ScaLoginCompleteRequest

{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://raw.githubusercontent.com/api-evangelist/lightspark/main/json-schema/lightspark-sca-login-complete-request-schema.json",
  "title": "ScaLoginCompleteRequest",
  "description": "Completes an SCA login by submitting the proof for the started factor. Carries the same proof fields as an `ScaAuthorization` (`code` for `SMS_OTP` / `TOTP`, or `passkeyAssertion` + `origin` for `PASSKEY`), plus the `factor` being completed and, for `SMS_OTP`, the `challengeId` returned by the login start.",
  "x-generated": "2026-10-12",
  "x-method": "derived",
  "x-generator": "derive-json-schema.py",
  "x-source": "openapi/lightspark-strong-customer-authentication-api-openapi.yml#/components/schemas/ScaLoginCompleteRequest",
  "type": "object",
  "required": [
    "factor"
  ],
  "anyOf": [
    {
      "required": [
        "code"
      ]
    },
    {
      "required": [
        "passkeyAssertion",
        "origin"
      ]
    }
  ],
  "properties": {
    "factor": {
      "$ref": "#/$defs/ScaFactor",
      "description": "The factor being completed; must match the started login."
    },
    "challengeId": {
      "type": [
        "string",
        "null"
      ],
      "description": "The challenge handle returned by the login start, required for `SMS_OTP` and omitted for other factors."
    },
    "code": {
      "type": [
        "string",
        "null"
      ],
      "description": "The one-time code the customer received by SMS, or read from their authenticator app. Provide for `SMS_OTP` / `TOTP`. In sandbox, the code is always `123456`."
    },
    "passkeyAssertion": {
      "type": [
        "object",
        "null"
      ],
      "additionalProperties": true,
      "description": "Opaque WebAuthn assertion produced by the device from the login start's `passkeyOptions`. Required when completing a `PASSKEY` login."
    },
    "origin": {
      "type": [
        "string",
        "null"
      ],
      "description": "The WebAuthn origin the `passkeyAssertion` was produced against (one of the login start's `allowedOrigins`). Required alongside `passkeyAssertion`; omit it for the `code` path."
    }
  },
  "$defs": {
    "ScaFactor": {
      "type": "string",
      "enum": [
        "SMS_OTP",
        "TOTP",
        "PASSKEY"
      ],
      "description": "A Strong Customer Authentication factor.\n\n| Factor | Description |\n|--------|-------------|\n| `SMS_OTP` | One-time code sent by SMS to the customer's verified phone. Requires no prior enrollment. |\n| `TOTP` | Time-based one-time code from an authenticator app. Requires enrollment. Not valid for per-transaction challenges (cannot carry dynamic linking). |\n| `PASSKEY` | WebAuthn passkey assertion. Requires enrollment. |\n"
    }
  }
}