docs(cards): document the optional 3DS password on card create

.spectral.yaml

@@ -12,7 +12,8 @@ rules:
   # Naming Conventions (README: Naming Conventions)
   # ============================================================
 
-  # Fields must be camelCase (excludes TestWebhookResponse which mirrors external format)
+  # Fields must be camelCase (excludes TestWebhookResponse which mirrors
+  # external format; see the overrides block for per-property exemptions)
   field-names-camelCase:
     description: Schema property names must be camelCase
     message: "Property '{{property}}' must be camelCase. See openapi/README.md#field-naming"
@@ -179,3 +180,13 @@ rules:
       function: pattern
       functionOptions:
         match: "^((\\/([a-z0-9]+(-[a-z0-9]+)*|\\{[a-zA-Z0-9]+\\}))+|\\/sandbox\\/cards\\/\\{id\\}\\/simulate\\/(balance_inquiry|credit_authorization|financial_authorization|financial_credit_authorization|authorization_advice|credit_authorization_advice|return_reversal))$"
+
+# Per-property exemptions from the naming rules above.
+overrides:
+  # "3DS" is the industry spelling of the 3-D Secure factor, and this field
+  # mirrors the issuer's own request field name. Renaming it to satisfy the
+  # camelCase rule would break the wire contract Grid already accepts.
+  - files:
+      - "openapi.yaml#/components/schemas/CardCreateRequest/properties/threeDSecurePassword"
+    rules:
+      field-names-camelCase: "off"

openapi/components/schemas/cards/CardCreateRequest.yaml

@@ -17,6 +17,16 @@ properties:
       Optional platform-specific card identifier. System-generated when
       omitted, mirroring `platformCustomerId` semantics.
     example: card-emp-aary-001
+  threeDSecurePassword:
+    type: string
+    description: >-
+      Optional static password used as the card's 3-D Secure factor. Only
+      accepted for card programs whose issuer supports a static-password
+      factor (EU cards today); supplying it for a program that does not is
+      rejected with `INVALID_INPUT`. When omitted, one is generated on the
+      cardholder's behalf. Grid does not retain the value: it is forwarded to
+      the issuer and discarded, so it cannot be read back afterwards.
+    example: AbCd1234EfGh5678
   form:
     $ref: ./CardForm.yaml
   fundingSources: