mpgs Transaction: Pay.Tokenize payment process issues - mastercard

Question

I'm integrating MPGS (Mastercard Payment Gateway Services). I want to use token to pay. But when I call the API Transaction "Pay", I get the wrong result. I want to know what went wrong. Thank you very much.
This is my payment process:
Use hosted checkout to complete the payment and save the sessionid of successful payment
Use the sessionid obtained in the first step to get the token and store the token
Reference API： POST /api/rest/version/62/merchant/{merchantId}/token
RequestBody:
{
"session": {
"id": "SESSION0002130457496K8245619M90"
}
Create session and obtain the sessionid and OrderID.
Reference API： Session: Create Checkout Session
Use Transaction: Pay to start payment
Reference API：Transaction: Pay
RequestBody:
{
"apiOperation": "PAY",
"order": {
"amount": 10.55,
"currency": "HKD"
},
"session": {
"id": "SESSION0002249161342J64341132I3"
},
"sourceOfFunds": {
"token": "5123456709720008",
"type": "SCHEME_TOKEN",
"provided": {
"card": {
"expiry": {
"month": "01",
"year": "39"
},
"storedOnFile": "TO_BE_STORED"
}
}
},
"transaction": {
"source": "INTERNET"
},
"agreement": {
"id": "m599944354",
"type": "UNSCHEDULED"
}
}
Response
{
"agreement": {
"id": "m599944354",
"type": "UNSCHEDULED"
},
"gatewayEntryPoint": "WEB_SERVICES_API",
"merchant": "myMerchantId",
"order": {
"amount": 10.55,
"authenticationStatus": "AUTHENTICATION_NOT_IN_EFFECT",
"chargeback": {
"amount": 0,
"currency": "HKD"
},
"creationTime": "2022-05-19T08:08:43.740Z",
"currency": "HKD",
"id": "2022051520752464800620225416016",
"lastUpdatedTime": "2022-05-19T08:08:43.754Z",
"merchantAmount": 10.55,
"merchantCategoryCode": "4812",
"merchantCurrency": "HKD",
"status": "FAILED",
"totalAuthorizedAmount": 0,
"totalCapturedAmount": 0,
"totalDisbursedAmount": 0,
"totalRefundedAmount": 0
},
"response": {
"gatewayCode": "BLOCKED"
},
"result": "FAILURE",
"risk": {
"response": {
"gatewayCode": "REJECTED",
"review": {
"decision": "NOT_REQUIRED"
},
"rule": [
{
"data": "NO_LIABILITY_SHIFT",
"name": "MSO_3D_SECURE",
"recommendation": "REJECT",
"type": "MSO_RULE"
},
{
"data": "512345",
"name": "MSO_BIN_RANGE",
"recommendation": "NO_ACTION",
"type": "MSO_RULE"
}
]
}
},
"sourceOfFunds": {
"provided": {
"card": {
"brand": "MASTERCARD",
"expiry": {
"month": "1",
"year": "39"
},
"fundingMethod": "CREDIT",
"number": "512345xxxxxx0008",
"scheme": "MASTERCARD",
"storedOnFile": "TO_BE_STORED"
}
},
"token": "5123456709720008",
"type": "CARD"
},
"timeOfLastUpdate": "2022-05-19T08:08:43.754Z",
"timeOfRecord": "2022-05-19T08:08:43.754Z",
"transaction": {
"acquirer": {
"id": "Myid",
"merchantId": "myMerchantId"
},
"amount": 10.55,
"authenticationStatus": "AUTHENTICATION_NOT_IN_EFFECT",
"currency": "HKD",
"id": "tran-14",
"source": "INTERNET",
"stan": "0",
"type": "PAYMENT"
},
"version": "62"
}
Problem points:
Is my method of obtaining token correct?
Whether the method of using "Transaction: Pay" is correct, and whether the parameters of request body are missing
Why is the order.authenticationStatus="AUTHENTICATION_NOT_IN_EFFECT" in the response in step 4? What "There is no authentication information associated with this transaction." means?

Answer 1

You need to update CARD Details using SESSION UPDATE and then make a payment using PAY.
Ensure the 3DS scheme is verified before attempting to PAY.

Answer 2

You don't need to provide card expiry details again in the API request body as it is already stored in the token.
Your transaction is getting BLOCKED because of Risk Rejection rule
"NO_LIABILITY_SHIFT"
"rule": [
{
"data": "**NO_LIABILITY_SHIFT**",
"name": "MSO_3D_SECURE",
"recommendation": "**REJECT**",
"type": "MSO_RULE"
}
]
The "NO_LIABILITY_SHIFT" rule is triggered when in the Merchant Admin Portal -> Transaction Filtering -> 3-D Secure Rules ->No Liability Shift -> "Reject" Screenshot and you are trying to perform Pay operation without 3DS authentication as otherwise in case of fraud or chargeback the liability will be on the merchant and acquirer side.
You need to perform EMV 3DS authentication before Pay operation. https://eu-gateway.mastercard.com/api/documentation/integrationGuidelines/supportedFeatures/pickAdditionalFunctionality/authentication/3DS/3DSecureAuthentication.html?locale=en_US