docs(cards): document the optional 3DS password on card create

[kphurley7]

Grid already accepts threeDSecurePassword on POST /cards and forwards it to the issuer, but the field was absent from the spec — so it reached no SDK and no documentation, and was discoverable only by being told about it. That is a poor property for a security-relevant field, so this documents it.

What it does

• Adds the optional threeDSecurePassword to CardCreateRequest.
• Regenerates openapi.yaml and mintlify/openapi.yaml.

Documented semantics, matching the current implementation:

• Only accepted for card programs whose issuer supports a static-password 3-D Secure factor (EU cards today). Supplying it for a program that does not is rejected with INVALID_INPUT — the US/Lithic program has no such factor, and silently dropping a caller-supplied secret would be worse than refusing it.
• When omitted, one is generated on the cardholder's behalf.
• Grid does not retain the value. It is forwarded to the issuer and discarded, so it cannot be read back.

The lint exemption

The name trips field-names-camelCase because of the consecutive capitals in "3DS". That spelling is the industry one and matches the issuer's own request field, and Grid already honors it on the wire, so renaming would break a live contract to satisfy a naming rule.

Rather than exclude the whole schema, this adds a spectral overrides block scoped to the single property, alongside the existing TestWebhookResponse carve-out. field-names-camelCase still applies to every other field on CardCreateRequest.

Verification

npm run lint:openapi exits 0. Confirmed the exemption is doing real work rather than masking: spectral reports 0 errors on main, 1 error (field-names-camelCase on this property) with the field added and no override, and 0 errors with the override. The field is present in both generated bundles.

Follow-up

Worth deciding separately whether the handler should keep accepting a caller-supplied password at all, or always generate one. There is no strength validation on the Grid side today — the issuer's validator is the only gate.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

2 Skipped Deployments

Project	Deployment	Actions	Updated (UTC)
grid-flow-builder	Ignored		Jul 31, 2026 11:04pm
grid-wallet-demo	Ignored		Jul 31, 2026 11:04pm

[github-actions]

✱ Stainless preview builds for grid

This PR will update the grid SDKs with the following commit messages.

cli

feat(api): add three-d-secure-password parameter to cards issue method

go

feat(api): add threeDSecurePassword parameter to card creation

kotlin

feat(api): add threeDSecurePassword parameter to card create

openapi

feat(api): add threeDSecurePassword parameter to card creation

php

feat(api): add threeDSecurePassword parameter to cards issue method

python

feat(api): add three_d_secure_password parameter to cards issue method

ruby

feat(api): add three_d_secure_password parameter to card creation

typescript

feat(api): add threeDSecurePassword parameter to cards.issue method

Edit this comment to update them. They will appear in their respective SDK's changelogs.

✅ grid-typescript studio · code · diff

Your SDK build had at least one "note" diagnostic, but this did not represent a regression.
generate ✅ → build ✅ → lint ❗ → test ✅

npm install https://pkg.stainless.com/s/grid-typescript/79bc6dad155a8fb8b467f815632393f4a39cb647/dist.tar.gz

✅ grid-openapi studio · code · diff

Your SDK build had at least one "warning" diagnostic, but this did not represent a regression.
generate ⚠️

✅ grid-ruby studio · code · diff

Your SDK build had at least one "note" diagnostic, but this did not represent a regression.
generate ✅ → build ✅ (prev: build ⏭️) → lint ✅ → test ✅

✅ grid-go studio · code · diff

Your SDK build had at least one "note" diagnostic, but this did not represent a regression.
generate ✅ → build ✅ (prev: build ⏭️) → lint ❗ → test ❗

go get github.com/stainless-sdks/grid-go@5128bd6ca35cadb64a7c0d3a49bcc32a8c0d0d34

✅ grid-kotlin studio · code · diff

Your SDK build had at least one "warning" diagnostic, but this did not represent a regression.
generate ⚠️ → build ✅ (prev: build ⏭️) → lint ✅ (prev: lint ⏭️) → test ❗

⚠️ grid-python studio · code · diff

Your SDK build had a failure in the lint CI job, which is a regression from the base state.
generate ✅ → build ✅ (prev: build ⏭️) → lint ❗ (prev: lint ⏭️) → test ❗

pip install https://pkg.stainless.com/s/grid-python/aabd047411d7e4de8fe0ac8b6bf106f43c261f03/grid-0.0.1-py3-none-any.whl

✅ grid-php studio · code · diff

Your SDK build had at least one "note" diagnostic, but this did not represent a regression.
generate ✅ → lint ✅ → test ✅

✅ grid-cli studio · code · diff

Your SDK build had at least one "warning" diagnostic, but this did not represent a regression.
generate ⚠️ → build ❗ → lint ❗ → test ❗

---

This comment is auto-generated by GitHub Actions and is automatically kept up to date as you push.
If you push custom code to the preview branch, re-run this workflow to update the comment.
Last updated: 2026-07-31 23:10:00 UTC

[greptile-apps]

Greptile Summary

Documents the existing optional 3-D Secure password accepted by card creation.

• Adds threeDSecurePassword to the canonical CardCreateRequest schema.
• Regenerates both committed OpenAPI bundles with the new property.
• Adds a narrowly scoped Spectral naming exemption for the established wire-field spelling.

Confidence Score: 5/5

The PR appears safe to merge, with the source schema, generated bundles, and narrowly scoped lint exemption aligned.

The change documents an existing optional request field consistently across the canonical schema and generated outputs, and no concrete contract, build, or security failure was identified.

Important Files Changed

Filename	Overview
.spectral.yaml	Adds a property-specific exemption for the intentionally nonstandard threeDSecurePassword wire name without weakening naming checks elsewhere.
openapi/components/schemas/cards/CardCreateRequest.yaml	Documents the optional request-only password, its issuer restrictions, generated default, and non-retention semantics.
openapi.yaml	Keeps the generated root bundle synchronized with the canonical card request schema.
mintlify/openapi.yaml	Keeps the generated Mintlify OpenAPI bundle synchronized with the canonical schema and root bundle.

_{Reviews (1): Last reviewed commit: "docs(cards): document the optional 3DS p..." | Re-trigger Greptile}

[mintlify]

Preview deployment for your docs. Learn more about Mintlify Previews.

Project	Status	Preview	Updated (UTC)
Grid	🟢 Ready	View Preview	Aug 1, 2026, 1:07 AM