Confirm trusting a beneficiary

Finalize trusting a beneficiary (identified by the externalAccountId in the path) by submitting the SCA proof (code for SMS_OTP / TOTP, or passkeyAssertion + origin for PASSKEY), echoing the challengeId when one was issued. Returns trusted: true.

This endpoint is only meaningful for customers in a region where SCA is required (e.g. EU). For customers outside SCA-regulated regions, this returns 409.

In sandbox, the SMS/TOTP code is always 000000.

POST /customers/external-accounts/{externalAccountId}/trust/confirm

Confirm trusting a beneficiary

cURL

curl --request POST \
  --url https://api.lightspark.com/grid/2025-10-13/customers/external-accounts/{externalAccountId}/trust/confirm \
  --header 'Authorization: Basic <encoded-value>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "challengeId": "<string>",
  "code": "000000",
  "passkeyAssertion": {},
  "origin": "https://app.example.com"
}
'

200

{
  "trusted": true
}

Authorizations

Authorization · string · header · required

API token authentication using format <api token id>:<api client secret>

Path Parameters

externalAccountId · string · required

The unique identifier of the external account (beneficiary) being trusted.

Body

application/json

Confirms trusting or untrusting a beneficiary by submitting the SCA proof. Carries the same proof fields as an ScaAuthorization (code for SMS_OTP / TOTP, or passkeyAssertion + origin for PASSKEY) and, when the start issued one, the challengeId. The beneficiary is identified by the externalAccountId in the path — no separate handle is needed. Provide exactly one of code or passkeyAssertion, with origin alongside a passkeyAssertion.

challengeId · string | null

The challenge handle from the trust start's scaChallenge, when one was issued. Omit when the start returned no challenge.

code · string | null

The one-time code the customer received by SMS, or read from their authenticator app. Provide for SMS_OTP / TOTP. In sandbox, the code is always 000000.

Example:

"000000"

passkeyAssertion · object | null

Opaque WebAuthn assertion produced by the device from the challenge's assertion options. Required when satisfying a PASSKEY challenge.

origin · string | null

The WebAuthn origin the passkeyAssertion was produced against. Required alongside passkeyAssertion; omit it for the code path.

Example:

"https://app.example.com"

Response

200

application/json

Beneficiary trusted.

The result of a confirm-trust / confirm-untrust call. trusted is true after a successful trust and false after a successful untrust.

trusted · boolean · required

Whether the beneficiary is now trusted. true after a successful trust, false after a successful untrust.