diff --git a/.spectral.yaml b/.spectral.yaml
index 6975a563e..2b8b9055b 100644
--- a/.spectral.yaml
+++ b/.spectral.yaml
@@ -12,7 +12,8 @@ rules:
   # Naming Conventions (README: Naming Conventions)
   # ============================================================
 
-  # Fields must be camelCase (excludes TestWebhookResponse which mirrors external format)
+  # Fields must be camelCase (excludes TestWebhookResponse which mirrors
+  # external format; see the overrides block for per-property exemptions)
   field-names-camelCase:
     description: Schema property names must be camelCase
     message: "Property '{{property}}' must be camelCase. See openapi/README.md#field-naming"
@@ -179,3 +180,13 @@ rules:
       function: pattern
       functionOptions:
         match: "^((\\/([a-z0-9]+(-[a-z0-9]+)*|\\{[a-zA-Z0-9]+\\}))+|\\/sandbox\\/cards\\/\\{id\\}\\/simulate\\/(balance_inquiry|credit_authorization|financial_authorization|financial_credit_authorization|authorization_advice|credit_authorization_advice|return_reversal))$"
+
+# Per-property exemptions from the naming rules above.
+overrides:
+  # "3DS" is the industry spelling of the 3-D Secure factor, and this field
+  # mirrors the issuer's own request field name. Renaming it to satisfy the
+  # camelCase rule would break the wire contract Grid already accepts.
+  - files:
+      - "openapi.yaml#/components/schemas/CardCreateRequest/properties/threeDSecurePassword"
+    rules:
+      field-names-camelCase: "off"
diff --git a/mintlify/openapi.yaml b/mintlify/openapi.yaml
index a6069a95d..82ff88579 100644
--- a/mintlify/openapi.yaml
+++ b/mintlify/openapi.yaml
@@ -23585,6 +23585,10 @@ components:
           type: string
           description: Optional platform-specific card identifier. System-generated when omitted, mirroring `platformCustomerId` semantics.
           example: card-emp-aary-001
+        threeDSecurePassword:
+          type: string
+          description: 'Optional static password used as the card''s 3-D Secure factor. Only accepted for card programs whose issuer supports a static-password factor (EU cards today); supplying it for a program that does not is rejected with `INVALID_INPUT`. When omitted, one is generated on the cardholder''s behalf. Grid does not retain the value: it is forwarded to the issuer and discarded, so it cannot be read back afterwards.'
+          example: AbCd1234EfGh5678
         form:
           $ref: '#/components/schemas/CardForm'
         fundingSources:
diff --git a/openapi.yaml b/openapi.yaml
index a6069a95d..82ff88579 100644
--- a/openapi.yaml
+++ b/openapi.yaml
@@ -23585,6 +23585,10 @@ components:
           type: string
           description: Optional platform-specific card identifier. System-generated when omitted, mirroring `platformCustomerId` semantics.
           example: card-emp-aary-001
+        threeDSecurePassword:
+          type: string
+          description: 'Optional static password used as the card''s 3-D Secure factor. Only accepted for card programs whose issuer supports a static-password factor (EU cards today); supplying it for a program that does not is rejected with `INVALID_INPUT`. When omitted, one is generated on the cardholder''s behalf. Grid does not retain the value: it is forwarded to the issuer and discarded, so it cannot be read back afterwards.'
+          example: AbCd1234EfGh5678
         form:
           $ref: '#/components/schemas/CardForm'
         fundingSources:
diff --git a/openapi/components/schemas/cards/CardCreateRequest.yaml b/openapi/components/schemas/cards/CardCreateRequest.yaml
index 5cbd262a3..3de99ac8a 100644
--- a/openapi/components/schemas/cards/CardCreateRequest.yaml
+++ b/openapi/components/schemas/cards/CardCreateRequest.yaml
@@ -17,6 +17,16 @@ properties:
       Optional platform-specific card identifier. System-generated when
       omitted, mirroring `platformCustomerId` semantics.
     example: card-emp-aary-001
+  threeDSecurePassword:
+    type: string
+    description: >-
+      Optional static password used as the card's 3-D Secure factor. Only
+      accepted for card programs whose issuer supports a static-password
+      factor (EU cards today); supplying it for a program that does not is
+      rejected with `INVALID_INPUT`. When omitted, one is generated on the
+      cardholder's behalf. Grid does not retain the value: it is forwarded to
+      the issuer and discarded, so it cannot be read back afterwards.
+    example: AbCd1234EfGh5678
   form:
     $ref: ./CardForm.yaml
   fundingSources: