Ravelin Callbacks API

openapi: 3.0.3
info:
  title: Ravelin Server 3D Secure Callbacks API
  version: '1'
  description: 'Ravelin''s PSP-agnostic, PCI 3DS-validated 3D Secure Server API. Implements EMV 3DS 2.x

    Authentication Request (AReq), Challenge, Result, and Version Lookup operations against

    3ds.live.pci.ravelin.com. Supports both encrypted payment method payloads and unencrypted

    PAN, dynamic exemption routing, and card-scheme-specific authentication values (CAVV, AAV,

    AEVV). Integrates with the Ravelin iOS, Android, and browser SDKs for App-based (APP),

    Browser-based (BRW), and 3RI (3DS Requestor Initiated) channels.


    Endpoint documentation: https://developer.ravelin.com/merchant/api/endpoints/3d-secure/.

    '
  contact:
    name: Ravelin Support
    url: https://support.ravelin.com/
  termsOfService: https://www.ravelin.com/legal/terms-of-service
  license:
    name: Proprietary
servers:
- url: https://3ds.live.pci.ravelin.com
  description: PCI 3DS production endpoint
security:
- secretApiKey: []
tags:
- name: Callbacks
  description: Outbound webhook events delivered by Ravelin.
paths:
  /webhooks/ravelin/order-decisions:
    post:
      tags:
      - Callbacks
      summary: Receive an Order Decision Callback
      operationId: receiveOrderDecision
      description: Delivered when an order is approved, rejected, or left pending by a reviewer in the Ravelin dashboard. Use to update downstream order management state.
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/OrderDecisionEvent'
      responses:
        '200':
          description: Acknowledged.
  /webhooks/ravelin/manual-reviews:
    post:
      tags:
      - Callbacks
      summary: Receive a Manual Review Callback
      operationId: receiveManualReview
      description: Delivered when a manual review case is completed for a customer or event.
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ManualReviewEvent'
      responses:
        '200':
          description: Acknowledged.
  /webhooks/ravelin/refund-decisions:
    post:
      tags:
      - Callbacks
      summary: Receive a Refund Decision Callback
      operationId: receiveRefundDecision
      description: Delivered when a refund request is approved or rejected by a reviewer in the Ravelin dashboard.
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/RefundDecisionEvent'
      responses:
        '200':
          description: Acknowledged.
components:
  schemas:
    Reviewer:
      type: object
      properties:
        name:
          type: string
        email:
          type: string
          format: email
    OrderDecisionEvent:
      type: object
      required:
      - orderId
      - label
      - timestamp
      properties:
        orderId:
          type: string
        label:
          type: string
          enum:
          - APPROVED
          - PENDING
          - REJECTED
        reviewer:
          $ref: '#/components/schemas/Reviewer'
        timestamp:
          type: string
          format: date-time
    RefundDecisionEvent:
      type: object
      required:
      - refundId
      - orderId
      - label
      - timestamp
      properties:
        refundId:
          type: string
        orderId:
          type: string
        label:
          type: string
          enum:
          - APPROVED
          - REJECTED
          - PENDING
        reviewer:
          $ref: '#/components/schemas/Reviewer'
        timestamp:
          type: string
          format: date-time
    ManualReviewEvent:
      type: object
      required:
      - customerId
      - label
      - timestamp
      properties:
        customerId:
          type: string
        orderId:
          type: string
        label:
          type: string
          enum:
          - FRAUDULENT
          - TRUSTED
          - UNKNOWN
        reviewer:
          $ref: '#/components/schemas/Reviewer'
        timestamp:
          type: string
          format: date-time
  securitySchemes:
    secretApiKey:
      type: apiKey
      in: header
      name: Authorization
      description: Secret API key prefixed with `token`.