From 17370ba49d4639c955d9d4afb7b39f4a800c7de4 Mon Sep 17 00:00:00 2001 From: kphurley7 Date: Fri, 31 Jul 2026 17:51:02 -0500 Subject: [PATCH] docs(cards): document the optional 3DS password on card create Grid already accepts threeDSecurePassword on POST /cards and forwards it to the issuer, but the field was absent from the spec, so it reached no SDK and no docs - discoverable only by being told about it. The name trips field-names-camelCase because of the consecutive capitals in "3DS", which is the industry spelling and matches the issuer's own request field. Renaming would break a contract Grid already honors, so this exempts the single property rather than the schema, alongside the existing TestWebhookResponse carve-out. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01JsJUrc9YRcfxEFqgXQEYvD --- .spectral.yaml | 13 ++++++++++++- mintlify/openapi.yaml | 4 ++++ openapi.yaml | 4 ++++ .../components/schemas/cards/CardCreateRequest.yaml | 10 ++++++++++ 4 files changed, 30 insertions(+), 1 deletion(-) diff --git a/.spectral.yaml b/.spectral.yaml index 6975a563e..2b8b9055b 100644 --- a/.spectral.yaml +++ b/.spectral.yaml @@ -12,7 +12,8 @@ rules: # Naming Conventions (README: Naming Conventions) # ============================================================ - # Fields must be camelCase (excludes TestWebhookResponse which mirrors external format) + # Fields must be camelCase (excludes TestWebhookResponse which mirrors + # external format; see the overrides block for per-property exemptions) field-names-camelCase: description: Schema property names must be camelCase message: "Property '{{property}}' must be camelCase. See openapi/README.md#field-naming" @@ -179,3 +180,13 @@ rules: function: pattern functionOptions: match: "^((\\/([a-z0-9]+(-[a-z0-9]+)*|\\{[a-zA-Z0-9]+\\}))+|\\/sandbox\\/cards\\/\\{id\\}\\/simulate\\/(balance_inquiry|credit_authorization|financial_authorization|financial_credit_authorization|authorization_advice|credit_authorization_advice|return_reversal))$" + +# Per-property exemptions from the naming rules above. +overrides: + # "3DS" is the industry spelling of the 3-D Secure factor, and this field + # mirrors the issuer's own request field name. Renaming it to satisfy the + # camelCase rule would break the wire contract Grid already accepts. + - files: + - "openapi.yaml#/components/schemas/CardCreateRequest/properties/threeDSecurePassword" + rules: + field-names-camelCase: "off" diff --git a/mintlify/openapi.yaml b/mintlify/openapi.yaml index a6069a95d..82ff88579 100644 --- a/mintlify/openapi.yaml +++ b/mintlify/openapi.yaml @@ -23585,6 +23585,10 @@ components: type: string description: Optional platform-specific card identifier. System-generated when omitted, mirroring `platformCustomerId` semantics. example: card-emp-aary-001 + threeDSecurePassword: + type: string + description: 'Optional static password used as the card''s 3-D Secure factor. Only accepted for card programs whose issuer supports a static-password factor (EU cards today); supplying it for a program that does not is rejected with `INVALID_INPUT`. When omitted, one is generated on the cardholder''s behalf. Grid does not retain the value: it is forwarded to the issuer and discarded, so it cannot be read back afterwards.' + example: AbCd1234EfGh5678 form: $ref: '#/components/schemas/CardForm' fundingSources: diff --git a/openapi.yaml b/openapi.yaml index a6069a95d..82ff88579 100644 --- a/openapi.yaml +++ b/openapi.yaml @@ -23585,6 +23585,10 @@ components: type: string description: Optional platform-specific card identifier. System-generated when omitted, mirroring `platformCustomerId` semantics. example: card-emp-aary-001 + threeDSecurePassword: + type: string + description: 'Optional static password used as the card''s 3-D Secure factor. Only accepted for card programs whose issuer supports a static-password factor (EU cards today); supplying it for a program that does not is rejected with `INVALID_INPUT`. When omitted, one is generated on the cardholder''s behalf. Grid does not retain the value: it is forwarded to the issuer and discarded, so it cannot be read back afterwards.' + example: AbCd1234EfGh5678 form: $ref: '#/components/schemas/CardForm' fundingSources: diff --git a/openapi/components/schemas/cards/CardCreateRequest.yaml b/openapi/components/schemas/cards/CardCreateRequest.yaml index 5cbd262a3..3de99ac8a 100644 --- a/openapi/components/schemas/cards/CardCreateRequest.yaml +++ b/openapi/components/schemas/cards/CardCreateRequest.yaml @@ -17,6 +17,16 @@ properties: Optional platform-specific card identifier. System-generated when omitted, mirroring `platformCustomerId` semantics. example: card-emp-aary-001 + threeDSecurePassword: + type: string + description: >- + Optional static password used as the card's 3-D Secure factor. Only + accepted for card programs whose issuer supports a static-password + factor (EU cards today); supplying it for a program that does not is + rejected with `INVALID_INPUT`. When omitted, one is generated on the + cardholder's behalf. Grid does not retain the value: it is forwarded to + the issuer and discarded, so it cannot be read back afterwards. + example: AbCd1234EfGh5678 form: $ref: ./CardForm.yaml fundingSources: