BeneficiaryTrustConfirmRequest

{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://raw.githubusercontent.com/api-evangelist/lightspark/main/json-schema/lightspark-beneficiary-trust-confirm-request-schema.json",
  "title": "BeneficiaryTrustConfirmRequest",
  "description": "Confirms trusting or untrusting a beneficiary by submitting the SCA proof. Carries the same proof fields as an `ScaAuthorization` (`code` for `SMS_OTP` / `TOTP`, or `passkeyAssertion` + `origin` for `PASSKEY`) and, when the start issued one, the `challengeId`. The beneficiary is identified by the `externalAccountId` in the path — no separate handle is needed.",
  "x-generated": "2026-10-12",
  "x-method": "derived",
  "x-generator": "derive-json-schema.py",
  "x-source": "openapi/lightspark-strong-customer-authentication-api-openapi.yml#/components/schemas/BeneficiaryTrustConfirmRequest",
  "type": "object",
  "anyOf": [
    {
      "required": [
        "code"
      ]
    },
    {
      "required": [
        "passkeyAssertion",
        "origin"
      ]
    }
  ],
  "properties": {
    "challengeId": {
      "type": [
        "string",
        "null"
      ],
      "description": "The challenge handle from the trust start's `scaChallenge`, when one was issued. Omit when the start returned no challenge."
    },
    "code": {
      "type": [
        "string",
        "null"
      ],
      "description": "The one-time code the customer received by SMS, or read from their authenticator app. Provide for `SMS_OTP` / `TOTP`. In sandbox, the code is always `123456`."
    },
    "passkeyAssertion": {
      "type": [
        "object",
        "null"
      ],
      "additionalProperties": true,
      "description": "Opaque WebAuthn assertion produced by the device from the challenge's assertion options. Required when satisfying a `PASSKEY` challenge."
    },
    "origin": {
      "type": [
        "string",
        "null"
      ],
      "description": "The WebAuthn origin the `passkeyAssertion` was produced against. Required alongside `passkeyAssertion`; omit it for the `code` path."
    }
  }
}