Card 3DS OTP

Request body for event type CARD, event detail REQUEST_3DS.

When a cardholder gets a 3D Secure challenge, Monit sends the OTP to your OTP callback URL, and you deliver it to the cardholder. This only happens when OTP callback is enabled and the card was created through the API. See Set webhook URL.

{
  "data": {
    "id": "0c4cf036-0e00-0044-f752-4ca55fbb2918",
    "balance": 10000,
    "card_name": "Card A",
    "card_type": "VIRTUAL",
    "cardholder": {
      "id": "0b668087-0800-00f7-fc41-9d8ce8f748c8",
      "full_name": "User Admin"
    },
    "created_at": "2026-05-16 07:34:52",
    "updated_at": "2026-05-16 07:35:57",
    "card_status": "ACTIVE",
    "last_number": "6491",
    "card_network": "MASTERCARD",
    "card_mechanism": "DEBIT",
    "otp": {
      "verification_code": "482913",
      "merchant": "AMAZON.COM",
      "created_at": "2026-05-16 07:40:12"
    }
  },
  "event_id": "0c4cf068-b600-0002-1c1b-c3c083161692",
  "timestamp": "2026-05-16 07:40:13",
  "event_type": "CARD",
  "event_detail": "REQUEST_3DS",
  "is_sandbox": false,
  "organization_id": "0b5a1e02-3c00-0011-8d2e-7a1f3b9c4d10"
}

The card fields are the same as in Card.

Field	Type	Description
otp.verification_code	String	The OTP to deliver, in plain text.
otp.merchant	String	Merchant that requested 3D Secure. Can be `null`.
otp.created_at	String Datetime	When the challenge was created. Time zone UTC

Your response

Return a 2xx code right away, then deliver the OTP.

If Monit does not get a 2xx, it retries right away: 3 attempts in total, 8 seconds timeout each. All attempts have the same event_id, so deliver each event_id only once.

Test event

A test event sent from your Monit dashboard has event detail REQUEST_3DS_TEST, sample card data, and otp.verification_code 000000. Do not deliver it to a cardholder.