---
title: "Confirm trusting a beneficiary"
method: POST
path: "/customers/external-accounts/{externalAccountId}/trust/confirm"
tags: ["Strong Customer Authentication"]
---

# Confirm trusting a beneficiary

`POST /customers/external-accounts/{externalAccountId}/trust/confirm`

## Request

- Base URL: `https://api.lightspark.com/grid/2025-10-13`
- URL: `https://api.lightspark.com/grid/2025-10-13/customers/external-accounts/{externalAccountId}/trust/confirm`
- Auth: HTTP basic

Finalize trusting a beneficiary (identified by the `externalAccountId` in the
path) by submitting the SCA proof (`code` for `SMS_OTP` / `TOTP`, or
`passkeyAssertion` + `origin` for `PASSKEY`), echoing the `challengeId` when
one was issued. Returns `trusted: true`.

This endpoint is only meaningful for customers in a region where SCA is required (e.g. EU). For customers outside SCA-regulated regions, this returns `409`.

In sandbox, the SMS/TOTP code is always `000000`.

## Request body

- BeneficiaryTrustConfirmRequest: Confirms trusting or untrusting a beneficiary by submitting the SCA proof. Carries the same proof fields as an `ScaAuthorization` (`code` for `SMS_OTP` / `TOTP`, or `passkeyAssertion` + `origin` for `PASSKEY`) and, when the start issued one, the `challengeId`. The beneficiary is identified by the `externalAccountId` in the path — no separate handle is needed. Provide exactly one of `code` or `passkeyAssertion`, with `origin` alongside a `passkeyAssertion`.
  - `challengeId` string, nullable: The challenge handle from the trust start's `scaChallenge`, when one was issued. Omit when the start returned no challenge.
  - `code` string, nullable: The one-time code the customer received by SMS, or read from their authenticator app. Provide for `SMS_OTP` / `TOTP`. In sandbox, the code is always `000000`.
  - `passkeyAssertion` object, nullable: Opaque WebAuthn assertion produced by the device from the challenge's assertion options. Required when satisfying a `PASSKEY` challenge.
  - `origin` string, nullable: The WebAuthn origin the `passkeyAssertion` was produced against. Required alongside `passkeyAssertion`; omit it for the `code` path.

## Response `200`

Beneficiary trusted.

- BeneficiaryTrustConfirm: The result of a confirm-trust / confirm-untrust call. `trusted` is `true` after a successful trust and `false` after a successful untrust.
  - `trusted` boolean, required: Whether the beneficiary is now trusted. `true` after a successful trust, `false` after a successful untrust.

## Other responses

- `400`: Invalid or expired proof
- `401`: Unauthorized
- `404`: Customer or external account not found
- `409`: SCA is not required for this customer.
- `500`: Internal service error

## Changes

> 115 revisions in range; 2 not diffed.

- **2026-10-28** `d996ddfb9d2b`: 2 info
  - added the optional property `details/missingFields` to the response with the `400` status
  - added the optional property `details/refusalReason` to the response with the `400` status
- **2026-10-26** `f11f1e76bdd7`: 1 warning
  - added the new `PURCHASE_CARD_LIMIT_REACHED` enum value to the `code` response property for the response status `409`
- **2026-10-26** `0a6dad5815c7`: 1 warning
  - added the new `INVOICE_ALREADY_USED` enum value to the `code` response property for the response status `409`
- **2026-10-24** `715332dcb111`: 1 warning
  - added the new `EXACT_AMOUNT_UNAVAILABLE` enum value to the `code` response property for the response status `400`
- **2026-10-20** `761d1d030cb5`: 2 warning
  - added the new `AGENT_CARD_EXISTS` enum value to the `code` response property for the response status `409`
  - added the new `CARDHOLDER_AGREEMENT_NOT_ACCEPTED` enum value to the `code` response property for the response status `400`

[Operation history](https://skmtc.dev/lightsparkdev/apis/grid-api/changes/customers/external-accounts/:externalAccountId/trust/confirm/post.md)

---

[API](https://skmtc.dev/lightsparkdev/apis/grid-api.md) - [All operations](https://skmtc.dev/lightsparkdev/apis/grid-api/llms.txt) - [OpenAPI document](https://skmtc.dev/lightsparkdev/apis/grid-api/revisions/7a1db46ec552?raw)