Complete an SCA login

Finalize an SCA login by submitting the proof for the started factor (code for SMS_OTP / TOTP, or passkeyAssertion + origin for PASSKEY), echoing the challengeId for SMS_OTP. Returns the reported session status.

This endpoint is only meaningful for customers in a region where SCA is required (e.g. EU). For customers outside SCA-regulated regions, this returns 409.

In sandbox, the SMS/TOTP code is always 123456.

post/sca/login/complete

Request body

Example request

{
  "endUserIpAddress": "203.0.113.42",
  "code": "123456",
  "origin": "https://app.example.com"
}

Response

SCA login completed; the session status is returned.

statusstring required

The status of the login session. A successful login reports SUCCESS; other values indicate the login did not complete and should be surfaced to the caller.

sessionExpiresAtstring date-time nullable

Absolute UTC timestamp after which the customer's SCA session is no longer valid and they must complete another SCA login. Money movement in SCA-regulated currencies is refused once it passes, so prompt a re-login ahead of it rather than waiting for a SCA_SESSION_REQUIRED failure. Present when the login established a session.

Example response

{
  "status": "SUCCESS",
  "sessionExpiresAt": "2026-01-29T12:00:00Z"
}

Changes

Changed in 7 of the 24 revisions of this API.1103

Aug 14, 2026aaa1fb8782c81See the full diff
- ●
  added the new EXTERNAL_ACCOUNT_VERIFICATION_REQUIRED enum value to the code response property for the response status 400
  response-property-enum-value-added
This revision also has 1 change that name no endpoint, such as unreferenced schemas being removed. See the revision's changelog
Aug 13, 2026df12ec487f0e1See the full diff
- ●
  added the new TRANSACTION_SIZE_LIMIT_EXCEEDED enum value to the code response property for the response status 400
  response-property-enum-value-added
Aug 11, 2026b06902b6595a4See the full diff
- ●
  added the new CARDHOLDER_KYC_NOT_APPROVED enum value to the code response property for the response status 400
  response-property-enum-value-added
- ●
  added the new CARD_ALREADY_CLOSED enum value to the code response property for the response status 409
  response-property-enum-value-added
- ●
  added the new CARD_NOT_MUTABLE enum value to the code response property for the response status 409
  response-property-enum-value-added
- ●
  added the new INVALID_STATE_TRANSITION enum value to the code response property for the response status 409
  response-property-enum-value-added
Aug 6, 2026526036c126091See the full diff
- ●
  added the new END_USER_TERMS_VERSION_NOT_FOUND enum value to the code response property for the response status 400
  response-property-enum-value-added
Jul 31, 2026b21ed434ee6e122See the full diff
- ▲
  added the new required request property endUserIpAddress
  new-required-request-property
- ●
  added the new BENEFICIARY_TRUSTED enum value to the code response property for the response status 409
  response-property-enum-value-added
- ●
  added the new SCA_SESSION_REQUIRED enum value to the code response property for the response status 409
  response-property-enum-value-added
- ○
  added the optional property details/errors to the response with the 400 status
  response-optional-property-added
- ○
  added the optional property sessionExpiresAt to the response with the 200 status
  response-optional-property-added
Jul 26, 2026094458a989d21See the full diff
- ●
  added the new TRANSACTION_NOT_CANCELLABLE enum value to the code response property for the response status 409
  response-property-enum-value-added
This revision also has 1 change that name no endpoint, such as unreferenced schemas being removed. See the revision's changelog
Jul 21, 2026483d0a08414b1See the full diff
- ○
  endpoint added
  endpoint-added
This revision also has 1 change that name no endpoint, such as unreferenced schemas being removed. See the revision's changelog

Full history