Confirm or Cancel a standing order with an OTP

post

https://www.sandbox.striga.com/api/v1/standing-orders/confirm

Confirm or Cancel a standing order with an OTP. (5 attempts allowed)

This single endpoint confirms every standing-order operation — the verified challengeId itself determines what happens: confirming a per-account create (from /create), a cancellation (from /cancel), or a wallet-level unified create (from /wallet-create). The response shape varies accordingly (see the oneOf below).

SCA-enabled applications: the required body fields depend on the verificationMethod chosen at create/cancel time. sms and totp send the verificationCode; passkey sends origin + passkeyAssertion after running PASSKEY_APPROVAL_START against this challengeId.

Recent Requests

Time	Status	User Agent
Retrieving recent requests…

Loading…

Body Params

userId

uuid

required

Unique ID of the user for whom the standing order is to be confirmed

challengeId

uuid

required

The challenge ID linked to this standing order

verificationMethod

string

enum

Defaults to sms

SCA factor used to confirm — must match the factor selected at create/cancel time. Defaults to sms when omitted. sms and totp require verificationCode; passkey requires origin + passkeyAssertion (run PASSKEY_APPROVAL_START against this challengeId first to obtain the assertion challenge).

Allowed:

verificationCode

string

The one-time code. Required when verificationMethod is sms or totp; omit for passkey.

origin

string

Browser-supplied origin from the WebAuthn ceremony (e.g. https://app.example.com). Required when verificationMethod is passkey. Must match an entry in the application's webAuthn.allowedOrigins.

passkeyAssertion

object

Signed WebAuthn PublicKeyCredential returned by navigator.credentials.get() for the assertion challenge issued by PASSKEY_APPROVAL_START. Required when verificationMethod is passkey.

string

required

The IP address of the user at the time of initiating this standing order

Responses

201success

400Bad Request. The request was unacceptable, often due to missing a required parameter.

401Invalid authentication header

500Unexpected server error.