POST /api/v1/step-up-attempts/{attempt_id}

Start in Observe on one route. Use the deployment URL and installed package version supplied for your workspace. Historical host examples and source capabilities do not establish a live service or published release.

Endpoint

POST https://gate.x-lock.dev/api/v1/step-up-attempts/{attempt_id}

Description

When locked hosted validation returns action: "step_up", MANDATE may include

a stepUpAttemptId. Your application owns the actual MFA, passkey, email,

payment verification, support review, or custom workflow. This endpoint only

records the terminal aggregate outcome so dashboard reporting can show whether

requested step-ups completed, failed, or were bypassed.

It is server-to-server only. Do not call it from browser JavaScript, and do not

send identity proof data or raw request material.

Request

Content-Type: application/json

Authorization: Bearer mak_... with tokens:validate scope

{
  "status": "completed"
}

Response

Content-Type: application/json

Success (200)

{
  "id": "b3b0d225-86c7-4e3f-8d38-10b9ea6f17f0",
  "site_key_id": "8bd93e33-6f46-4c28-9c06-7e9d4b0a8891",
  "status": "completed",
  "kind": "mfa",
  "route": "/checkout",
  "route_class": "high",
  "completed_at": "2026-06-28T07:12:24Z",
  "updated_at": "2026-06-28T07:12:24Z"
}

Only attempts currently in requested state can transition. Repeating a

terminal update returns 404 because there is no mutable pending attempt left

for that organization.

Error (400/401/403/404)

{
  "error": "step-up attempt not found"
}