From 065e823060dd8c595cac64621096f91eae4b981b Mon Sep 17 00:00:00 2001 From: Jeremy Date: Wed, 29 Jul 2026 05:39:08 +0000 Subject: [PATCH] feat: document SCA_SESSION_REQUIRED (409) and ACCOUNT_LOCKED (423) on quote authorize --- mintlify/openapi.yaml | 10 +++++++++- openapi.yaml | 10 +++++++++- openapi/components/schemas/errors/Error409.yaml | 2 ++ .../paths/quotes/quotes_{quoteId}_authorize.yaml | 13 ++++++++++++- 4 files changed, 32 insertions(+), 3 deletions(-) diff --git a/mintlify/openapi.yaml b/mintlify/openapi.yaml index 0ae3a6da0..25dd5f3f7 100644 --- a/mintlify/openapi.yaml +++ b/mintlify/openapi.yaml @@ -3891,11 +3891,17 @@ paths: schema: $ref: '#/components/schemas/Error404' '409': - description: SCA is not required for this customer, or the quote has no pending challenge to authorize. + description: SCA is not required for this customer, or the quote has no pending challenge to authorize. Also returned with `SCA_SESSION_REQUIRED` when the customer's SCA login session is missing or expired — re-authenticate the customer, then authorize again. content: application/json: schema: $ref: '#/components/schemas/Error409' + '423': + description: Returned with `ACCOUNT_LOCKED` when the customer's login is temporarily locked after too many failed authorization attempts. The customer must wait for the lock to expire before authorizing again. + content: + application/json: + schema: + $ref: '#/components/schemas/Error423' '429': description: Too many requests. Returned with `RATE_LIMITED` when authorization attempts for this challenge happen too frequently (for example, repeated bad codes brute-forcing the OTP). The challenge may be invalidated after too many failed attempts. Clients should back off and retry after the interval indicated by the `Retry-After` response header. content: @@ -12580,6 +12586,7 @@ components: | EMAIL_OTP_EMAIL_ALREADY_EXISTS | Email address is already associated with an EMAIL_OTP credential | | EMAIL_OTP_CREDENTIAL_SET_CHANGED | Tied EMAIL_OTP credential set changed after the signed-retry challenge was issued | | PASSKEY_ALREADY_ENROLLED | The customer already has an enrolled passkey factor; only one passkey per customer is supported. Delete the existing one before enrolling another | + | SCA_SESSION_REQUIRED | The customer's Strong Customer Authentication login session is missing or expired. Re-authenticate the customer, then retry the request. Distinct from a `401`, which means the platform's own API credentials were rejected | | CONFLICT | Generic resource-state conflict. Returned, for example, when `platformCustomerId` on a customer create call collides with an existing active customer on the same platform | enum: - TRANSACTION_NOT_PENDING_PLATFORM_APPROVAL @@ -12588,6 +12595,7 @@ components: - EMAIL_OTP_EMAIL_ALREADY_EXISTS - EMAIL_OTP_CREDENTIAL_SET_CHANGED - PASSKEY_ALREADY_ENROLLED + - SCA_SESSION_REQUIRED - CONFLICT message: type: string diff --git a/openapi.yaml b/openapi.yaml index 0ae3a6da0..25dd5f3f7 100644 --- a/openapi.yaml +++ b/openapi.yaml @@ -3891,11 +3891,17 @@ paths: schema: $ref: '#/components/schemas/Error404' '409': - description: SCA is not required for this customer, or the quote has no pending challenge to authorize. + description: SCA is not required for this customer, or the quote has no pending challenge to authorize. Also returned with `SCA_SESSION_REQUIRED` when the customer's SCA login session is missing or expired — re-authenticate the customer, then authorize again. content: application/json: schema: $ref: '#/components/schemas/Error409' + '423': + description: Returned with `ACCOUNT_LOCKED` when the customer's login is temporarily locked after too many failed authorization attempts. The customer must wait for the lock to expire before authorizing again. + content: + application/json: + schema: + $ref: '#/components/schemas/Error423' '429': description: Too many requests. Returned with `RATE_LIMITED` when authorization attempts for this challenge happen too frequently (for example, repeated bad codes brute-forcing the OTP). The challenge may be invalidated after too many failed attempts. Clients should back off and retry after the interval indicated by the `Retry-After` response header. content: @@ -12580,6 +12586,7 @@ components: | EMAIL_OTP_EMAIL_ALREADY_EXISTS | Email address is already associated with an EMAIL_OTP credential | | EMAIL_OTP_CREDENTIAL_SET_CHANGED | Tied EMAIL_OTP credential set changed after the signed-retry challenge was issued | | PASSKEY_ALREADY_ENROLLED | The customer already has an enrolled passkey factor; only one passkey per customer is supported. Delete the existing one before enrolling another | + | SCA_SESSION_REQUIRED | The customer's Strong Customer Authentication login session is missing or expired. Re-authenticate the customer, then retry the request. Distinct from a `401`, which means the platform's own API credentials were rejected | | CONFLICT | Generic resource-state conflict. Returned, for example, when `platformCustomerId` on a customer create call collides with an existing active customer on the same platform | enum: - TRANSACTION_NOT_PENDING_PLATFORM_APPROVAL @@ -12588,6 +12595,7 @@ components: - EMAIL_OTP_EMAIL_ALREADY_EXISTS - EMAIL_OTP_CREDENTIAL_SET_CHANGED - PASSKEY_ALREADY_ENROLLED + - SCA_SESSION_REQUIRED - CONFLICT message: type: string diff --git a/openapi/components/schemas/errors/Error409.yaml b/openapi/components/schemas/errors/Error409.yaml index 6567f779f..f7746d76c 100644 --- a/openapi/components/schemas/errors/Error409.yaml +++ b/openapi/components/schemas/errors/Error409.yaml @@ -20,6 +20,7 @@ properties: | EMAIL_OTP_EMAIL_ALREADY_EXISTS | Email address is already associated with an EMAIL_OTP credential | | EMAIL_OTP_CREDENTIAL_SET_CHANGED | Tied EMAIL_OTP credential set changed after the signed-retry challenge was issued | | PASSKEY_ALREADY_ENROLLED | The customer already has an enrolled passkey factor; only one passkey per customer is supported. Delete the existing one before enrolling another | + | SCA_SESSION_REQUIRED | The customer's Strong Customer Authentication login session is missing or expired. Re-authenticate the customer, then retry the request. Distinct from a `401`, which means the platform's own API credentials were rejected | | CONFLICT | Generic resource-state conflict. Returned, for example, when `platformCustomerId` on a customer create call collides with an existing active customer on the same platform | enum: - TRANSACTION_NOT_PENDING_PLATFORM_APPROVAL @@ -28,6 +29,7 @@ properties: - EMAIL_OTP_EMAIL_ALREADY_EXISTS - EMAIL_OTP_CREDENTIAL_SET_CHANGED - PASSKEY_ALREADY_ENROLLED + - SCA_SESSION_REQUIRED - CONFLICT message: type: string diff --git a/openapi/paths/quotes/quotes_{quoteId}_authorize.yaml b/openapi/paths/quotes/quotes_{quoteId}_authorize.yaml index 13c6bfd8a..816424136 100644 --- a/openapi/paths/quotes/quotes_{quoteId}_authorize.yaml +++ b/openapi/paths/quotes/quotes_{quoteId}_authorize.yaml @@ -64,11 +64,22 @@ post: '409': description: >- SCA is not required for this customer, or the quote has - no pending challenge to authorize. + no pending challenge to authorize. Also returned with + `SCA_SESSION_REQUIRED` when the customer's SCA login session is missing + or expired — re-authenticate the customer, then authorize again. content: application/json: schema: $ref: ../../components/schemas/errors/Error409.yaml + '423': + description: >- + Returned with `ACCOUNT_LOCKED` when the customer's login is temporarily + locked after too many failed authorization attempts. The customer must + wait for the lock to expire before authorizing again. + content: + application/json: + schema: + $ref: ../../components/schemas/errors/Error423.yaml '429': description: >- Too many requests. Returned with `RATE_LIMITED` when authorization