---
title: "Initiate marking an IBAN as Trusted Beneficiary"
method: POST
path: "/wallets/beneficiary/iban/trust"
tags: ["Trusted Beneficiary"]
---

# Initiate marking an IBAN as Trusted Beneficiary

`POST /wallets/beneficiary/iban/trust`

Issues the SCA challenge for the chosen factor (default `sms`). Confirm with `/wallets/beneficiary/confirm-trust`.

## Request body

- object
  - `userId` string, required
  - `whitelistedIbanId` string, required
  - `verificationMethod` 'sms' | 'totp' | 'passkey' — Defaults to `sms` when omitted.

## Response `200`

Challenge issued. The response always carries `verificationMethod` plus the factor-specific fields: `sms` adds `challengeId` and `dateExpires`; `passkey` adds `options`, `allowedOrigins`, and `relyingPartyId`; `totp` adds `ok`.

- object
  - `verificationMethod` 'sms' | 'totp' | 'passkey', required
  - `ok` boolean — Present for `totp`.
  - `challengeId` string — Present for `sms`.
  - `dateExpires` string — Present for `sms`.
  - `options` object — Standard WebAuthn `PublicKeyCredentialRequestOptions`. Base64url-encoded binary fields are passed through to the browser without modification.
    - `challenge` string
    - `timeout` integer
    - `rpId` string
    - `allowCredentials` object[]
      - `type` string
      - `id` string
    - `userVerification` string
  - `allowedOrigins` string[] — Present for `passkey`.
  - `relyingPartyId` string — Present for `passkey`.

## Other responses

- `400` — Request was rejected. The `errorCode` field disambiguates.
- `401` — Invalid API key or HMAC signature.

---

[API](https://skmtc.net/striga/apis/striga-v1.md) · [All operations](https://skmtc.net/striga/apis/striga-v1/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/striga/striga-v1/revisions/63e57aa7df45/schema)