ScaAuthorization

{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://raw.githubusercontent.com/api-evangelist/lightspark/main/json-schema/lightspark-sca-authorization-schema.json",
  "title": "ScaAuthorization",
  "description": "Proof that satisfies an `ScaChallenge`. Provide exactly one of `code` (for `SMS_OTP` / `TOTP`) or `passkeyAssertion` (for `PASSKEY`). When supplying a `passkeyAssertion`, `origin` is **required** — the WebAuthn assertion is bound to the origin it was produced against, and a passkey confirmation is rejected without it.",
  "x-generated": "2026-10-12",
  "x-method": "derived",
  "x-generator": "derive-json-schema.py",
  "x-source": "openapi/lightspark-strong-customer-authentication-api-openapi.yml#/components/schemas/ScaAuthorization",
  "type": "object",
  "properties": {
    "code": {
      "type": [
        "string",
        "null"
      ],
      "description": "The one-time code the customer received by SMS, or read from their authenticator app. In sandbox, the code is always `123456`."
    },
    "passkeyAssertion": {
      "type": [
        "object",
        "null"
      ],
      "additionalProperties": true,
      "description": "Opaque WebAuthn assertion produced by the device from the challenge's `passkeyAssertionOptions`. Required when satisfying a `PASSKEY` challenge."
    },
    "origin": {
      "type": [
        "string",
        "null"
      ],
      "description": "The WebAuthn origin the `passkeyAssertion` was produced against. **Required** alongside `passkeyAssertion`; omit it for the `code` path. When the challenge lists `passkeyAllowedOrigins` (enrollment / login challenges), it must be one of those. A per-transaction passkey challenge carries `passkeyAssertionOptions` but may omit `passkeyAllowedOrigins`; in that case supply the origin your app invoked the WebAuthn API from, which must match the relying party in `passkeyAssertionOptions`."
    }
  }
}