Begin an SCA login for the customer with the chosen factor, opening the end-user SCA session (an exemption gating read / account access beyond the per-transaction window). Returns factor-specific material: SMS_OTP dispatches a code and returns a challengeId + expiresAt; TOTP returns only the factor (the customer reads the code from their app); PASSKEY returns WebAuthn passkeyOptions. Complete with POST /sca/login/complete.

This endpoint is only meaningful for customers in a region where SCA is required (e.g. EU). For customers outside SCA-regulated regions, this returns 409.

{
  "expiresAt": "2025-10-03T12:05:00Z",
  "allowedOrigins": [
    "https://app.example.com"
  ],
  "relyingPartyId": "app.example.com"
}