Skip to main content
POST
When a purchase or authorization returns status: "pending_3ds", the cardholder must complete a 3D Secure challenge at the URL provided in actionRequired.url. Once the cardholder finishes the challenge, call POST /payment/resume to continue processing the payment and receive the final outcome.

​
How 3DS resumption works

  1. Your purchase or authorization call returns status: "pending_3ds" with an actionRequired object.
  2. Redirect the cardholder (or open an iframe) to actionRequired.url.
  3. After the challenge completes, the cardholder is redirected back to your site.
  4. You call POST /payment/resume with the sessionId to get the final payment result.
No API key is required for this endpoint. The sessionId itself acts as the credential and is scoped to a single pending payment. Sessions expire 15 minutes after the 3DS challenge is issued — if the session has expired, the original purchase or authorization must be retried.
This endpoint handles pending_3ds only. It does not handle pending_ddc (device data collection). For DDC flows, retry the original purchase or authorization request with threeDsSetup.sessionId set to the DDC session ID.
The response is a full payment response with the final status, refusalCode on decline, and everything else — same shape as purchase/authorization.

​
Resume after a 3DS challenge

Expired session — 400 Bad Request
If you use the Therius JS SDK, you don’t need to call this endpoint manually. Call sdk.handleAction(result.actionRequired) after receiving a pending_3ds response and the SDK handles the redirect, listens for the challenge completion, and resumes the payment automatically. It returns a promise that resolves to the final paymentResponse.

Body

application/json
​
sessionId
string
required

The sessionId from a pending_3ds / pending_action payment response.

Response

200 - application/json

Resumed payment result

​
id
string<uuid>

The Therius payment id. Returned by POST /payment/authorization and POST /payment/purchase; use it as the {id} path segment for capture, refund, cancel and cancel_or_refund.

Example:

"9f8b2c1e-4d5a-6b7c-8d9e-0f1a2b3c4d5e"

​
status
enum<string>

captured - funds settled; authorized - funds reserved, call capture to settle; declined - issuer declined, see refusalCode; pending_3ds - a 3DS challenge is required, see actionRequired; pending_action - an external action (redirect, voucher) is required, see actionRequired; failed - processing error unrelated to the issuer; cancelled - authorization voided; refunded - captured funds returned.

Available options:
captured,
authorized,
declined,
pending_3ds,
pending_action,
failed,
cancelled,
refunded
​
paymentCode
string

Therius receipt ID, for reconciliation, support and Inquiry. NOT the handle for capture/refund/cancel — use id for that.

Example:

"PC-1234567890"

​
orderCode
string

Your orderCode, echoed back.

​
merchantCode
string

Your merchantCode, echoed back.

​
autorizationCode
string

Issuer authorization code on an approved payment. The field name is misspelled on the wire (no h) - this is intentional and stable.

​
paymentMethod
string

Payment method used, e.g. card, pix, ach.

​
connectionCode
string

Code of the gateway connection that processed the payment.

​
connectionName
string

Display name of the gateway connection that processed the payment.

​
amount
object
​
card
object

Card details from the response: masked PAN, brand, type, and the network transaction/reference IDs to cite on future MIT charges.

​
apm
object

Alternative-payment-method details (redirect URL, QR code, barcode) when paymentMethod is an APM.

​
token
object

Present when the card was tokenized (tokenize: true).

​
actionRequired
object

Present when status is pending_3ds or pending_action. Describes what the cardholder must do next — with the Therius JS SDK, pass the whole object to sdk.handleAction().

​
refusalCode
object

Present when status is declined. See the Declined Payments concept page for the full code table and how to react to each recoveryAction.