---
title: "Mark an IBAN as Trusted Beneficiary (business)"
method: POST
path: "/business/beneficiary/iban/trust"
tags: ["Business Trusted Beneficiary"]
---

# Mark an IBAN as Trusted Beneficiary (business)

`POST /business/beneficiary/iban/trust`

## Request

- Base URL: `https://www.sandbox.striga.com/api/v1`
- URL: `https://www.sandbox.striga.com/api/v1/business/beneficiary/iban/trust`
- Auth: API key in header `api-key` and API key in header `Authorization`

Single-call TOTP-confirmed trust for a business. Unlike the consumer two-step initiate→confirm flow, the business endpoint verifies the supplied `totpCode` and applies the trust in a single request. The IBAN must already be whitelisted and activated, otherwise the request is rejected with `30073`.

## Request body

- object
  - `businessId` string, uuid, required
  - `whitelistedIbanId` string, uuid, required
  - `totpCode` string, required: 6–8 character TOTP or recovery code, verified at the time of the request.

## Response `200`

Trust applied.

- object
  - `ok` boolean, required

## Other responses

- `400`: Request was rejected. The `errorCode` field disambiguates.
- `401`: Invalid API key or HMAC signature.

---

[API](https://skmtc.dev/striga/apis/striga-strong-customer-authentication.md) - [All operations](https://skmtc.dev/striga/apis/striga-strong-customer-authentication/llms.txt) - [OpenAPI document](https://skmtc.dev/striga/apis/striga-strong-customer-authentication/revisions/6a0cf1c67072?raw)