How AI is applied across API Evangelist and APIs.io. Read my AI disclosure →
API Evangelist API Evangelist
Discovery
Learnings
Guidance
Toolbox
Alignment
API Evangelist LLC

JPMorgan Chase Authentication API

Authentication

JPMorgan Chase Authentication API is one of 65 APIs that JPMorgan Chase publishes on the APIs.io network, described by a machine-readable OpenAPI specification.

Tagged areas include Authentication. The published artifact set on APIs.io includes an OpenAPI specification, API documentation, and an API reference.

This API exposes 3 operations across 2 paths, and defines 90 schemas. It is described by OpenAPI 3.2.0, at version 2.5.1.

Requests are made against 3 base URLs: https://api-ms.payments.jpmorgan.com/api/v2, https://api-ms-test.payments.jpmorgan.com/api/v2, https://api-mock.payments.jpmorgan.com/api/v2.

3 operations 2 paths 90 schemas 1 GET2 POST

Metadata

The identity and technical contract details declared by the specification.

Specification
OpenAPI 3.2.0
API Version
2.5.1
Base URL
https://api.payments.jpmorgan.com/onboarding/v1
Authentication
HTTP Bearer
Resource Areas
1

Authentication & Security 1

JPMorgan Chase Authentication API declares 1 security scheme for authenticating requests. It accepts HTTP bearer tokens (JWT) (BearerAuth). By default, every request must be authenticated.

Paths & Operations 3

Across 2 paths, the API surfaces 3 operations — 1 GET, 2 POST. Each is listed below with its method, path, parameters, and response codes.

Authentication 3

Authentication

POST
/authentications
Prepare a 3DS authentication
V2SuthenticationPost 3 params body → 200400401403412500503504
POST
/authentications/{authentication-id}
Perform a 3DS authentication
V2SuthenticationByIdPost 4 params body → 200400401403412500503504
GET
/authentications/{authentication-id}
Retrieve an authentication request
V2SuthenticationByIdGet 4 params → 200400401403404412500503

Schemas 90

The contract defines 90 schemas that model the data the API accepts and returns. The most detailed are threeDSAccountAdditionalInfo (18 properties), threeDomainSecureCompletion (18 properties), authenticationByIdRequest (14 properties), softMerchant (13 properties). Each schema is shown below with its type and property counts.

middleName
string
Given name between first name and last name/surname.
authenticationMethod
string
Information about how the 3DS Requestor previously authenticated the cardholder.
phone
object
Phone number in ITU-T E.164 format. Country code and phone number (subscriber number) are mandatory values
2 properties 1 required
purchasedItemCount
integer
The number of items in the sale for the payment processing request.
threeDomainSecureExemption
object
Three Domain Secure Closure
3 properties
threeDSRequestorPriorAuthenticationInfo
object
Contains information about how the 3DS Requestor authenticated the cardholder as part of a previous 3DS transaction.
3 properties
threeDSMessageExtension
object
Contains Data necessary to support requirements not otherwise defined in the 3D Secure message are carried in a Message Extension. This field is limited to 81.…
4 properties
paymentToken
object
Token Information for the payment transaction
5 properties
issuerAssignedAuthenticationFraudScore
string
Assigned by the card issuer this specifies the likelihood that an authorization will be fraudulent. The scale ranges from 0 to 99. The higher the score, the mo…
paymentMethodId
string
Identifies a unique occurrence of the type of payment accepted by a level of the hierarchy of the merchant acquiring account.
tokenNumber
string
The token number is a secure surrogate value generated for an account number in a payment transaction. The token is substituted for the card number or primary…
responseStatus
string
Indicates whether API request resulted in success, error, or denial.
tokenServiceResponseMessage
string
Long explanation of response Message received from token service
authenticationResponse
object
Authentication Response Information
13 properties
authenticationValueCalculationMethod
string
Identifies the calculation method used by the issuer to generate the electronic commerce cryptogram for cardholder authentication.
message
string
Long informative message about error
entity
string
The moniker given to the module or program where the error generated.
threeDSChallengeMerchantNotificationUrl
string
A reference to a web resource on the internet specifying its location on a computer network and a mechanism for retrieving. In this context, this is the notifi…
lastName
string
Last name or surname
accountHolderReferenceId
string
Merchant defined identifier for a consumer
cvv
string
Card verification value (CVV/CV2)
threeDomainSecureCompletion
object
Three Domain Secure Closure
18 properties
authenticationPaymentMethodType
object
Authentication Payment Method Type
2 properties
validationMessage
object
Object containing information about transaction validation
3 properties
issuerAssignedAuthenticationExemptionEncoded
string
Identifies the encoded textual value assigned by issuer based on information in the authentication request, so that transactions do not have to go through stro…
merchantCategoryCode
string
MCC or Merchant Category Code. Defaults to MCC configured at the merchant profile level. Some configurations allow multiple MCC's under a single Merchant ID. S…
requestId
string
Merchant identifier for the request. The value must be unique.
firstName
string
That part of an individual's full name considered a personal name or given name and generally positioned before the last name or family name.
authenticationValue
string
3DS Base 64 cryptogram obtained prior to payment request.
threeDSPurchaseInfo
object
Three DS Purchase Info
6 properties 2 required
threeDomainSecureCreation
object
Three Domain Secure Creation
5 properties
authenticationId
string
Unique identifier for the Authentication attempt.
messageType
string
Codifies type of message requested by authentication server for cardholder authentication request initiated by requestor.
threeDomainSecureChallenge
object
Three Domain Secure Challenge
7 properties
electronicCommerceIndicator
string
Describes the Electronic Commerce Indicator used in cardholder authentication on a network token
threeDSPurchaseRisk
object
Contains Risk related information provided by the 3DS Requestor.
10 properties
authenticationStatusReasonText
string
Long explanation of the Authentication Status
code
string
Short informative code about error
authenticationType
string
Indicates the type of cardholder Authentication request requested by the authentication requestor.
tokenProvider
string
The label given to a provider who creates the digital token for cards.
responseMessage
string
Long explanation of response code
authenticationByIdRequest
object
Request information for authentication by Id call
14 properties 3 required
threeDSTransactionId
string
Identifies a unique occurrence of a transaction. In this context, this is Universally unique transaction identifier to identify a single transaction. If the va…
threeDSChallengeType
string
Indicates whether a challenge is requested for this transaction.
authenticationConsumerProfile
object
Consumer Profile information used for authentication purpose.
2 properties 2 required
month
integer
The month of the expiration date
email
string
Optional value for merchants to provide for a transaction
channelType
string
Codifies the method in which the order was initiated. If not provided, defaults to browser value.
messages
object
A list of errors and warnings.
5 properties 2 required
consumerProfileId
string
Identifies a unique occurrence of a consumer maintained in the firm as requested by merchant. Consumer profile contains information relevant to processing tran…
address
object
Address Object
7 properties
threeDSVersion
string
Codifies the version of the Three Domain Secure (3-D Secure or 3DS) software that is used by the merchant. 3DS is a protocol designed to be an additional multi…
authenticationResult
object
Accountholder Authentication
6 properties
recurringAuthorizationExpirationDate
string
Date after which no further authorizations shall be performed. This field is limited to 8 characters, and the accepted format is YYYYMMDD.
challengeAuthenticationMethod
string
Information about how the 3DS Requestor authenticated the cardholder for the challenge request.
threeDSMethodUrl
string
A reference to a web resource on the internet specifying its location on a computer network and a mechanism for retrieving.
threeDSAuthenticationTimestamp
string
Designates the hour, minute and second of the cardholder authentication
threeDSTransactionStatusReasonCode
string
Contains code indicating the reason for the transaction status in threeDSTransactionStatus.
acsTransactionId
string
This data element provides additional information to the ACS to determine the best approach for handling a request. The field is limited to 36 characters conta…
cardTypeName
string
Name of the payment network
responseCode
string
Short explanation for response status
updateTimestamp
string
Designates the hour, minute, and second in a specific day when the record was last modified.
authenticationSupportUrl
string
Fully qualified URL of 3DS Requestor website or customer care site. This field is optional and it is recommended to be configured in the configuration.
amount
integer
Total monetary value of the payment including all taxes and fees. For zero exponent currency codes (i.e. Japanese Yen) a virtual decimal of 2 is not expected
threeDSAccountAdditionalInfo
object
This field contains additional information about the Cardholder’s account provided by the 3DS Requestor.
18 properties
information
object
A list of informational messages
2 properties
threeDSRequestorAuthenticationInfo
object
Information about how the 3DS Requestor authenticated the cardholder before or during the transaction.
6 properties 1 required
challengeAuthenticationType
string
Indicates the category of authentication request the Issuer will use to challenge the Cardholder in a three domain secure authentication process.
authenticationCard
object
card information used for authentication purpose.
9 properties 1 required
tokenServiceResponseCode
string
Short explanation of response Code
accountNumber
string
The card or token number.
expiry
object
Expiration date
2 properties 2 required
merchantPurchaseDescription
string
Description of goods or services sold according to merchant's internal systems.
threeDSAccountType
string
Indicates the type of consumer account is requested for authentication.
consumerAccountPasswordChangeLength
string
Indicates the length of time since the consumer account password was last updated in days.
threeDSDirectoryServerTransactionId
string
Universally unique transaction identifier assigned by the DirectoryServer to identify a single transaction.
threeDSTransactionStatus
string
Indicates whether a transaction qualifies as an authenticated transaction.
consumerInstallmentAuthorizationCount
integer
Indicates the maximum number of authorisations permitted for instalment payments.
authenticationByIdResponse
object
Authentication By Id Response
12 properties
challengeWindowSize
string
Dimensions of the challenge window that has been displayed to the Cardholder. The ACS shall reply with content that is formatted to appropriately render in thi…
issuerAssignedAuthenticationExemption
string
Identifies the coded values assigned by issuer based on information in the authentication request, so that transactions do not have to go through strong custom…
year
integer
The year of the expiration date
threeDSSchemeId
string
The identifier of the scheme for better resolving of the versioning data for the security protocol used on cardholder authentication using 3DS.
authenticationAccount
object
Authentication Account
6 properties 2 required
maskedAccountNumber
string
Identifies a concealed number associated with the card number recognized by various payment systems. This is typically concealed by storing only the first 6 an…
softMerchant
object
Soft merchant information is passed to the card association along with the transaction. This soft merchant information may also be used for cases where smaller…
13 properties
authenticationRequest
object
Authentication Request information
9 properties 2 required
browserInfo
object
Browser Information of the consumer
11 properties
encryptionIntegrityCheck
string
The alphanumeric string generated by voltage to verify the soundness of the encrypted key used by merchant and payment process. The merchant passed this in the…
currency
string
Describes the currency type of the transaction

Specification

The full machine-readable OpenAPI contract behind this narrative.

Source

jp-morgan-chase-authentication-api-openapi.yml Raw ↑

Other APIs JPMorgan Chase publishes across the network.

Notifications API
Accounts API
Recipients API
Webhooks API
Transactions API
Documents API
JPMorgan Chase Account Information API
JPMorgan Chase Account Restrictions API
JPMorgan Chase Account Services API
JPMorgan Chase Account Statements API
JPMorgan Chase Account Transactions API
JPMorgan Chase Account Updates API
Where this information came from

This is an independent, third-party profile of JPMorgan Chase Authentication API, published by API Evangelist. We do not operate, host, resell, or support these APIs, and we are not affiliated with or endorsed by the company unless stated above. Everything here is built from publicly available information — the company's own site, developer portal, documentation, public repositories, and the specifications it publishes for public use. Nothing is obtained by breaching a system, defeating an access control, or using credentials.

The Kin Score and Agent Readiness rating are independently calculated assessments of a company's public API artifacts, scored against a published rubric. They are not certifications, endorsements, security assessments, or audits.

Corrections, re-scores, and removal are free — no partnership or purchase required, and you do not need to justify the request. A removed company is recorded as unrated, never scored zero for having asked. Acknowledgement within one business day; removal within two.

info@apievangelist.com · Read the full data-sourcing policy →
On a security or compliance team? Put security in the subject line and you will get a person, not a form — we will tell you exactly which public URLs this profile was built from.