> For the complete documentation index, see [llms.txt](https://firstoken.gitbook.io/api-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://firstoken.gitbook.io/api-docs/api-reference/risk/payer-authentication-3d-secure/data-only-authentication.md).

# Data-Only Authentication

## Data-Only Authentication

3-D Secure Data Only is a frictionless authentication mode that shares enriched transaction data with the card issuer — without triggering a full authentication challenge. The issuer uses this data to make better authorization decisions on future transactions.

{% hint style="warning" %}
**Data-Only does not provide liability shift.** Fraud liability remains with the merchant, as this is not a full cardholder authentication.
{% endhint %}

**Key characteristics:**

* No challenge presented to the cardholder (fully frictionless)
* Merchant retains fraud liability (no liability shift)
* Issuer gains richer context to improve approval rates
* Supported networks: **Visa** and **Mastercard**

**Why use it?**

* Higher approval rates by sharing behavioral and device data with the issuer
* Zero friction for the cardholder — no interruption at checkout
* Ideal for recurring payments, low-risk transactions, and markets where standard 3DS challenges hurt conversion

***

#### Integration Workflow

Data-Only skips the `return_url`, challenge modal, and Validate step entirely.

<img src="/files/KlkOPfSQTXBoMXEd7Tno" alt="" class="gitbook-drawing">

> There is **no Validate step** in Data-Only mode.

***

#### Changes in the Check Enrollment Request

To activate Data-Only mode, send `"mode": "data_only"` in the `authentication` object. Omit the `return_url`, `token`, and `device_channel` fields that are required in standard 3DS.

```json
"authentication": {
    "reference_id": "de47f34c-ad65-4a09-a36e-4cc375b941d5",
    "mode": "data_only"
}
```

{% hint style="info" %}
`return_url`, `device_channel`, and `token` are **not required** when using `mode: "data_only"`.
{% endhint %}

***

#### Full Request Example

**cURL**

```bash
curl --location 'https://api.firstoken.co/v1/risk/authentication/enroll' \
--header 'Content-Type: application/json' \
--header 'x-api-key: <YOUR_API_KEY>' \
--data-raw '{
    "transaction_info": {
        "type": "check_enroll",
        "reference_code": "123456789"
    },
    "card": {
        "number": "{{token_id : detokenize}}",
        "expiration_date": "{{token_id : detokenize}}"
    },
    "order_info": {
        "amount_details": {
            "total_amount": "1000",
            "currency": "MXN"
        }
    },
    "bill_to": {
        "first_name": "John",
        "last_name": "Doe",
        "country": "US",
        "address_1": "1 Market St",
        "address_2": "Suite 200",
        "city": "san francisco",
        "state": "CA",
        "phone_number": "4158880000",
        "email": "accept@gmsectec.com",
        "postal_code": "94105"
    },
    "buyer_info": {
        "mobile_phone": "4158880000"
    },
    "device_info": {
        "ip_address": "190.123.237.237",
        "http_browser_color_depth": "30",
        "http_browser_java_enabled": false,
        "http_browser_js_enabled": true,
        "http_browser_screen_height": "1117",
        "http_browser_screen_width": "1728",
        "http_browser_time_offset": "240",
        "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36",
        "cookies_accepted": true,
        "http_browser_language": "en-US",
        "http_accept_content": "application/json",
        "fingerprint_session_id": "0_64119f12-666a-4da6-a451-0856b7ghydad",
    },
    "authentication": {
        "reference_id": "de47f34c-ad65-4a09-a36e-4cc375b941d5",
        "mode": "data_only"
    }
}'
```

***

#### Response Examples

{% tabs %}
{% tab title="Visa — Data-Only Successful" %}

```json
{
    "status": "success",
    "message": "Data-only authentication successful",
    "data": {
        "transaction_info": {
            "type": "check_enroll_response",
            "transaction_id": "0001776433283853503688",
            "reference_code": "123456789",
            "request_id": "7764332849426106004805",
            "status": "Authentication_successful",
            "created_at": "2026-04-17T13:41:25Z"
        },
        "card": {
            "bin": "400000",
            "type": "VISA"
        },
        "consumer_auth_info": {
            "authentication_mode": "data_only",
            "eci": "07",
            "eci_raw": "07",
            "token": "AxjxbwSTpOfDhVrDjbVFAU9+yZx4hKojhqBfbhk0ky9GMjmDoAwAxRoP",
            "commerce_indicator": "internet",
            "pares_status": "I",
            "veres_enrolled": "Y",
            "acs_transaction_id": "572cc555-ee48-4594-871d-19ba5515d716",
            "authentication_transaction_id": "2e7JGHvf5gThFiKvgBY1",
            "cavv": "AJkBBkhgQQAAAE4gSEJydQAAAAA=",
            "specificationVersion": "2.2.0",
            "tree_dss_server_transaction_id": "22f5c236-ba59-4f66-9acd-b2d2a27479d3",
            "xid": "AJkBBkhgQQAAAE4gSEJydQAAAAA=",
            "directory_server_transaction_id": "7d5bd69b-b8ce-4f31-879e-b1b8d676ca08",
            "acs_reference_number": "CardinalACS"
        }
    }
}
```

{% endtab %}

{% tab title="Mastercard — Data-Only Successful" %}

```json
{
    "status": "success",
    "message": "Data-only authentication successful",
    "data": {
        "transaction_info": {
            "type": "check_enroll_response",
            "transaction_id": "0001776436453292124778",
            "reference_code": "123456789",
            "request_id": "7764364535306784104806",
            "status": "Authentication_successful",
            "created_at": "2026-04-17T14:34:13Z"
        },
        "card": {
            "bin": "520000",
            "type": "MASTERCARD"
        },
        "consumer_auth_info": {
            "authentication_mode": "data_only",
            "eci_raw": "06",
            "token": "AxjxbwSTpOg0F37BxGFmAk9+yaCKNKojhqBfbhk0ky9GMjmDoBYA7xlD",
            "commerce_indicator": "spa",
            "pares_status": "I",
            "veres_enrolled": "Y",
            "acs_transaction_id": "64303fc6-6997-4950-ac1d-7237d835afae",
            "authentication_transaction_id": "HVKUzWTAfCALmsFwAag1",
            "specificationVersion": "2.2.0",
            "tree_dss_server_transaction_id": "0f63095b-1c3c-493c-8990-8ee41fedd370",
            "ucaf_authentication_data": "AJkBBkhgQQAAAE4gSEJydQAAAAA=",
            "ucaf_collection_indicator": "6",
            "directory_server_transaction_id": "544cd301-33a3-4165-9cda-a41cb831fae1",
            "acs_reference_number": "CardinalACS"
        }
    }
}
```

{% endtab %}
{% endtabs %}

The `authentication_mode: "data_only"` and `pares_status: "I"` fields together confirm the transaction was processed in Data-Only mode for both Visa and Mastercard.

***

#### Response Fields

**transaction\_info**

<table><thead><tr><th width="220">Field</th><th>Description</th></tr></thead><tbody><tr><td><code>type</code></td><td>Always <code>"check_enroll_response"</code></td></tr><tr><td><code>transaction_id</code></td><td>Unique transaction identifier</td></tr><tr><td><code>reference_code</code></td><td>Your original reference code</td></tr><tr><td><code>request_id</code></td><td>Unique request identifier</td></tr><tr><td><code>status</code></td><td><code>"Authentication_successful"</code> — always for Data-Only</td></tr><tr><td><code>created_at</code></td><td>timestamp</td></tr></tbody></table>

**consumer\_auth\_info — Common Fields**

<table><thead><tr><th width="280">Field</th><th>Description</th></tr></thead><tbody><tr><td><code>authentication_mode</code></td><td><code>"data_only"</code> — confirms the mode used</td></tr><tr><td><code>pares_status</code></td><td><code>I</code> — Informational only. Same for Visa and Mastercard.</td></tr><tr><td><code>eci_raw</code></td><td><code>07</code> for Visa · <code>06</code> for Mastercard</td></tr><tr><td><code>commerce_indicator</code></td><td><code>"internet"</code> for Visa · <code>"spa"</code> for Mastercard</td></tr><tr><td><code>veres_enrolled</code></td><td><code>Y</code></td></tr><tr><td><code>token</code></td><td>Authentication token</td></tr><tr><td><code>acs_transaction_id</code></td><td>ACS transaction identifier</td></tr><tr><td><code>authentication_transaction_id</code></td><td>Not used for Validate in Data-Only mode</td></tr><tr><td><code>specificationVersion</code></td><td>3DS version used</td></tr><tr><td><code>tree_dss_server_transaction_id</code></td><td>3DS Server transaction ID</td></tr><tr><td><code>directory_server_transaction_id</code></td><td>Directory Server transaction ID — include in authorization</td></tr><tr><td><code>acs_reference_number</code></td><td>ACS reference identifier</td></tr></tbody></table>

**consumer\_auth\_info — Visa Specific Fields**

<table><thead><tr><th width="280">Field</th><th>Description</th></tr></thead><tbody><tr><td><code>eci</code></td><td><code>07</code> — Data-Only specific code, not an authentication failure</td></tr><tr><td><code>cavv</code></td><td>Cardholder Authentication Verification Value — include in authorization</td></tr><tr><td><code>xid</code></td><td>Transaction identifier — include in authorization</td></tr></tbody></table>

**consumer\_auth\_info — Mastercard Specific Fields**

<table><thead><tr><th width="280">Field</th><th>Description</th></tr></thead><tbody><tr><td><code>ucaf_authentication_data</code></td><td>Universal Cardholder Authentication Field — include in authorization</td></tr><tr><td><code>ucaf_collection_indicator</code></td><td><code>6</code> for Mastercard Data-Only</td></tr></tbody></table>

***

#### Network Behavior

**Visa Data Only**

The authentication request reaches the issuer's ACS. The issuer receives all enriched transaction data and can link it to the authorization message for better risk assessment.

**Expected response values:**

<table><thead><tr><th width="220">Field</th><th>Value</th></tr></thead><tbody><tr><td><code>authentication_mode</code></td><td><code>"data_only"</code></td></tr><tr><td><code>pares_status</code></td><td><code>I</code></td></tr><tr><td><code>eci</code> / <code>eci_raw</code></td><td><code>07</code></td></tr><tr><td><code>commerce_indicator</code></td><td><code>"internet"</code></td></tr><tr><td><code>cavv</code></td><td>Present — include in authorization</td></tr><tr><td><code>xid</code></td><td>Present — include in authorization</td></tr></tbody></table>

{% hint style="warning" %}
ECI `07` in Data-Only mode does **not** indicate a failed authentication. It is the designated code for Visa Data Only transactions. Use `authentication_mode: "data_only"` and `pares_status: "I"` to identify this scenario in your integration.
{% endhint %}

***

**Mastercard Data Only**

Mastercard offers two Data-Only variants — **Data Only** (AReq reaches the issuer) and **Identity Check Insights / IDCI** (Mastercard generates a risk score at the Directory Server level). Both variants use the same `mode: "data_only"` request and produce the same response structure in Firstoken. The distinction is handled internally by Mastercard.

**Expected response values:**

<table><thead><tr><th width="220">Field</th><th>Value</th></tr></thead><tbody><tr><td><code>authentication_mode</code></td><td><code>"data_only"</code></td></tr><tr><td><code>pares_status</code></td><td><code>I</code></td></tr><tr><td><code>eci_raw</code></td><td><code>06</code></td></tr><tr><td><code>commerce_indicator</code></td><td><code>"spa"</code></td></tr><tr><td><code>ucaf_authentication_data</code></td><td>Present — include in authorization</td></tr><tr><td><code>ucaf_collection_indicator</code></td><td><code>6</code></td></tr></tbody></table>

***

#### Standard 3DS vs. Data-Only

<table><thead><tr><th width="240"></th><th width="200">Standard 3DS</th><th>Data-Only</th></tr></thead><tbody><tr><td>Challenge possible</td><td>Yes</td><td>No</td></tr><tr><td>Liability shift</td><td>Yes (if authenticated)</td><td>No</td></tr><tr><td>Validate step needed</td><td>Only if challenge</td><td>Never</td></tr><tr><td><code>return_url</code> required</td><td>Yes</td><td>No</td></tr><tr><td><code>mode</code> value</td><td><code>"S"</code></td><td><code>"data_only"</code></td></tr><tr><td><code>pares_status</code></td><td><code>Y</code>, <code>N</code>, <code>A</code>, <code>C</code>, <code>R</code>, <code>U</code></td><td><code>I</code> (Visa and Mastercard)</td></tr><tr><td><code>eci_raw</code> (Visa)</td><td><code>05</code>/<code>06</code> success · <code>07</code> fail</td><td><code>07</code> (informational)</td></tr><tr><td><code>eci_raw</code> (Mastercard)</td><td><code>01</code>/<code>02</code> success · <code>00</code> fail</td><td><code>06</code></td></tr><tr><td>Authorization fields (Visa)</td><td><code>eci</code>, <code>cavv</code>, <code>xid</code></td><td><code>eci</code>, <code>cavv</code>, <code>xid</code></td></tr><tr><td>Authorization fields (Mastercard)</td><td><code>eci_raw</code>, <code>ucaf_authentication_data</code></td><td><code>eci_raw</code>, <code>ucaf_authentication_data</code>, <code>ucaf_collection_indicator: 6</code></td></tr></tbody></table>

***

#### Next Steps

After a successful Data-Only response, proceed directly to payment authorization using the fields from `consumer_auth_info`.

**For Visa:** include `eci`, `cavv`, `xid`, and `directory_server_transaction_id`.

**For Mastercard:** include `eci_raw`, `ucaf_authentication_data`, `ucaf_collection_indicator`, and `directory_server_transaction_id`.