# Enroll a Card Using the API
source: https://developer.mastercard.com/consent-management/documentation/use-cases/transaction-notifications/single-card-enrolment/apis/enroll/index.md

The following sequence shows the single-card enrollment flow using the Consent Management \& Enrollment API:
Diagram consentapis

1. Your service calls the `consents` endpoint:


   API Reference: `POST /consents`

   <br />

2. The Consent Management \& Enrollment API returns the `auth.type` and `auth.params` for fingerprinting.
   If fingerprinting is **not required** , you receive `threeDSServerTransID` but not `threeDsMethodUrl` in `auth.params`. In this case, set `fingerprintStatus` to `unavailable`.

3. Your service sends a fingerprinting request to the cardholder's browser passing the `auth.params` values.
   You must create a listener and implement a timeout mechanism. If fingerprinting encounters an issue and you do not receive the `threeds-method-notification`, the flow should continue without blocking. See [Card Consent Management APIs Tutorial](https://developer.mastercard.com/consent-management/documentation/tutorials-and-guides/card-consents-tutorial/index.md) for an example of how to display the iframe and listen for the completion event.

4. The browser performs fingerprinting. If fingerprinting fails and you do not receive the `threeds-method-notification` event, set `fingerprintStatus` to `timeout` in the next call.

5. When the fingerprinting iframe completes, it uses the browser's `Window.postMessage` to send a message with the type `threeds-method-notification`. This indicates that the process has finished. Fingerprinting results in one of the following outcomes:

   * **Success**
   * **Timeout**
   * **Unavailable** (for example, fingerprinting is not required)
6. Your service calls the `start-authentication` endpoint, passing the fingerprinting result and the browser parameters:


   API Reference: `POST /consents/{card_ref}/start-authentication`

   For more information, see [Handling 3DS Authentication](https://developer.mastercard.com/consent-management/documentation/tutorials-and-guides/card-consents-tutorial/handling-3ds-auth/index.md).

   <br />

7. `start-authentication` returns the URL for the 3DS challenge.
   If a challenge is not required (or not possible), the response contains no challenge details and `auth.Status` = `AUTHENTICATED`. User authentication is considered complete and no further API call is required.

8. Using the response to `start-authentication`, initiate the 3DS challenge iframe to the consumer so that they can verify their identity. Similar to the fingerprinting iframe, you must create a listener for the `Window.postMessage` event.

9. The browser displays the 3DS challenge window.

10. When the 3DS challenge iframe completes, it uses the browser's `Window.postMessage` to send a message with the type `threeds-method-notification`.

11. Your service calls `/consents/{card_ref}/verify-authentication` to check if the 3DS challenge was successful:


    API Reference: `POST /consents/{card_ref}/verify-authentication`

    <br />

12. `verify-authentication` responds with the consent status. If authentication fails for any reason, such as the user canceling or failing the challenge, failure details are provided in `auth.params` using the following fields: `cardholderInfo`, `transStatusReason`, and `transStatus`.

## Next Steps {#next-steps}

* To check the consents on an enrolled card, see [Retrieve Consent](https://developer.mastercard.com/consent-management/documentation/use-cases/transaction-notifications/single-card-enrolment/apis/retrieve/index.md).
* To revoke consent for a card, see [Delete Consent](https://developer.mastercard.com/consent-management/documentation/use-cases/transaction-notifications/single-card-enrolment/apis/delete/index.md).