---
title: "Validate action"
method: POST
path: "/validate"
tags: ["action"]
---

# Validate action

`POST /validate`

Validate the result of an action using a token obtained after redirecting back from the pre-built UI or returned by an Authsignal SDK.

## Request body

- object
  - `token` string, required — The token obtained after a redirect or returned by an Authsignal SDK.
  - `userId` string — The ID of the user (if known). If passed, this will be used to validate that the token is for the correct user.
  - `action` string — The action which was tracked. Use this to ensure that the action being validated matches the action that was tracked.

## Response `200`

OK

- object
  - `isValid` boolean — `true` if the challenge's state is `CHALLENGE_SUCCEEDED`.
  - `state` 'ALLOW' | 'BLOCK' | 'CHALLENGE_REQUIRED' | 'CHALLENGE_FAILED' | 'CHALLENGE_SUCCEEDED' | 'REVIEW_REQUIRED' | 'REVIEW_FAILED' | 'REVIEW_SUCCEEDED' — The current state of the action.
  - `stateUpdatedAt` string, date-time — The time in ISO 8061 format when the state of the action was last updated.
  - `userId` string — The ID of the user.
  - `action` string
  - `idempotencyKey` string
  - `verificationMethod` 'SMS' | 'AUTHENTICATOR_APP' | 'EMAIL_MAGIC_LINK' | 'EMAIL_OTP' | 'PUSH' | 'DEVICE' | 'SECURITY_KEY' | 'PASSKEY' | 'VERIFF' | 'IPROOV' | 'PALM_BIOMETRICS_RR' | 'IDVERSE'
  - `veriffSessionId` string — The Veriff session ID, returned when the challenge was completed using Veriff. Use this with your own Veriff API credentials to fetch the full decision and provider payload.

## Other responses

- `400` — Invalid Request
- `401` — Unauthorized

---

[API](https://skmtc.dev/authsignal/apis/call-connect-api.md) · [All operations](https://skmtc.dev/authsignal/apis/call-connect-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/authsignal/call-connect-api/revisions/5604d744e3ad/schema)