---
title: "Confirm untrusting a beneficiary"
method: POST
path: "/customers/external-accounts/{externalAccountId}/untrust/confirm"
tags: ["Strong Customer Authentication"]
---

# Confirm untrusting a beneficiary

`POST /customers/external-accounts/{externalAccountId}/untrust/confirm`

Finalize untrusting a beneficiary (identified by the `externalAccountId` in
the path) by submitting the SCA proof (`code` for `SMS_OTP` / `TOTP`, or
`passkeyAssertion` + `origin` for `PASSKEY`), echoing the `challengeId` when
one was issued. Returns `trusted: false`.

This endpoint is only meaningful for customers in a region where SCA is required (e.g. EU). For customers outside SCA-regulated regions, this returns `409`.

In sandbox, the SMS/TOTP code is always `123456`.

## Request body

- union — Confirms trusting or untrusting a beneficiary by submitting the SCA proof. Carries the same proof fields as an `ScaAuthorization` (`code` for `SMS_OTP` / `TOTP`, or `passkeyAssertion` + `origin` for `PASSKEY`) and, when the start issued one, the `challengeId`. The beneficiary is identified by the `externalAccountId` in the path — no separate handle is needed.
  - object
    - `challengeId` string, nullable — The challenge handle from the trust start's `scaChallenge`, when one was issued. Omit when the start returned no challenge.
    - `code` string, nullable, required — The one-time code the customer received by SMS, or read from their authenticator app. Provide for `SMS_OTP` / `TOTP`. In sandbox, the code is always `123456`.
    - `passkeyAssertion` object, nullable — Opaque WebAuthn assertion produced by the device from the challenge's assertion options. Required when satisfying a `PASSKEY` challenge.
    - `origin` string, nullable — The WebAuthn origin the `passkeyAssertion` was produced against. Required alongside `passkeyAssertion`; omit it for the `code` path.
  - object
    - `challengeId` string, nullable — The challenge handle from the trust start's `scaChallenge`, when one was issued. Omit when the start returned no challenge.
    - `code` string, nullable — The one-time code the customer received by SMS, or read from their authenticator app. Provide for `SMS_OTP` / `TOTP`. In sandbox, the code is always `123456`.
    - `passkeyAssertion` object, nullable, required — Opaque WebAuthn assertion produced by the device from the challenge's assertion options. Required when satisfying a `PASSKEY` challenge.
    - `origin` string, nullable, required — The WebAuthn origin the `passkeyAssertion` was produced against. Required alongside `passkeyAssertion`; omit it for the `code` path.

## Response `200`

Beneficiary untrusted.

- BeneficiaryTrustConfirm — The result of a confirm-trust / confirm-untrust call. `trusted` is `true` after a successful trust and `false` after a successful untrust.
  - `trusted` boolean, required — Whether the beneficiary is now trusted. `true` after a successful trust, `false` after a successful untrust.

## Other responses

- `400` — Invalid or expired proof
- `401` — Unauthorized
- `404` — Customer or external account not found
- `409` — SCA is not required for this customer.
- `500` — Internal service error

---

[API](https://skmtc.net/stainless-api/apis/grid-api.md) · [All operations](https://skmtc.net/stainless-api/apis/grid-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/stainless-api/grid-api/versions/151f2d9bad9c/schema)