---
title: "Enroll a User in SCA"
method: POST
path: "/v2.01/{ClientId}/sca/users/{UserId}/enrollment"
tags: ["Users"]
---

# Enroll a User in SCA

`POST /v2.01/{ClientId}/sca/users/{UserId}/enrollment`

Obtain an SCA redirection link to enroll an Owner user.

If `UserCategory` is `OWNER`, this endpoint allows you to enroll a user in SCA. To enroll `PAYER` users for the first time, use the [PUT Categorize a Natural User](/api-reference/users/categorize-natural-user) or [PUT Categorize a Legal User](/api-reference/users/categorize-legal-user) endpoints.

Your platform needs to retrieve the returned `PendingUserAction.RedirectUrl`, add an encoded `returnUrl` query parameter for them to be returned to after the SCA session, and redirect the user.

[Read more about SCA redirection](/guides/sca/session) **→**

You can use this endpoint to obtain a new session `RedirectUrl`. This is useful to: 
- Enroll Owners created without SCA enrollment
- Retry enrollment if a previous session was unsuccessful or expired (after 10 minutes)

Calling this endpoint creates a new valid session that can be used, even if there is one already in progress for the user. Calling this endpoint also doesn't change the user's `UserStatus`, even if the session expires or is unsuccessful.

<Note icon="fa-regular fa-circle-info">
**Note – This endpoint doesn't change UserStatus**

Calling this endpoint does **not** change the user's status to `PENDING_USER_ACTION` (it stays as `ACTIVE`) and no `USER_ACCOUNT_VALIDATION_ASKED` webhook notification is sent.

This ensures that legacy users do not become blocked if they are unable to complete SCA successfully.
</Note>

<Warning icon="fa-regular fa-triangle-exclamation">
**Caution – Legal representative's email required**

For `OWNER` users, the `LegalRepresentative.Email` address is required.

SCA uses this email address to build a [behavioral biometrics profile](/guides/sca/factors#email-confirmation-behavioral-biometrics) and as a backup communication channel.

Prior to SCA, it was possible to create a Legal `OWNER` without the `LegalRepresentativeEmail`, so this data may be missing. Calling this endpoint without this data will return an error.
</Warning>

## Path parameters

- `ClientId` string, required
- `UserId` string, required

## Headers

- `Authorization` string, required

## Response `200`

Success

- EnrollUserManageProxyConsentResponse
  - `PendingUserAction` PendingUserAction — Object containing the `RedirectUrl` needed for SCA redirection if triggered by the API call (otherwise returned `null`).
    - `RedirectUrl` string — The URL to which to redirect the user to perform strong customer authentication (SCA) via a Mangopay-hosted webpage. This value is a variable and should not be hardcoded. The SCA session link expires 10 minutes after it's generated. **Caution:** Before redirecting the user on this URL, you must add the query parameter `ReturnUrl` with the percent-encoded URL to which you want the SCA session to return the user after authentication (whether successful or not). For more details, see [How to redirect a user for an SCA session](/guides/sca/session#how-to-redirect-a-user-for-sca).

## Other responses

- `400` — Bad Request

---

[API](https://skmtc.net/mangopay/apis/api-reference.md) · [All operations](https://skmtc.net/mangopay/apis/api-reference/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/mangopay/api-reference/versions/795281070285/schema)