status values

Your response's Status field is what the ACS acts on. The exact meaning differs per endpoint — see each page — but the shape is shared:

Status	Meaning
SUCCESS	The operation completed
RETRY	Not finished yet; ask again later. Only meaningful on /validate
REJECTED	The cardholder is refused
FAILWITHFEEDBACK	Refused, with a reason to show
BLOCKED	Refused; the card or account is blocked
FAILURE	Refused for another reason
ERROR	Your platform could not process the request

Timeouts

The ACS applies a request timeout to each call. If your endpoint does not answer in time, the ACS treats it exactly like an ERROR response.

WARNING

There is no retry. The authentication is decided on the first answer — or the first timeout. Return a fast ERROR rather than holding a connection open; a held connection consumes the cardholder's remaining time in the challenge window.

Authentication

Requests from the ACS to your platform are not signed at the application layer. They are protected at the network layer by the source IP ranges exchanged during onboarding. Traffic in the other direction — your OOB callback — is signed; see Security.

Cardholder data

The /step_up request contains the full PAN, because your platform needs it to identify the cardholder. It is the only endpoint that carries one. Treat that request as in scope for PCI DSS: do not log the body, and do not persist the PAN outside your existing cardholder data environment.