---
title: "Confirm or Cancel a business standing order with an OTP"
method: POST
path: "/business/confirm"
tags: ["Business"]
---

# Confirm or Cancel a business standing order with an OTP

`POST /business/confirm`

Confirm or Cancel a business standing order with an OTP (5 attempts allowed). Identical to POST /confirm except the owner is identified by `businessId` instead of `userId`.

## Request body

- BusinessConfirmStandingOrderRequest
  - `businessId` string, uuid, required — Unique ID of the business for whom the standing order is to be confirmed
  - `challengeId` string, uuid, required — The challenge ID linked to this standing order
  - `verificationMethod` 'sms' | 'totp' | 'passkey' — SCA factor used to confirm — must match the factor selected at create/cancel time. Defaults to sms.
  - `verificationCode` string — The one-time code. Required when verificationMethod is sms or totp; omit for passkey.
  - `origin` string — Browser-supplied origin from the WebAuthn ceremony. Required when verificationMethod is passkey.
  - `passkeyAssertion` object — Signed WebAuthn `PublicKeyCredential` returned by `navigator.credentials.get()` for the assertion challenge issued by `PASSKEY_APPROVAL_START`. Required when `verificationMethod` is `passkey`.
    - `id` string
    - `rawId` string
    - `type` string
    - `response` object
      - `clientDataJSON` string
      - `authenticatorData` string
      - `signature` string
      - `userHandle` string
    - `clientExtensionResults` object
      - `appid` string
  - `ip` union, required — The IP address of the business admin at the time of initiating this standing order
    - string, ipv4
    - string, ipv6

## Response `201`

success

- BusinessConfirmStandingOrderResponse
  - `id` string, uuid, required — The unique ID of this standing order
  - `businessId` string, uuid, required — The unique business ID for this standing order
  - `status` 'CANCELLED' | 'ACTIVE' | 'PAUSED', required — The status of this standing order

## Other responses

- `400` — Bad Request. The request was unacceptable, often due to missing a required parameter.
- `401` — Invalid authentication header
- `500` — Unexpected server error.

---

[API](https://skmtc.net/striga/apis/striga-v1.md) · [All operations](https://skmtc.net/striga/apis/striga-v1/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/striga/striga-v1/revisions/63e57aa7df45/schema)