Authorization with Exemption Request

As we explain in our Exemptions to SCA article, you can flag an exemption in the authorization message without first performing Strong Customer Authentication (SCA) for certain low-risk scenarios. After assessing the request’s validity, the Issuer will either apply the exemption or request authentication.

Merchants should first consult with their acquirer before managing their own exemption messaging. To use exemption flags in authorizations contact our support team.

The following table provides the request syntax for the Exemption Status field. An O in the Type column indicates that this field is optional.

Sample request

Here, we request an exemption for TRANSACTION_RISK_ANALYSIS in the authorization message.

For more information on exemptions in an authorization message, see Exemptions to SCA.

If the Issuer does not approve the exemption request and requires authentication before the payment can be processed further, you’ll receive a response code of 111. This is known as a soft decline. When your application or website receives this code, it should proceed with the standard 3D Secure 2 authentication steps (see Authentication in the API Reference).

The following table provides the response syntax for the Result field.

Sample response

Here, the Issuer responds with a soft decline.

<response timestamp="20180731090859">
  <merchantid>MerchantId</merchantid>
  <account>internet</account>
  <orderid>N6qsk4kYRZihmPrTXWYS6g</orderid>
  <result>111</result>
  <cvnresult>U</cvnresult>
  <avspostcoderesponse>U</avspostcoderesponse>
  <avsaddressresponse>U</avsaddressresponse>
  <message>SCA Required</message>
  <pasref>14610544313177922</pasref>
  <timetaken>1</timetaken>
  <authtimetaken>0</authtimetaken>
  <cardissuer>
    <bank>AIB BANK</bank>
    <country>IRELAND</country>
    <countrycode>IE</countrycode>
    <region>EUR</region>
  </cardissuer>
  <sha1hash>8f4dfe7460ce91f78a144a2ed4f334617feaaab4</sha1hash>
</response>