---
title: "Record a security-relevant business event"
method: POST
path: "/business/record-event"
tags: ["Business Account Security"]
---

# Record a security-relevant business event

`POST /business/record-event`

## Request

- Base URL: `https://www.sandbox.striga.com/api/v1`
- URL: `https://www.sandbox.striga.com/api/v1/business/record-event`
- Auth: API key in header `api-key` and API key in header `Authorization`

Reports a security event for a business, driving progressive account lockout under PSD2. — `RESET_PASSWORD_COMPLETED` revokes every active SCA session for the business and clears the failed-login counter (an account already suspended at level 5 remains suspended until access is restored by support). — `FAILED_LOGIN_ATTEMPT` increments the cumulative counter and escalates the lock at each milestone: 5 attempts → 15 minutes, 6 → 30 minutes, 7 → 1 hour, 8 → 24 hours, 9 or more → suspension with no automatic recovery.

## Request body

- object
  - `businessId` string, uuid, required: The business the event is recorded against.
  - `event` 'RESET_PASSWORD_COMPLETED' | 'FAILED_LOGIN_ATTEMPT', required

## Response `200`

Event recorded. The populated fields depend on the event and resulting lock state: `RESET_PASSWORD_COMPLETED` returns only `event`; `FAILED_LOGIN_ATTEMPT` adds `failedAttempts` plus `lockedUntil` (time-bounded lock) or `suspended: true` (level-5 suspension).

- object
  - `event` 'RESET_PASSWORD_COMPLETED' | 'FAILED_LOGIN_ATTEMPT', required
  - `failedAttempts` integer: Cumulative failed-login count. Present for `FAILED_LOGIN_ATTEMPT`.
  - `lockedUntil` string, date-time: End of the active lock window. Present for `FAILED_LOGIN_ATTEMPT` when a time-bounded lock is in effect.
  - `suspended` boolean: Present and `true` when the attempt escalated to level 5 and the business was SUSPENDED.

## Other responses

- `400`: Request was rejected. The `errorCode` field disambiguates.
- `401`: Invalid API key or HMAC signature.

---

[API](https://skmtc.dev/striga/apis/striga-strong-customer-authentication.md) - [All operations](https://skmtc.dev/striga/apis/striga-strong-customer-authentication/llms.txt) - [OpenAPI document](https://skmtc.dev/striga/apis/striga-strong-customer-authentication/revisions/6a0cf1c67072?raw)