---
title: "Record a security event"
method: POST
path: "/sca/record-event"
tags: ["Strong Customer Authentication"]
---

# Record a security event

`POST /sca/record-event`

## Request

- Base URL: `https://api.lightspark.com/grid/2025-10-13`
- URL: `https://api.lightspark.com/grid/2025-10-13/sca/record-event`
- Auth: HTTP basic

Record a client-side security-relevant event for the customer with Grid's risk engine (e.g. a sign-in, a sensitive view), to
feed adaptive-authentication signals.

This endpoint is only meaningful for customers in a region where SCA is required (e.g. EU). For customers outside SCA-regulated regions, this returns `409`.

## Request body

- RecordSecurityEventRequest: Records a client-side security event for the customer so Grid can maintain the customer's login-security state (SCA session revocation and failed-login lockout).
  - `eventType` 'RESET_PASSWORD_COMPLETED' | 'FAILED_LOGIN_ATTEMPT', required: A security event on a customer's account that affects Strong Customer Authentication.
  - `endUserIpAddress` string, required: The IP address of the end user's device the event was observed from, recorded against the event by the SCA provider. Supply the customer's address, not your server's — it feeds the provider's risk assessment and the adaptive-authentication signals derived from this event.

## Response `200`

Event recorded; the customer's resulting login-security state is returned (including any lockout).

- RecordSecurityEventResponse: The customer's login-security state after recording the event, so the integrator can surface a lockout to the end user.
  - `eventType` 'RESET_PASSWORD_COMPLETED' | 'FAILED_LOGIN_ATTEMPT', required: A security event on a customer's account that affects Strong Customer Authentication.
  - `suspended` boolean, required: Whether the customer's login is currently suspended (locked with no automatic expiry). A suspended customer must go through a password reset (`RESET_PASSWORD_COMPLETED`) to clear the lockout.
  - `lockedUntil` string, date-time, nullable: When the customer may attempt to log in again, if temporarily locked. Null when not locked, or when `suspended` is true (no automatic expiry).
  - `failedAttempts` integer, required: The customer's current cumulative failed-login count.

## Other responses

- `400`: Invalid event type
- `401`: Unauthorized
- `404`: Customer not found
- `409`: SCA is not required for this customer.
- `423`: The customer's login is locked (or suspended) after too many failed attempts. `details.lockedUntil` says when they may retry.
- `500`: Internal service error

## Changes

> 115 revisions in range; 2 not diffed.

- **2026-10-28** `d996ddfb9d2b`: 2 info
  - added the optional property `details/missingFields` to the response with the `400` status
  - added the optional property `details/refusalReason` to the response with the `400` status
- **2026-10-26** `f11f1e76bdd7`: 1 warning
  - added the new `PURCHASE_CARD_LIMIT_REACHED` enum value to the `code` response property for the response status `409`
- **2026-10-26** `0a6dad5815c7`: 1 warning
  - added the new `INVOICE_ALREADY_USED` enum value to the `code` response property for the response status `409`
- **2026-10-24** `715332dcb111`: 1 warning
  - added the new `EXACT_AMOUNT_UNAVAILABLE` enum value to the `code` response property for the response status `400`
- **2026-10-20** `761d1d030cb5`: 2 warning
  - added the new `AGENT_CARD_EXISTS` enum value to the `code` response property for the response status `409`
  - added the new `CARDHOLDER_AGREEMENT_NOT_ACCEPTED` enum value to the `code` response property for the response status `400`

[Operation history](https://skmtc.dev/lightsparkdev/apis/grid-api/changes/sca/record-event/post.md)

---

[API](https://skmtc.dev/lightsparkdev/apis/grid-api.md) - [All operations](https://skmtc.dev/lightsparkdev/apis/grid-api/llms.txt) - [OpenAPI document](https://skmtc.dev/lightsparkdev/apis/grid-api/revisions/7a1db46ec552?raw)