Qonto Custom API Call Bulk Transfers with SCA : Handling 428 error body?

Questions
,
1

I am trying to perform Bulk Transfers using the Qonto App already integrated in Make. Since “Bulk Transfers” is not yet available as a native function in Make, I am using a Custom API Call.

For security, I am using SCA.

Everything is working fine, and I am supposed to receive a 428 status code along with a body containing the "sca_session_token".

I am receiving the 428 response, but Make does not show the body when an error occurs, so I cannot access the SCA token.

Unlike the “HTTP Make a Request” module, there is no option to “Evaluate all states as errors (except for 2xx and 3xx).”

As a result, I am not able to fully use the Qonto API. Is there any way to access the full details of the 428 response?

Do I need to ask Qonto to update their Make integration? Or, in the worst case, do I have to set up OAuth manually inside Make and perform the requests via the HTTP module?

Thank you very much for any suggestions to simplify this process :folded_hands:

2

Hi @GuiRVB,

As per the Qonto documentation:

The 428 status code means “Precondition Required” in Qonto’s API. It’s used for Strong Customer Authentication (SCA) when performing sensitive actions.

When you receive a 428 response, the user needs to authenticate the action via:

Paired mobile device (push notification)
Passkey (text message with link)
SMS OTP (for Embed Partners only)
The response includes a sca_session_token that you must use to complete the action after the user authenticates. You have 15 minutes to use this token before it expires.

The full step by step guide is explained here: Strong Customer Authentication - Qonto

Not a Qonto expert, so I haven’t used this flow before. But I hope this helps!

Cheers,
Henk

3

Thank you for your message! But my problem is:

I can’t access the sca_session_token because Make.com consider the 428 as an error and do not return the body. Is there a way to force Make to give the body inside the Qonto module?

4

Have you tried to take a look at the payload from Qonto itself through the Make DevTool?

Chrome Extension:
Make DevTool - Chrome Web Store
Tutorial:
Introduction to Make Chrome DevTool (formerly Integromat DevTool)

5

Ok I managed to solve my problem by doing a HTTP “Make an OAuth 2.0 request”
With the parameter : Evaluate all states as errors (except for 2xx and 3xx ) : No

(For that you need to create a Qonto App with “Business API” to get Client ID and Secret for the OAuth)

Thanks for your help, I didn’t know the DevTool, I’ll have a look :folded_hands: