Confirm untrusting a beneficiary

curl --request POST \
  --url https://api.lightspark.com/grid/2025-10-13/customers/external-accounts/{externalAccountId}/untrust/confirm \
  --header 'Authorization: Basic <encoded-value>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "code": "123456",
  "challengeId": "<string>",
  "passkeyAssertion": {},
  "origin": "https://app.example.com"
}
'

const options = {
  method: 'POST',
  headers: {Authorization: 'Basic <encoded-value>', 'Content-Type': 'application/json'},
  body: JSON.stringify({
    code: '123456',
    challengeId: '<string>',
    passkeyAssertion: {},
    origin: 'https://app.example.com'
  })
};

fetch('https://api.lightspark.com/grid/2025-10-13/customers/external-accounts/{externalAccountId}/untrust/confirm', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

val client = OkHttpClient()

val mediaType = MediaType.parse("application/json")
val body = RequestBody.create(mediaType, "{\n  \"code\": \"123456\",\n  \"challengeId\": \"<string>\",\n  \"passkeyAssertion\": {},\n  \"origin\": \"https://app.example.com\"\n}")
val request = Request.Builder()
  .url("https://api.lightspark.com/grid/2025-10-13/customers/external-accounts/{externalAccountId}/untrust/confirm")
  .post(body)
  .addHeader("Authorization", "Basic <encoded-value>")
  .addHeader("Content-Type", "application/json")
  .build()

val response = client.newCall(request).execute()

{
  "trusted": true
}

{
  "status": 400,
  "message": "<string>",
  "details": {}
}

{
  "status": 401,
  "message": "<string>",
  "details": {}
}

{
  "status": 404,
  "message": "<string>",
  "details": {}
}

{
  "status": 409,
  "message": "<string>",
  "details": {}
}

{
  "status": 500,
  "message": "<string>",
  "details": {}
}

Strong Customer Authentication

Confirm untrusting a beneficiary

Finalize untrusting a beneficiary (identified by the externalAccountId in the path) by submitting the SCA proof (code for SMS_OTP / TOTP, or passkeyAssertion + origin for PASSKEY), echoing the challengeId when one was issued. Returns trusted: false.

This endpoint is only meaningful for customers in a region where SCA is required (e.g. EU). For customers outside SCA-regulated regions, this returns 409.

In sandbox, the SMS/TOTP code is always 123456.

POST

customers

external-accounts

{externalAccountId}

untrust

confirm

Confirm untrusting a beneficiary

curl --request POST \
  --url https://api.lightspark.com/grid/2025-10-13/customers/external-accounts/{externalAccountId}/untrust/confirm \
  --header 'Authorization: Basic <encoded-value>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "code": "123456",
  "challengeId": "<string>",
  "passkeyAssertion": {},
  "origin": "https://app.example.com"
}
'

const options = {
  method: 'POST',
  headers: {Authorization: 'Basic <encoded-value>', 'Content-Type': 'application/json'},
  body: JSON.stringify({
    code: '123456',
    challengeId: '<string>',
    passkeyAssertion: {},
    origin: 'https://app.example.com'
  })
};

fetch('https://api.lightspark.com/grid/2025-10-13/customers/external-accounts/{externalAccountId}/untrust/confirm', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

val client = OkHttpClient()

val mediaType = MediaType.parse("application/json")
val body = RequestBody.create(mediaType, "{\n  \"code\": \"123456\",\n  \"challengeId\": \"<string>\",\n  \"passkeyAssertion\": {},\n  \"origin\": \"https://app.example.com\"\n}")
val request = Request.Builder()
  .url("https://api.lightspark.com/grid/2025-10-13/customers/external-accounts/{externalAccountId}/untrust/confirm")
  .post(body)
  .addHeader("Authorization", "Basic <encoded-value>")
  .addHeader("Content-Type", "application/json")
  .build()

val response = client.newCall(request).execute()

{
  "trusted": true
}

{
  "status": 400,
  "message": "<string>",
  "details": {}
}

{
  "status": 401,
  "message": "<string>",
  "details": {}
}

{
  "status": 404,
  "message": "<string>",
  "details": {}
}

{
  "status": 409,
  "message": "<string>",
  "details": {}
}

{
  "status": 500,
  "message": "<string>",
  "details": {}
}

Authorizations

Authorization

string

header

required

API token authentication using format <api token id>:<api client secret>

Path Parameters

externalAccountId

string

required

The unique identifier of the external account (beneficiary) being untrusted.

Body

application/json

Option 1
Option 2

Confirms trusting or untrusting a beneficiary by submitting the SCA proof. Carries the same proof fields as an ScaAuthorization (code for SMS_OTP / TOTP, or passkeyAssertion + origin for PASSKEY) and, when the start issued one, the challengeId. The beneficiary is identified by the externalAccountId in the path — no separate handle is needed.

code

string | null

required

The one-time code the customer received by SMS, or read from their authenticator app. Provide for SMS_OTP / TOTP. In sandbox, the code is always 123456.

Example:

"123456"

challengeId

string | null

The challenge handle from the trust start's scaChallenge, when one was issued. Omit when the start returned no challenge.

passkeyAssertion

object | null

Opaque WebAuthn assertion produced by the device from the challenge's assertion options. Required when satisfying a PASSKEY challenge.

origin

string | null

The WebAuthn origin the passkeyAssertion was produced against. Required alongside passkeyAssertion; omit it for the code path.

Example:

"https://app.example.com"

Response

Beneficiary untrusted.

The result of a confirm-trust / confirm-untrust call. trusted is true after a successful trust and false after a successful untrust.

trusted

boolean

required

Whether the beneficiary is now trusted. true after a successful trust, false after a successful untrust.

Start untrusting a beneficiary

Authorize a quote's SCA challenge

⌘I

Using the API

API documentation

Confirm untrusting a beneficiary

Authorizations

Path Parameters

Body

Response