---
title: "Record a security event"
method: POST
path: "/sca/record-event"
tags: ["Strong Customer Authentication"]
---

# Record a security event

`POST /sca/record-event`

Record a client-side security-relevant event for the customer with Grid's risk engine (e.g. a sign-in, a sensitive view), to
feed adaptive-authentication signals.

This endpoint is only meaningful for customers in a region where SCA is required (e.g. EU). For customers outside SCA-regulated regions, this returns `409`.

## Request body

- RecordSecurityEventRequest — Records a client-side security event for the customer so Grid can maintain the customer's login-security state (SCA session revocation and failed-login lockout).
  - `eventType` 'RESET_PASSWORD_COMPLETED' | 'FAILED_LOGIN_ATTEMPT', required — The security event to record: | Value | Effect | |-------|--------| | `RESET_PASSWORD_COMPLETED` | Revokes every active SCA session for the customer and clears the failed-login counter. | | `FAILED_LOGIN_ATTEMPT` | Increments the cumulative failed-login counter and escalates the lockout at each milestone: 5 attempts → 15 minutes, 6 → 30 minutes, 7 → 1 hour, 8 → 24 hours, 9 or more → suspension. |

## Response `200`

Event recorded; the customer's resulting login-security state is returned (including any lockout).

- RecordSecurityEventResponse — The customer's login-security state after recording the event, so the integrator can surface a lockout to the end user.
  - `eventType` 'RESET_PASSWORD_COMPLETED' | 'FAILED_LOGIN_ATTEMPT', required — The event that was recorded.
  - `suspended` boolean, required — Whether the customer's login is currently suspended (locked with no automatic expiry). A suspended customer must go through a password reset (`RESET_PASSWORD_COMPLETED`) to clear the lockout.
  - `lockedUntil` string, date-time, nullable — When the customer may attempt to log in again, if temporarily locked. Null when not locked, or when `suspended` is true (no automatic expiry).
  - `failedAttempts` integer, required — The customer's current cumulative failed-login count.

## Other responses

- `400` — Invalid event type
- `401` — Unauthorized
- `404` — Customer not found
- `409` — SCA is not required for this customer.
- `423` — The customer's login is locked (or suspended) after too many failed attempts. `details.lockedUntil` says when they may retry.
- `500` — Internal service error

## Changes

- **2026-08-14** `aaa1fb8782c8` — 1 warning
  - added the new `EXTERNAL_ACCOUNT_VERIFICATION_REQUIRED` enum value to the `code` response property for the response status `400`
- **2026-08-13** `df12ec487f0e` — 1 warning
  - added the new `TRANSACTION_SIZE_LIMIT_EXCEEDED` enum value to the `code` response property for the response status `400`
- **2026-08-11** `b06902b6595a` — 4 warning
  - added the new `CARDHOLDER_KYC_NOT_APPROVED` enum value to the `code` response property for the response status `400`
  - added the new `CARD_ALREADY_CLOSED` enum value to the `code` response property for the response status `409`
  - added the new `CARD_NOT_MUTABLE` enum value to the `code` response property for the response status `409`
  - added the new `INVALID_STATE_TRANSITION` enum value to the `code` response property for the response status `409`
- **2026-08-06** `526036c12609` — 1 warning
  - added the new `END_USER_TERMS_VERSION_NOT_FOUND` enum value to the `code` response property for the response status `400`
- **2026-07-31** `b21ed434ee6e` — 2 warning, 1 info
  - added the new `BENEFICIARY_TRUSTED` enum value to the `code` response property for the response status `409`
  - added the new `SCA_SESSION_REQUIRED` enum value to the `code` response property for the response status `409`
  - added the optional property `details/errors` to the response with the `400` status

[Full history](https://skmtc.dev/stainless-api/apis/grid-api/changes/sca/record-event/post.md)

---

[API](https://skmtc.dev/stainless-api/apis/grid-api.md) · [All operations](https://skmtc.dev/stainless-api/apis/grid-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/stainless-api/grid-api/revisions/2ec84c06fbec/schema)