Netcetera Demo Merchant - Release Notes - Version 2.9.0.0

Overview

Published: 25.02.2026

Version 2.9.0.0 is a major release of the Netcetera Demo Merchant.

For documentation about this release please refer to the documentation site.

Compatibility

This version has a breaking change and is not compatible with previous version of the Netcetera Demo Merchant.

Breaking Changes

The Demo Merchant UI application has been removed. End-users should use the API endpoints and existing demo flows without the bundled UI.

Important notification

Challenge Indicator Handling

The simulator evaluates the threeDSRequestorChallengeIndicator values provided in the Authentication Request (AReq) to determine whether a challenge or a frictionless response is returned.

Challenge-Enforcing Indicators

If any challenge-requesting indicator is present (e.g., 04 – Challenge requested (mandate)), a challenge response is enforced, regardless of any default frictionless configuration. The following indicators explicitly request a challenge and will always result in a challenge flow:

  • 03 - Challenge requested 3DS requestor preference
  • 04 - Challenge requested (mandate)
  • 09 - Challenge requested (whitelist prompt requested if challenge required)
  • 12 - Challenge requested (device binding prompt requested if challenge required)
  • 13 - Challenge requested (Issuer requested)
  • 14 - Challenge requested (Merchant initiated transactions)

Multiple Indicators (Supported from Protocol Version 2.3.1)

When multiple indicators are provided:

  • They are evaluated in the order received.
  • The simulator attempts to apply each indicator sequentially.
  • If none match a specific frictionless or exemption rule, the simulator falls back to a default challenge response.

Frictionless-Requesting Indicators

Indicators that explicitly request no challenge may result in a frictionless response, provided protocol version, scheme, and transaction attributes support the exemption.

Examples:

  • 05 – TRA exemption
  • 06 – Data share only
  • 10 – Low value exemption

If exemption conditions are not met, the simulator proceeds with a challenge flow.

No Indicators Provided

If:

  • No challenge indicator is provided, or
  • No indicator can be successfully applied,

Then:

  • The configured ARes scenario is applied (if available),
  • Otherwise, the simulator defaults to a standard frictionless response.

Changes

Improvements

  • Updated the TRA exemption condition so it is applied only when the calculated purchase amount (derived from purchaseAmount and purchaseExponent) is less than or equal to 5000. If purchaseExponent is provided, the effective amount is computed accordingly. If it is not provided, the purchaseAmount is evaluated as-is. For amounts above this value, the standard challenge flow is returned.
  • Updated support for the Decoupled Authentication flow. For more information, visit Decoupled Authentication page.

Bug fixes

  • Fixed challenge value parsing to correctly handle missing or empty inputs, ensuring the default challenge response is returned when no value is provided.
  • Fixed card range configuration so that issuerCountryCode field is only set when a non-empty value is provided, preventing null or blank issuer country codes from being applied.
  • Fixed an issue in the BROWSER_CHALLENGE_MISSING_ACS_URL simulation configuration.