---
title: "Confirm transaction with OTP"
method: POST
path: "/business/transaction/confirm"
tags: ["wallets"]
---

# Confirm transaction with OTP

`POST /business/transaction/confirm`

## Request

- Base URL: `https://www.sandbox.striga.com/api/v1/wallets`
- URL: `https://www.sandbox.striga.com/api/v1/wallets/business/transaction/confirm`
- Auth: API key in header `api-key` and API key in header `Authorization`

TODO

## Request body

- BusinessConfirmTransactionRequest
  - `businessId` string, uuid, required: The Id of the business who is sending this transaction
  - `challengeId` string, uuid, required: The challengeId that you received when initiating the transaction
  - `verificationMethod` 'sms' | 'totp' | 'passkey': The SCA factor the partner is confirming with. Optional for legacy SMS callers; required when using passkey (which omits `verificationCode` and supplies `origin` + `passkeyAssertion` instead).
  - `verificationCode` string: 5–6 character code (6-digit OTP or 5-5 TOTP recovery code). Required when `verificationMethod` is `sms` or `totp`, or when omitted. Must NOT be sent on the passkey path.
  - `origin` string: Browser origin that produced the WebAuthn assertion. Required when `verificationMethod` is `passkey`.
  - `passkeyAssertion` object: WebAuthn assertion payload produced by the partner's frontend. Required when `verificationMethod` is `passkey`. Free-form — the route's custom validator (`isPasskeyCredentialPayload`) enforces the WebAuthn shape, so this schema doesn't enumerate fields.
  - `ip` string, ip, required: IP address collected as the IP address from which the End User is making the withdrawal request. IMPORTANT - This will be a required parameter from the 15th of June 2023 and is optional until then.

## Response `200`

success

- BusinessConfirmTransactionResponse
  - `id` string, uuid, required
  - `sourceAccountId` string, alpha-numeric, required
  - `destinationAccountId` string, alpha-numeric, required
  - `memo` string
  - `status` string
  - `txType` string
  - `order` object
    - `price` string
    - `debit` object
      - `currency` string
      - `amountFloat` string
      - `amount` string, big-number-amount
    - `credit` object
      - `currency` string
      - `amountFloat` string
      - `amount` string, big-number-amount
  - `dateTime` string, date-time
  - `balanceBefore` object
    - `balance` string, big-number-amount
    - `currency` string
  - `balanceAfter` object
    - `balance` string, big-number-amount
    - `currency` string
  - `sourceSyncedOwnerId` string, uuid
  - `destinationSyncedOwnerId` string, uuid

## Other responses

- `400`: Bad Request. The request was unacceptable, often due to missing a required parameter.
- `401`: Invalid authentication header
- `500`: Unexpected server error.

---

[API](https://skmtc.dev/striga/apis/business-wallets-transactions.md) - [All operations](https://skmtc.dev/striga/apis/business-wallets-transactions/llms.txt) - [OpenAPI document](https://skmtc.dev/striga/apis/business-wallets-transactions/revisions/ea0f4d67546d?raw)