Finalize the factor enrollment started by POST /sca/factors. The request body is discriminated by type: for TOTP, submit the shared secret from the start call plus the first code; for PASSKEY, submit the WebAuthn credential the device produced plus the origin it was produced against. The threaded secret/credential binds the confirmation to its enrollment, so no separate id is needed.

A TOTP confirmation returns one-time recovery codes (shown once); a passkey confirmation returns the enrolled factor.

This endpoint is only meaningful for customers in a region where SCA is required (e.g. EU). For customers outside SCA-regulated regions, this returns 409.

In sandbox, the TOTP code is always 000000.

{
  "code": "000000"
}

{
  "recoveryCodes": [
    "ABCD-EFGH-IJKL",
    "MNOP-QRST-UVWX"
  ]
}