---
title: "Submit Identity Verification Challenge"
method: POST
path: "/api/v1/users/:userIdentifier/identity-verification/challenges/:challengeId/submissions"
tags: ["Identity Verification"]
---

# Submit Identity Verification Challenge

`POST /api/v1/users/:userIdentifier/identity-verification/challenges/:challengeId/submissions`

## Request

- Base URL: `https://merchant-api.accruesavings.com`
- URL: `https://merchant-api.accruesavings.com/api/v1/users/:userIdentifier/identity-verification/challenges/:challengeId/submissions`
- Auth: none declared. Required headers: `Client-ID`, `Authorization`
- TypeScript: <https://skmtc.dev/byaccrue/apis/accrue-merchant-api/docs/api/v1/users/:userIdentifier/identity-verification/challenges/:challengeId/submissions/post.ts> (a function with typed inputs; its response is checked against the schema)

Submits answers for an active challenge. Each challenge allows up to three submission attempts. When all answers are correct, the response includes a single-use `verificationToken` that can be used to apply a verified profile update within 10 minutes.

## Path parameters

- `userIdentifier` string, required: Accrue `userId` or merchant `userReference` (`externalUserId` / `stableExternalUserId`). Accrue resolves the identifier automatically against active wallets for your merchant.
- `challengeId` string, uuid, required: The challenge ID returned from the create challenge endpoint.

## Headers

- `Client-ID` string, uuid, required: The unique identifier of the client making the request. This header is required to retrieve the client-specific configuration and ensure that the response is tailored to the client's settings and permissions.
- `Authorization` string, uuid, required: Secure secret to access privileged endpoints.

## Request body

- SubmitIdentityVerificationChallengeRequest
  - `data` object, required
    - `type` 'IdentityVerificationSubmission', required
    - `attributes` object, required
      - `answers` object[], required: One answer per question in the active challenge.
        - `questionId` string, required: The `id` of the question being answered.
        - `optionId` string, required: The `id` of the selected option.
      - `metadata` object: Optional partner metadata stored with the verification attempt.

## Response `200`

Submission processed. Check `passed` to determine whether a verification token was issued.

- SubmitIdentityVerificationChallengeResponse
  - `data` IdentityVerificationResult, required: Outcome of an identity verification challenge submission.
    - `id` string, uuid, required: Unique identifier for the object.
    - `type` 'IdentityVerificationResult', required
    - `attributes` object, required
      - `passed` boolean, required: Whether the user answered all questions correctly.
      - `verificationToken` string, nullable, required: Single-use token required to apply a verified profile update. Present only when `passed` is `true`. Valid for 10 minutes.
      - `expiresAt` string, date-time, nullable, required: ISO-8601 timestamp when the verification token expires. Present only when `passed` is `true`.
      - `failureReason` 'IncorrectAnswer' | 'ChallengeExpired' | 'MaxAttemptsExceeded', nullable, required: Reason the submission did not pass. `null` when `passed` is `true`.
      - `updatedAt` string, date-time, required
      - `createdAt` string, date-time, required

## Other responses

- `400`: Bad Request
- `404`: Not Found
- `500`: Internal Server Error

---

[API](https://skmtc.dev/byaccrue/apis/accrue-merchant-api.md) - [All operations](https://skmtc.dev/byaccrue/apis/accrue-merchant-api/llms.txt) - [OpenAPI document](https://skmtc.dev/byaccrue/apis/accrue-merchant-api/revisions/3e2d97ef2e6e?raw)