Validate

POST {your_base_url}/validate

Called during an out-of-band challenge when the ACS needs to know whether the cardholder has responded yet. It is the fallback for the OOB callback: the ACS polls this endpoint when the cardholder clicks Continue and no callback has arrived for the session.

If you implement the callback, this endpoint is still called — a cardholder can always click Continue before your push reaches them.

Request

{
  "ProcessorId": "cake-proc-01",
  "IssuerId": "cake-iss-01",
  "TransactionId": "9f6b6a2e-6f4e-4d0a-9b6e-2f9d6c1a7e10",
  "DSTransactionId": "660e8400-e29b-41d4-a716-446655440000",
  "StepupRequestId": "b2b6c9a4-1d0e-4e3a-8c8b-5a1f2d3c4b5a",
  "StepupType": "OUTOFBAND",
  "StepupCounter": 1,
  "FirstFactorOutcome": "",
  "MessageVersion": "2.2.0",
  "RDXMessageVersion": "2.2.4",
  "CredentialResponse": [
    { "Id": "0b8ce7e2-8388-4b4c-9568-8f8da53c1b09", "Type": "OUTOFBANDOTHER" }
  ]
}

Look up the session by StepupRequestId and report its current state.

Response

{
  "ProcessorId": "cake-proc-01",
  "IssuerId": "cake-iss-01",
  "TransactionId": "9f6b6a2e-6f4e-4d0a-9b6e-2f9d6c1a7e10",
  "StepupRequestId": "b2b6c9a4-1d0e-4e3a-8c8b-5a1f2d3c4b5a",
  "Status": "RETRY"
}

How your response is interpreted

You return	The ACS does	Attempt consumed
SUCCESS or AUTHENTICATED	Finalises the challenge as approved — transStatus Y	—
REJECTED	Counts a failed attempt. On reaching the limit of 3, finalises as transStatus N with challenge cancellation indicator 08. Below the limit, re-renders the waiting page	Yes
RETRY	Re-renders the waiting page and extends the inter-round deadline	No
STEPUP, ERROR, FAILWITHFEEDBACK, any unrecognised status	Same as RETRY — treated as not yet complete	No

Only SUCCESS, AUTHENTICATED, and REJECTED are final. Everything else, including a status the ACS does not recognise, leaves the challenge open.

WARNING

Return SUCCESS or REJECTED only once the cardholder has actually approved or refused. While you are still waiting on them, return RETRY.

Returning SUCCESS early approves a transaction the cardholder never saw. Returning REJECTED early burns one of the three attempts, and three of them end the authentication.

Idempotency

The ACS may call this endpoint several times for one session — once per Continue click. A RETRY costs the cardholder nothing, so a session can be polled many times before any attempt is used.

Every call must be safe to repeat and must report the same state until that state genuinely changes. Do not consume or invalidate the session on read.