> ## Documentation Index
> Fetch the complete documentation index at: https://docs.slash.com/llms.txt
> Use this file to discover all available pages before exploring further.

# 3D Secure challenges

> Approve or decline card purchases that ask the cardholder to confirm them.

Some online purchases ask the cardholder to confirm them with 3D Secure before
they go through. Slash can let your legal entity make that decision itself:
each challenge arrives as a
[`three_ds_challenge.requested`](https://docs.slash.com/docs/v2/webhooks/event-types#three_ds_challenge-requested)
webhook, and you approve or decline it through the API. Contact Slash support
to turn this on.

A challenge lives for about five minutes. Decide it before its `expiresAt`; a
challenge left unanswered is declined, and so is the purchase.

The webhook carries everything needed to decide: the card, the merchant, the
amount and the deadline. Its `entityId` is the `challengeId` to pass to the
endpoints below. [`GET /v2/three-ds-challenges/{challengeId}`](https://docs.slash.com/api-reference/three-ds-challenges/retrieve)
returns the same challenge with its current `status`.

```bash theme={null}
curl -X POST "https://api.slash.com/v2/three-ds-challenges/$CHALLENGE_ID/approve" \
  -H "X-API-Key: $SLASH_API_KEY" \
  -H "x-legal-entity: $SLASH_LEGAL_ENTITY_ID"
```

[`POST /v2/three-ds-challenges/{challengeId}/decline`](https://docs.slash.com/api-reference/three-ds-challenges/decline)
rejects the purchase instead. Only a `pending` challenge can be decided:
deciding one that is no longer pending returns
`three_ds_challenge_already_decided`, and deciding it after it expired returns
`three_ds_challenge_expired`.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.