feat(sca): return the session expiry and require an end-user IP on SCA login complete

openapi/components/schemas/sca/ScaAuthorization.yaml

@@ -35,3 +35,14 @@ properties:
       that case supply the origin your app invoked the WebAuthn API from, which
       must match the relying party in `passkeyAssertionOptions`.
     example: https://app.example.com
+  endUserIpAddress:
+    type:
+      - string
+      - 'null'
+    description: >-
+      The IP address of the end user's device authorizing this operation,
+      forwarded to the SCA provider where it feeds risk assessment and any
+      transaction-risk exemption. Supply the customer's address, not your
+      server's. Optional: the provider records it for money-movement
+      authorizations, and ignores it for beneficiary trust changes.
+    example: 203.0.113.42

openapi/components/schemas/sca/ScaLoginComplete.yaml

@@ -6,8 +6,19 @@ properties:
   status:
     type: string
     description: >-
-      The status of the login session, passed through
-      verbatim (Grid does not normalize it). A successful login reports
-      `SUCCESS`; other values indicate the login did not
-      complete and should be surfaced to the caller.
+      The status of the login session. A successful login reports `SUCCESS`;
+      other values indicate the login did not complete and should be surfaced
+      to the caller.
     example: SUCCESS
+  sessionExpiresAt:
+    type:
+      - string
+      - 'null'
+    format: date-time
+    description: >-
+      Absolute UTC timestamp after which the customer's SCA session is no longer
+      valid and they must complete another SCA login. Money movement in
+      SCA-regulated currencies is refused once it passes, so prompt a re-login
+      ahead of it rather than waiting for a `SCA_SESSION_REQUIRED` failure.
+      Present when the login established a session.
+    example: '2026-01-29T12:00:00Z'

openapi/components/schemas/sca/ScaLoginCompleteRequest.yaml

@@ -3,9 +3,11 @@ description: >-
   Completes an SCA login by submitting the proof for the started factor. Carries
   the same proof fields as an `ScaAuthorization` (`code` for `SMS_OTP` / `TOTP`,
   or `passkeyAssertion` + `origin` for `PASSKEY`), plus the `factor` being
-  completed and, for `SMS_OTP`, the `challengeId` returned by the login start.
+  completed, the `endUserIpAddress` the login is being performed from, and, for
+  `SMS_OTP`, the `challengeId` returned by the login start.
 required:
   - factor
+  - endUserIpAddress
 anyOf:
   - required:
       - code
@@ -16,6 +18,14 @@ properties:
   factor:
     $ref: ./ScaFactor.yaml
     description: The factor being completed; must match the started login.
+  endUserIpAddress:
+    type: string
+    description: >-
+      The IP address of the end user's device completing this login, recorded
+      against the login event by the SCA provider. Supply the customer's
+      address, not your server's — it feeds the provider's risk assessment and
+      any transaction-risk exemption.
+    example: 203.0.113.42
   challengeId:
     type:
       - string