v5

OpenAPI 3.1.0Proprietary2026-08-011476181.4 MB

Strong Customer Authentication

Record a security event

Record a client-side security-relevant event for the customer with Grid's risk engine (e.g. a sign-in, a sensitive view), to feed adaptive-authentication signals.

This endpoint is only meaningful for customers in a region where SCA is required (e.g. EU). For customers outside SCA-regulated regions, this returns 409.

post/sca/record-event

Request body

eventType'RESET_PASSWORD_COMPLETED' | 'FAILED_LOGIN_ATTEMPT' required

The security event to record:

Value	Effect
RESET_PASSWORD_COMPLETED	Revokes every active SCA session for the customer and clears the failed-login counter.
FAILED_LOGIN_ATTEMPT	Increments the cumulative failed-login counter and escalates the lockout at each milestone: 5 attempts → 15 minutes, 6 → 30 minutes, 7 → 1 hour, 8 → 24 hours, 9 or more → suspension.

Example request

{
  "eventType": "FAILED_LOGIN_ATTEMPT"
}

Response

Event recorded; the customer's resulting login-security state is returned (including any lockout).

eventType'RESET_PASSWORD_COMPLETED' | 'FAILED_LOGIN_ATTEMPT' required

The event that was recorded.

suspendedboolean required

Whether the customer's login is currently suspended (locked with no automatic expiry). A suspended customer must go through a password reset (RESET_PASSWORD_COMPLETED) to clear the lockout.

lockedUntilstring date-time nullable

When the customer may attempt to log in again, if temporarily locked. Null when not locked, or when suspended is true (no automatic expiry).

failedAttemptsinteger required

The customer's current cumulative failed-login count.

Example response

{
  "eventType": "FAILED_LOGIN_ATTEMPT",
  "lockedUntil": "2025-10-03T12:15:00Z",
  "failedAttempts": 5
}