Check SCA requirements via API

Learn how to check whether Strong Customer Authentication (SCA) is required for a transaction.

Introduction

Strong Customer Authentication (SCA) is a PSD2 requirement for many online payments in Europe. It helps reduce fraud by requiring stronger customer verification. For card payments, 3D Secure (3DS) is a primary method for meeting SCA requirements.

Use the SCA Checker API before authorisation to determine whether a transaction requires SCA and select the appropriate action: apply 3DS, request an exemption where applicable, or proceed without SCA. This lets you avoid unnecessary authentication while reducing the risk of issuer soft declines for transactions that require SCA. It may also help reduce processing fees.

The SCA Checker evaluates the transaction context submitted in the request, including the card number, transaction amount and currency, whether the transaction is a Mail Order/Telephone Order (MOTO) or merchant-initiated, the recurring type, and any requested exemption. Based on this information, the response reflects one of three outcomes: SCA is required, SCA is not required, or SCA is in scope but an exemption may be possible.

For the complete details, see the API Reference.

Prerequisites

Before you start, verify that you have:

API credentials for HTTP Basic Authentication. You can find them in the merchant account creation email from emerchantpay support, or in the Gateway Console by going to Configuration > Merchants > Select the merchant > Terminals > Select the terminal > copy the details from the API Access panel.
The Terminal token required to specify the terminal configuration used for the SCA check.
The correct environment URL:
- Staging – https://staging.gate.emerchantpay.net
- Production – https://gate.emerchantpay.net

Check SCA requirements

POST /v1/sca/checker/:terminal_token

Staging – https://staging.gate.emerchantpay.net/v1/sca/checker/:terminal_token
Production – https://gate.emerchantpay.net/v1/sca/checker/:terminal_token

Use this endpoint to check whether Strong Customer Authentication is required for a transaction by sending the transaction context, such as the card number, amount, and currency, and optionally, the MOTO flag, Merchant Initiated Transaction (MIT) flag, recurring type, and requested exemption. The response indicates whether SCA is required and what exemption may be applicable, if any.

The SCA Checker is called per terminal. Replace :terminal_token with the terminal token for the terminal configuration that would be used to process the transaction.

The API has the following characteristics:

HTTP method – POST
Authentication method – HTTP Basic Authentication
Request format – JSON
Response format – JSON
Behaviour – Synchronous REST
Content type – application/json

Request example

The following example checks whether SCA is required for an initial recurring payment for EUR 25.00. The request also includes the card number, MOTO and MIT indicators, currency, and a check for a low-value exemption.

curl -u USERNAME:PASSWORD \
  https://staging.gate.emerchantpay.net/v1/sca/checker/:terminal_token \
  -X POST \
  -H “Content-Type: application/json” \
  -d ‘{
    “card_number”: “4200000000000000”,
    “moto”: false,
    “mit”: false,
    “recurring_type”: “initial”,
    “transaction_amount”: 2500,
    “transaction_currency”: “EUR”,
    “transaction_exemption”: “low_value”
  }’

Request parameters

Use the following parameters to provide the transaction context for the SCA check:

PARAMETER	REQUIRED	FORMAT	DESCRIPTION
`card_number`	Yes	String, up to 16 characters	Full card number or first 6 digits.
`transaction_amount`	Yes	Number	Transaction amount in minor currency units.
`transaction_currency`	Yes	String, 3 characters	Transaction currency in ISO 4217 format.
`moto`	No	Boolean	Indicates whether the transaction is a mail order / telephone order transaction. If omitted, the default is `false`.
`mit`	No	Boolean	Indicates whether the transaction is merchant-initiated. For example, this may apply to an unscheduled credential-on-file transaction initiated by the merchant based on a previous customer agreement. If omitted, the default is `false`.
`recurring_type`	No	String	Specifies the recurring type of the transaction. Supported values are `initial` and `subsequent`. Use `initial` for the first transaction in a recurring series. Initial recurring transactions may require SCA when they are in scope. Use `subsequent` for later transactions in an existing recurring series.
`transaction_exemption`	No	String, up to 30 characters	Checks if a specific SCA exemption may be applicable to the transaction. See the supported exemptions section for more details.

Supported exemptions

SCA exemptions allow eligible transactions to be processed without SCA in specific scenarios. When you submit a transaction_exemption, the SCA Checker evaluates whether the selected exemption may apply to the transaction. An exemption can reduce authentication friction, but it does not guarantee that the issuer will approve the transaction without SCA. The issuer may still request authentication or decline the transaction based on its own risk checks and regulatory obligations.

low_value – A low-value exemption may be available for eligible low-value transactions of EUR 30 or less. Issuers may still require SCA if applicable transaction counters or cumulative amount thresholds are exceeded.
low_risk – A low-risk exemption may be available where transaction risk analysis supports the exemption. The issuer may still require authentication even when an exemption is requested.
trusted_merchant – A trusted merchant exemption may be available when the cardholder has added the merchant to a trusted beneficiaries list held by the issuer. This exemption is controlled by the issuer and depends on the cardholder’s prior consent.
corporate_payment – A secure corporate payment exemption may be available for eligible transactions made through dedicated corporate payment processes or instruments. This can apply where the payment is initiated in a controlled business environment and meets the relevant scheme and regulatory requirements. This exemption is controlled by the issuer.
auth_network_outage – An authentication network outage exemption may be available when authentication cannot be completed because of an outage affecting the authentication network. This exemption is intended for exceptional cases where the authentication service is unavailable.

Card brand support

Not all SCA exemption values are supported by every card brand. Check the card brand before requesting an exemption.

EXEMPTION	VISA	MASTERCARD / INTL MAESTRO	DINERS / DISCOVER
`low_value`	Supported	Supported	Supported
`low_risk`	Supported	Supported	Supported
`trusted_merchant`	Supported	Supported	Not supported
`corporate_payment`	Supported	Supported	Supported
`delegated_authentication`	Not supported	Not supported	Not supported
`auth_network_outage`	Supported	Supported	Not supported

Response example

The following response shows that SCA is not required because the issuer is outside the EEA, and no exemption has been returned.

[
  {
    “sca_required”: “no”,
    “sca_result_reason”: “Issuer out of the EEA”,
    “exemption”: null
  }
]

Response parameters

The response includes the following parameters:

PARAMETER	TYPE	DESCRIPTION
`sca_required`	String	Indicates whether SCA is required. Use the value to decide how to route the transaction. Possible values are `yes`, `possible_exemption`, or `no`. See the result handling section for more details.
`sca_result_reason`	String	Reason for the returned SCA requirement result.
`exemption`	String or null	Detected SCA exemption, if applicable. See the supported exemptions section for more details.

Result handling

Use the sca_required value in the API response to decide how to route the transaction before authorisation. The result indicates whether the transaction should go through 3D Secure authentication, whether an exemption may be requested, or whether SCA is not required based on the submitted transaction context.

SCA_REQUIRED VALUE	RECOMMENDED ACTION
`yes`	SCA is required. Route the transaction through 3D Secure authentication.
`possible_exemption`	SCA is in scope, but an exemption may be requested. Continue with the relevant exemption flag, but prepare for the issuer to require authentication.
`no`	SCA is not required. Continue without SCA, unless your own risk or compliance rules require additional checks.

Some transactions may be outside the scope of SCA because of their nature.

Note: The SCA Checker helps you determine whether SCA is required or whether an exemption may apply. It does not guarantee that the issuer will approve a transaction without authentication. Issuers may still request SCA or decline a transaction based on their own rules.

For post-processing exemption outcomes, see SCA Reason for Not Honoring Exemption Values and SCA Exemption Result Values in the API Reference. These values relate to payment transaction responses and are not part of the SCA Checker response.

Was this page helpful?