---
title: "Initiate challenge"
method: POST
path: "/challenge"
tags: ["challenge", "sms", "email"]
---

# Initiate challenge

`POST /challenge`

Initiate a challenge by sending a verification code to an  email address or phone number.

## Request body

- object
  - `verificationMethod` 'EMAIL_OTP' | 'SMS' | 'WHATSAPP', required — The verification method to use for the challenge.
  - `action` string, required — The action code used to identify the challenge in the Authsignal Portal.
  - `idempotencyKey` string — The idempotency key for the action. An idempotency key can be used to initiate multiple challenges for the same action.
  - `phoneNumber` string — The phone number in E.164 format. Required if the verification method is 'SMS'.
  - `email` string — The email address. Required if the verification method is 'EMAIL_OTP'.
  - `userId` string — The primary ID of the user in your system. Required when initiating a challenge to enroll or update an authenticator for an existing user.
  - `scope` 'add:authenticators' | 'update:authenticators' | 'add:authenticators update:authenticators' — Providing scopes will authorize enrolling or updating an authenticator for an existing user. Must only be provided when initiating a challenge from an already authenticated state.
  - `locale` string — The locale of the user in BCP 47 format. Used to localize the pre-built UI, email, and SMS messages.
  - `ipAddress` string — The user's IP address. Can be provided to use rules based on location or other IP-derived features.
  - `userAgent` string — The user agent identifying a browser or app. Can be provided to use rules based on device.
  - `deviceId` string — An ID which identifies the user's device. Can be provided to use rules based on device.
  - `custom` object — A JSON object which can include any key/value pairs. Can be provided to use rules based on your own data points.

## Response `200`

OK

- object
  - `challengeId` string, required — The ID of the challenge.
  - `idempotencyKey` string, required — The idempotency key for the action. An idempotency key can be used to initiate multiple challenges for the same action.
  - `expiresAt` number, required — The challenge expiry as a Unix timestamp in seconds.

## Other responses

- `400` — Invalid Request
- `401` — Unauthorized

---

[API](https://skmtc.dev/authsignal/apis/call-connect-api.md) · [All operations](https://skmtc.dev/authsignal/apis/call-connect-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/authsignal/call-connect-api/revisions/5604d744e3ad/schema)