LIlightsparkdev
Strong Customer Authentication

Confirm trusting a beneficiary

Changed on

Finalize trusting a beneficiary (identified by the externalAccountId in the path) by submitting the SCA proof (code for SMS_OTP / TOTP, or passkeyAssertion + origin for PASSKEY), echoing the challengeId when one was issued. Returns trusted: true.

This endpoint is only meaningful for customers in a region where SCA is required (e.g. EU). For customers outside SCA-regulated regions, this returns 409.

In sandbox, the SMS/TOTP code is always 000000.

post/customers/external-accounts/{externalAccountId}/trust/confirm

Request

  • Base URL
    https://api.lightspark.com/grid/2025-10-13
  • URL
    https://api.lightspark.com/grid/2025-10-13/customers/external-accounts/{externalAccountId}/trust/confirm
  • Auth
    HTTP basic

Request body

challengeIdstring nullable

The challenge handle from the trust start's scaChallenge, when one was issued. Omit when the start returned no challenge.

codestring nullable

The one-time code the customer received by SMS, or read from their authenticator app. Provide for SMS_OTP / TOTP. In sandbox, the code is always 000000.

passkeyAssertionobject nullable

Opaque WebAuthn assertion produced by the device from the challenge's assertion options. Required when satisfying a PASSKEY challenge.

originstring nullable

The WebAuthn origin the passkeyAssertion was produced against. Required alongside passkeyAssertion; omit it for the code path.

Example request

{
  "code": "000000",
  "origin": "https://app.example.com"
}

Response

Beneficiary trusted.

trustedboolean required

Whether the beneficiary is now trusted. true after a successful trust, false after a successful untrust.

Changes

  • d996ddfb9d2bRevision changes
    • info

      added the optional property / to the response with the status

    • info

      added the optional property / to the response with the status

  • f11f1e76bdd7Revision changes
    • warning

      added the new PURCHASE_CARD_LIMIT_REACHED enum value to the response property for the response status