---
title: "Confirm or Cancel a business standing order with an OTP"
method: POST
path: "/business/confirm"
tags: ["standing-orders"]
---

# Confirm or Cancel a business standing order with an OTP

`POST /business/confirm`

## Request

- Base URL: `https://www.sandbox.striga.com/api/v1/standing-orders`
- URL: `https://www.sandbox.striga.com/api/v1/standing-orders/business/confirm`
- Auth: API key in header `api-key` and API key in header `Authorization`

Confirm or Cancel a business standing order with an OTP (5 attempts allowed). Identical to POST /confirm except the owner is identified by `businessId` instead of `userId`.

## Request body

- BusinessConfirmStandingOrderRequest
  - `businessId` string, uuid, required: Unique ID of the business for whom the standing order is to be confirmed
  - `challengeId` string, uuid, required: The challenge ID linked to this standing order
  - `verificationMethod` 'sms' | 'totp' | 'passkey': SCA factor used to confirm — must match the factor selected at create/cancel time. Defaults to sms.
  - `verificationCode` string: The one-time code. Required when verificationMethod is sms or totp; omit for passkey.
  - `origin` string: Browser-supplied origin from the WebAuthn ceremony. Required when verificationMethod is passkey.
  - `passkeyAssertion` object: Signed WebAuthn `PublicKeyCredential` returned by `navigator.credentials.get()` for the assertion challenge issued by `PASSKEY_APPROVAL_START`. Required when `verificationMethod` is `passkey`.
    - `id` string
    - `rawId` string
    - `type` string
    - `response` object
      - `clientDataJSON` string
      - `authenticatorData` string
      - `signature` string
      - `userHandle` string
    - `clientExtensionResults` object
      - `appid` string
  - `ip` union, required: The IP address of the business admin at the time of initiating this standing order
    - string, ipv4
    - string, ipv6

## Response `201`

success

- BusinessConfirmStandingOrderResponse
  - `id` string, uuid, required: The unique ID of this standing order
  - `businessId` string, uuid, required: The unique business ID for this standing order
  - `status` 'CANCELLED' | 'ACTIVE' | 'PAUSED', required: The status of this standing order

## Other responses

- `400`: Bad Request. The request was unacceptable, often due to missing a required parameter.
- `401`: Invalid authentication header
- `500`: Unexpected server error.

---

[API](https://skmtc.dev/striga/apis/standing-orders.md) - [All operations](https://skmtc.dev/striga/apis/standing-orders/llms.txt) - [OpenAPI document](https://skmtc.dev/striga/apis/standing-orders/revisions/55fb35478f9d?raw)