feat(sca): add SCA management surface (enrollment, login, trust, reset)

Stacks on the per-transaction SCA spec (#558) and adds the remaining
Strong Customer Authentication surfaces an EU (Striga) partner needs, mirroring
the sparkcore handlers' exact routes + JSON shapes. All endpoints are EU-only
(409 for providers that don't require SCA).

- Factor enrollment: TOTP start/confirm, passkey register start/confirm,
  list factors, delete passkey.
- SCA login / 180-day session: login start/complete, plus record-event.
- Beneficiary trust: trust start (issues the SCA challenge + whitelistedId),
  trust/confirm and untrust/confirm (the whitelisting exemption that lets
  recurring payees skip per-transaction SCA).
- 2FA reset: initiate (201) -> poll status -> complete.

Reuses ScaFactor/ScaChallenge/ScaAuthorization from #558. Confirm/login bodies
carry the code|passkeyAssertion+origin proof; beneficiary confirm threads the
whitelistedId back so confirm never re-whitelists.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: jklein24

mintlify/openapi.yaml

@@ -0,0 +1,12 @@
+type: object
+description: >-
+  The result of a confirm-trust / confirm-untrust call. `trusted` is `true`
+  after a successful trust and `false` after a successful untrust.
+required:
+  - trusted
+properties:
+  trusted:
+    type: boolean
+    description: >-
+      Whether the beneficiary is now trusted. `true` after a successful trust,
+      `false` after a successful untrust.

openapi.yaml

@@ -0,0 +1,47 @@
+type: object
+description: >-
+  Confirms trusting or untrusting a beneficiary by submitting the SCA proof.
+  Carries the same proof fields as an `ScaAuthorization` (`code` for `SMS_OTP` /
+  `TOTP`, or `passkeyAssertion` + `origin` for `PASSKEY`), plus the
+  `whitelistedId` returned by the trust start and, when the start issued one,
+  the `challengeId`.
+required:
+  - whitelistedId
+properties:
+  whitelistedId:
+    type: string
+    description: >-
+      The provider beneficiary handle returned as `whitelistedId` by the trust
+      start, threaded back so confirm need not re-whitelist.
+  challengeId:
+    type:
+      - string
+      - 'null'
+    description: >-
+      The challenge handle from the trust start's `scaChallenge`, when one was
+      issued. Omit when the start returned no challenge.
+  code:
+    type:
+      - string
+      - 'null'
+    description: >-
+      The one-time code the customer received by SMS, or read from their
+      authenticator app. Provide for `SMS_OTP` / `TOTP`. In sandbox, the code is
+      always `123456`.
+    example: '123456'
+  passkeyAssertion:
+    type:
+      - object
+      - 'null'
+    additionalProperties: true
+    description: >-
+      Opaque WebAuthn assertion produced by the device from the challenge's
+      assertion options. Required when satisfying a `PASSKEY` challenge.
+  origin:
+    type:
+      - string
+      - 'null'
+    description: >-
+      The WebAuthn origin the `passkeyAssertion` was produced against. Required
+      alongside `passkeyAssertion`; omit it for the `code` path.
+    example: https://app.example.com

openapi/components/schemas/sca/BeneficiaryTrustConfirm.yaml

@@ -0,0 +1,21 @@
+type: object
+description: >-
+  The provider handle plus the SCA challenge a caller authorizes to finish
+  trusting (or untrusting) a beneficiary. `whitelistedId` is the provider's
+  beneficiary handle; thread it back on the confirm call so confirm need not
+  re-whitelist (which could trigger a second challenge). `scaChallenge` is
+  omitted when the provider does not surface one on the whitelist response; the
+  caller then confirms without a `challengeId`.
+required:
+  - whitelistedId
+properties:
+  whitelistedId:
+    type: string
+    description: >-
+      The provider's beneficiary (whitelist) handle. Thread it back on the
+      confirm call.
+  scaChallenge:
+    $ref: ./ScaChallenge.yaml
+    description: >-
+      The SCA challenge to satisfy on the confirm call. Omitted when the
+      provider issues no challenge on the whitelist response.

openapi/components/schemas/sca/BeneficiaryTrustConfirmRequest.yaml

@@ -0,0 +1,20 @@
+type: object
+description: >-
+  The WebAuthn credential a device produced for a passkey registration
+  challenge, submitted to enroll the passkey factor.
+required:
+  - origin
+  - credential
+properties:
+  origin:
+    type: string
+    description: >-
+      The WebAuthn origin the `credential` was produced against (one of the
+      enrollment start's `allowedOrigins`).
+    example: https://app.example.com
+  credential:
+    type: object
+    additionalProperties: true
+    description: >-
+      Opaque WebAuthn credential the device produced from the enrollment start's
+      `options`.

openapi/components/schemas/sca/BeneficiaryTrustStart.yaml

@@ -0,0 +1,7 @@
+type: object
+description: The enrolled passkey factor returned after a successful confirmation.
+required:
+  - factor
+properties:
+  factor:
+    $ref: ./ScaFactorView.yaml

openapi/components/schemas/sca/PasskeyEnrollmentConfirmRequest.yaml

@@ -0,0 +1,31 @@
+type: object
+description: >-
+  Opaque WebAuthn registration options relayed to the end user's device to
+  enroll a passkey factor. Grid performs no crypto; pass `options` to the
+  device's WebAuthn API to produce a credential, then submit that credential to
+  the confirm endpoint unmodified.
+required:
+  - options
+  - allowedOrigins
+  - relyingPartyId
+properties:
+  options:
+    type: object
+    additionalProperties: true
+    description: >-
+      Opaque WebAuthn `PublicKeyCredentialCreationOptions`. Pass to the device's
+      WebAuthn registration API unmodified.
+  allowedOrigins:
+    type: array
+    description: >-
+      The origins the WebAuthn registration ceremony may run against. The origin
+      the credential is produced against must be one of these and must be echoed
+      back on the confirm call.
+    items:
+      type: string
+    example:
+      - https://app.example.com
+  relyingPartyId:
+    type: string
+    description: The WebAuthn relying-party id the credential is bound to.
+    example: app.example.com

openapi/components/schemas/sca/PasskeyEnrollmentConfirmResponse.yaml

@@ -0,0 +1,12 @@
+type: object
+description: >-
+  Records a client-side security-relevant event for the customer with the
+  underlying provider's risk engine (e.g. a sign-in, a sensitive view). Used to
+  feed the provider's adaptive-authentication signals.
+required:
+  - eventType
+properties:
+  eventType:
+    type: string
+    description: The provider-defined event type to record.
+    example: LOGIN

openapi/components/schemas/sca/PasskeyEnrollmentStart.yaml

@@ -0,0 +1,10 @@
+type: object
+description: The Strong Customer Authentication factors a customer has enrolled.
+required:
+  - factors
+properties:
+  factors:
+    type: array
+    description: The customer's enrolled SCA factors.
+    items:
+      $ref: ./ScaFactorView.yaml