ScaLoginStart

{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://raw.githubusercontent.com/api-evangelist/lightspark/main/json-schema/lightspark-sca-login-start-schema.json",
  "title": "ScaLoginStart",
  "description": "The factor-specific material a customer needs to complete an SCA login. Each factor surfaces only the fields it issues: `SMS_OTP` carries `challengeId` and `expiresAt`; `TOTP` carries neither (the customer reads the code from their authenticator app); `PASSKEY` carries the opaque WebAuthn `passkeyOptions` with `allowedOrigins` and `relyingPartyId`.",
  "x-generated": "2026-10-12",
  "x-method": "derived",
  "x-generator": "derive-json-schema.py",
  "x-source": "openapi/lightspark-strong-customer-authentication-api-openapi.yml#/components/schemas/ScaLoginStart",
  "type": "object",
  "required": [
    "factor"
  ],
  "properties": {
    "factor": {
      "$ref": "#/$defs/ScaFactor",
      "description": "The factor this login was started for."
    },
    "challengeId": {
      "type": [
        "string",
        "null"
      ],
      "description": "The challenge handle for an `SMS_OTP` login, threaded back on the complete call. Present only for `SMS_OTP`."
    },
    "expiresAt": {
      "type": [
        "string",
        "null"
      ],
      "format": "date-time",
      "description": "Absolute UTC timestamp after which the `SMS_OTP` code expires. Present only for `SMS_OTP`."
    },
    "passkeyOptions": {
      "type": [
        "object",
        "null"
      ],
      "additionalProperties": true,
      "description": "Opaque WebAuthn assertion request options. Present only for `PASSKEY`; pass to the device's WebAuthn API to produce the assertion submitted on the complete call."
    },
    "allowedOrigins": {
      "type": [
        "array",
        "null"
      ],
      "items": {
        "type": "string"
      },
      "description": "The origins the WebAuthn ceremony may run against. Present only for `PASSKEY`."
    },
    "relyingPartyId": {
      "type": [
        "string",
        "null"
      ],
      "description": "The WebAuthn relying-party id. Present only for `PASSKEY`."
    }
  },
  "$defs": {
    "ScaFactor": {
      "type": "string",
      "enum": [
        "SMS_OTP",
        "TOTP",
        "PASSKEY"
      ],
      "description": "A Strong Customer Authentication factor.\n\n| Factor | Description |\n|--------|-------------|\n| `SMS_OTP` | One-time code sent by SMS to the customer's verified phone. Requires no prior enrollment. |\n| `TOTP` | Time-based one-time code from an authenticator app. Requires enrollment. Not valid for per-transaction challenges (cannot carry dynamic linking). |\n| `PASSKEY` | WebAuthn passkey assertion. Requires enrollment. |\n"
    }
  }
}