---
title: "Mark an IBAN as Trusted Beneficiary (business)"
method: POST
path: "/business/beneficiary/iban/trust"
tags: ["Business Trusted Beneficiary"]
---

# Mark an IBAN as Trusted Beneficiary (business)

`POST /business/beneficiary/iban/trust`

Single-call TOTP-confirmed trust for a business. Unlike the consumer two-step initiate→confirm flow, the business endpoint verifies the supplied `totpCode` and applies the trust in a single request. The IBAN must already be whitelisted and activated, otherwise the request is rejected with `30073`.

## Request body

- object
  - `businessId` string, uuid, required
  - `whitelistedIbanId` string, uuid, required
  - `totpCode` string, required — 6–8 character TOTP or recovery code, verified at the time of the request.

## Response `200`

Trust applied.

- object
  - `ok` boolean, required

## Other responses

- `400` — Request was rejected. The `errorCode` field disambiguates.
- `401` — Invalid API key or HMAC signature.

---

[API](https://skmtc.net/striga/apis/striga-v1.md) · [All operations](https://skmtc.net/striga/apis/striga-v1/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/striga/striga-v1/revisions/63e57aa7df45/schema)