3-D Secure
Cardholder authentication on an online purchase, before the authorization. Almost all of it belongs to the Access Control Server: it decides whether to challenge, picks the method, and verifies the answer.
One case reaches this API. An out-of-band challenge is answered in an application of yours rather than on the merchant's page, so the authentication becomes an object you read and answer while the merchant's checkout waits.
List authentications
Returns a page of out-of-band authentications, newest first.
Retrieve an authentication
Returns a single authentication. `authentication.challenged` already
Approve an authentication
Tells the Access Control Server the cardholder proved who they are, and
Decline an authentication
Tells the Access Control Server the cardholder refused, or that your