Skip to main content

End User Re-Authentication

Authentication is valid for 365 days. When an agent's authentication lapses, your backend re-authenticates them without repeating full registration: check status, expire the stale authentication, re-initiate with fresh PII and device payloads, complete the OTP or KBA challenge, and confirm. These are the /auth/... endpoints — distinct from the registration-time step-up endpoints used in Authentication with OTP Step Up.

End User UXPartner Backendrelay API

Steps​

  1. Check the agent's authentication status with GET /api/experian/agents/{agentId}/auth/status. If still authenticated, stop — no action needed.
  2. Expire the stale authentication with GET /api/experian/agents/{agentId}/auth/expire.
  3. Re-initiate authentication with POST /api/experian/agents/{agentId}/auth, supplying the required fields: jscPayload, hdimPayload, ipAddress, currentAddress, currentCity, currentState, currentZip. The response indicates the challenge type.
  4. Complete the challenge:
    • OTP (otpEnabled: true) — serve UX for the code and submit it with POST …/auth/otp; if the agent didn't receive it, GET …/auth/otp/resend.
    • KBA (kiqEnabled: true) — serve UX for the questions in the response payload and submit answers with POST …/auth/kba ({ kbaAnswers: [ {answer: choiceId}, … ] }).
  5. Re-check the status with GET …/auth/status. On success, re-authentication is complete; on failure, handle it — after 3 failed attempts the agent is locked for 24 hours (423 Locked).