Authentication with KBA Step Up
When an authentication attempt (End User Authentication or Consumer Authentication) is neither accepted nor rejected outright — and the customer is not eligible for OTP step-up — relay steps them up to knowledge-based authentication (KBA): multiple-choice questions delivered in the response payload, answered through UX you build. Organizations always step up directly to KBA.
End User UXPartner Backendrelay API
Steps
-
Customer enters the required PII in your application.
-
Your backend collects the PII and device info and calls the registration endpoint for the customer type.
-
POST the customer-type registration endpoint:
- Consumer —
POST /api/experian/renters/{renterId} - End user (agent) —
POST /api/experian/agents/{agentId} - Organization —
POST /api/experian/organizations/{organizationId}
- Consumer —
-
On Accept, persist the authentication datetime. Authentication is valid for 365 days.
-
Display a success message (optional). On Reject, translate the response and render UX — the customer should have the option to retry, or, if a consumer, to submit without reports.
-
If the response steps up to KBA (OTP not applicable), relay requests the KBA challenge on your behalf and returns the questions in the response payload.
-
Serve UX for the customer to answer the KBA questions — you must build this screen from the response payload.
-
Customer inputs and submits their answers in your application.
-
POST the answers to the matching endpoint:
- Consumer —
POST /api/experian/renters/{renterId}/kba - End user (agent) —
POST /api/experian/agents/{agentId}/kba - Organization —
POST /api/experian/organizations/{organizationId}/kba
Correct responses complete authentication (step 4); incorrect responses follow the rejection path.
- Consumer —