Is it the locale of the User for which the call is made? Is it the locale of the Administrator which does the call? Is the locale of the trusted application which handles the calls? Is there a way to influence/change any of these? I see in the logs that the HTTP calls do not set any Accept-Language headers…
Why I’m asking? The security questions and all server (error) messages should come in the same language of the browser in which the trusted application is displayed.