State the SCA proof rule in prose on login-complete and trust-confirm

[shreyav]

ScaLoginCompleteRequest and BeneficiaryTrustConfirmRequest expressed the proof rule as a top-level anyOf of required lists. That causes two problems:

• It states the wrong rule. anyOf means at least one, so a body with both code and passkeyAssertion passes. The server requires exactly one, with origin alongside a passkey.
• It breaks the generated Python client. The generator treats the schema as composed and emits a from_dict that drops every field.

This PR removes the anyOf and states the rule in each description, the way ScaAuthorization already does for the same fields. The server enforces the rule either way, so validation is unchanged for callers.

make build and make lint pass with 0 errors.

🤖 Generated with Claude Code

https://claude.ai/code/session_01KYyhvyVNjMMDrKJqFriCE7

---

Generated by Claude Code

[mintlify]

Preview deployment for your docs. Learn more about Mintlify Previews.

Project	Status	Preview	Updated
Grid	🟢 Ready	View Preview	Sep 24, 2026, 3:01 AM

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

3 Skipped Deployments

Project	Deployment	Actions	Updated
grid-cards-demo	Ignored		Sep 24, 2026 3:00am UTC
grid-flow-builder	Ignored		Sep 24, 2026 3:00am UTC
grid-wallet-demo	Ignored		Sep 24, 2026 3:00am UTC

[github-actions]

⚠️ Breaking OpenAPI changes detected

oasdiff reports 3 error / 0 warning changes to openapi.yaml.
This PR will need approval from an API reviewer before merge.

Errors (3)

• POST /customers/external-accounts/{externalAccountId}/trust/confirm — removed subschema #1, subschema #2 from the request body anyOf list [request-body-any-of-removed].
• POST /customers/external-accounts/{externalAccountId}/untrust/confirm — removed subschema #1, subschema #2 from the request body anyOf list [request-body-any-of-removed].
• POST /sca/login/complete — removed subschema #1, subschema #2 from the request body anyOf list [request-body-any-of-removed].

---

Detected by oasdiff. Full report: job summary or the oasdiff-report artifact.

[greptile-apps]

Confidence Score: 4/5

The contract change appears safe to merge after the non-blocking stale Redocly exceptions are cleaned up.

Findings

1.  Stale lint suppressions remain ▶

Fix with agent prompt

### Issue 1
openapi/components/schemas/sca/ScaLoginCompleteRequest.yaml:6-7
Removing these `anyOf` branches leaves six obsolete exceptions for `ScaLoginCompleteRequest` and `BeneficiaryTrustConfirmRequest`, along with their explanatory comment, in `.redocly.lint-ignore.yaml`. Please remove those entries with this schema change so the lint configuration continues to describe real, intentional exceptions instead of accumulating dead suppressions.

Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

Summary

This PR replaces composed proof requirements on SCA login completion and beneficiary trust confirmation with prose matching the existing ScaAuthorization convention. This preserves generated-client fields while documenting that callers must provide exactly one proof and include origin with passkey assertions.

• Updates both modular SCA request schemas.
• Regenerates the root and Mintlify OpenAPI bundles consistently.
• Leaves obsolete Redocly suppression entries that should be removed.

_{Reviews (1) · Last reviewed commit: "State the SCA proof rule in prose on log..."}

[greptile-apps]

Stale lint suppressions remain

Removing these anyOf branches leaves six obsolete exceptions for ScaLoginCompleteRequest and BeneficiaryTrustConfirmRequest, along with their explanatory comment, in .redocly.lint-ignore.yaml. Please remove those entries with this schema change so the lint configuration continues to describe real, intentional exceptions instead of accumulating dead suppressions.

Knowledge Base Used: Contract validation workflows

Prompt To Fix With AI

This is a comment left during a code review.
Path: openapi/components/schemas/sca/ScaLoginCompleteRequest.yaml
Line: 6-7

Comment:
**Stale lint suppressions remain**

Removing these `anyOf` branches leaves six obsolete exceptions for `ScaLoginCompleteRequest` and `BeneficiaryTrustConfirmRequest`, along with their explanatory comment, in `.redocly.lint-ignore.yaml`. Please remove those entries with this schema change so the lint configuration continues to describe real, intentional exceptions instead of accumulating dead suppressions.

**Knowledge Base Used:** [Contract validation workflows](https://app.greptile.com/lightspark/-/custom-context/knowledge-base/lightsparkdev/grid-api/-/docs/contract-validation-workflows.md)

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!

[shreyav]

Merge activity

• Sep 24, 4:32 AM UTC: A user started a stack merge that includes this pull request via Graphite.
• Sep 24, 4:32 AM UTC: @shreyav merged this pull request with Graphite.