Approve an authentication

POST 
/v1/authentications/:authentication_id/approve

Tells the Access Control Server the cardholder proved who they are, and releases the merchant's checkout to continue.

Call it only after a step-up on the device, immediately before: a biometric or the device passcode. An application that approves because it happens to be unlocked has removed the authentication rather than moved it.

Answer once. A second answer under a different Idempotency-Key returns 422 authentication_not_pending.

Requires the authentications:write scope.

Request

Responses

200

The authentication, now approved.

403

Credentials are valid but not permitted. Do not retry.

404

The resource does not exist, or belongs to another organization. The two are deliberately indistinguishable.

422

Well-formed but fails a business rule.