# Trusted IBANs

## Introduction

The trusted IBANs feature allows your customers to maintain a list of target
IBANs (per account) for which they do not have to complete [two-factor authentication (2FA)](/guides/authentication/strong-customer-authentication)
challenges. When a customer makes a payment to a trusted IBAN, then the payment

Additionally, you can create [Timed Orders](/guides/digital-banking/sepa-transfers/timed-orders) and [Standing Orders](/guides/digital-banking/sepa-transfers/standing-orders) to trusted IBANs without having to authorize the transaction using two-factor authentication. However, please note that this applies only to creating the order. In case of updating or deleting an existing order, two-factor authentication is required.

In order to use this feature in your solution, implement the API endpoints below:

## API endpoints

### POST Add trusted IBAN to an account

This method requires a [change request](/guides/authentication/strong-customer-authentication/#change-request).

Adds a trusted IBAN to the account specified in the request. 2FA will no longer
trigger for outgoing transactions to this IBAN.

**Request URL:**


```shell
POST /v1/accounts/{account_id}/trusted_ibans
```

**Example response:**


```json
{
  "id": "d6c778822b2d7bd3b778935bcfd0d1d3csc",
  "updated_at": "2021-01-30T08:30:00Z",
  "status": "AUTHORIZATION_REQUIRED",
  "url": ":env/v1/change_requests/:id/authorize"
}
```

[Click here to view the full API reference.](/api-reference/digital-banking/account-management/#tag/Trusted-IBANs/paths/~1v1~1accounts~1%7Baccount_id%7D~1trusted_ibans/post)

### GET Index trusted IBANs for an account

Returns an array of all trusted IBANs added to the specified account.

**Request URL:**


```shell
GET /v1/accounts/{account_id}/trusted_ibans
```

**Example response:**


```json
[
  {
    "iban": "DE12100110011001100101"
  }
]
```

[Click here to view the full API reference.](/api-reference/digital-banking/account-management/#tag/Trusted-IBANs/paths/~1v1~1accounts~1%7Baccount_id%7D~1trusted_ibans/get)

### DELETE Remove trusted IBAN

- You must submit the `person_id` of the person who added this trusted IBAN as a
query parameter in this request.
- This endpoint requires a [change request.](/guides/authentication/strong-customer-authentication/#change-request)


Removes the supplied IBAN from the list of trusted IBANs for the account specified in the request.

**Request URL:**


```shell
DELETE /v1/accounts/{account_id}/trusted_ibans/{trusted_iban_id}
```

**Example response:**


```shell
HTTP/1.1 204 No Content
```

[Click here to view the full API reference.](/api-reference/digital-banking/account-management/#tag/Trusted-IBANs/paths/~1v1~1accounts~1%7Baccount_id%7D~1trusted_ibans~1%7Btrusted_iban_id%7D/delete)

## Trusted IBANs webhooks

You can use the following webhook to be notified when a trusted IBAN is confirmed. The webhook includes information about the trusted IBAN and the person who approved the action.

- [TRUSTED_IBAN_CONFIRMED](/api-reference/onboarding/webhooks/#tag/Webhook-events/paths/TRUSTED_IBAN_CONFIRMED/post)