Resume After Challenge

POST https://cc.firmly.work/api/v2/payment/domains/{domain}/complete-order/resume

​​ The challenge envelope

When the issuer requires step-up verification (3-D Secure), the order is not failed — the 409 body is:

{
  "type": "payment_challenge_required",
  "challenge": {
    "challenge_id": "pi_3RXkQ2...",
    "method": "redirect",
    "url": "https://merchant.example/challenge?payment_id=...",
    "display": "popup",
    "expires_at": "2026-06-08T18:03:44.164Z"
  }
}

expires_at is optional — it is present only when the PSP reports a timeout, and some adapters never set it. Do not key a client-side timeout on it; fall back to your own when it is absent.

Send the shopper to challenge.url as display indicates. Adapters currently emit popup or full_redirect; new_tab is reserved and not emitted today. Never in an iframe: these pages forbid framing, and the post-challenge navigation breaks. Open it from a user gesture, or popup blockers intervene.

​​ Authentication

Same as Complete Order — a device access token, or server-to-server credentials.

​​ Path Parameters

• domain (string, required) — The merchant’s domain. Must match the original call.

​​ Request Body

Empty. No card data is sent: the payment is already held against the cart session, and all resume state lives server-side.

​​ Response

Call this once, when the shopper finishes.

• 200 — the order is placed. Same shape as Complete Order.
• 409 — the same envelope unchanged, meaning verification is still outstanding. Re-prompt and resume again on the next completion signal, until expires_at.

​​ Error Responses

{ "code": 422, "error": "PaymentChallengeExpired", "description": "The payment verification window has expired. Please place the order again." }

{ "code": 422, "error": "PaymentChallengeRequired", "description": "This payment requires additional bank verification (3D Secure) that is not supported in this checkout. Please use a different card." }

{ "code": 404, "error": "CartNotFound", "description": "Cart was not found." }

Authentication and domain errors match Complete Order.