---
title: "Get a PKI login challenge"
method: GET
path: "/eclipse-conductor/rest/v1/authentication/login-challenges"
tags: ["a) Authentication"]
---

# Get a PKI login challenge

`GET /eclipse-conductor/rest/v1/authentication/login-challenges`

Returns an encrypted challenge for the identity's public key. The client decrypts or signs it with their private key and presents the result to /login. If a clientChallenge is provided, the server decrypts it with the Eclipse private key to allow the client to verify the server's identity.

## Query parameters

- `challengeType` 'RSA_ECB_OAEPWithSHA_1AndMGF1Padding' | 'RSA_PKCS1_SHA_256_Signature' | 'WebAuthN'
- `clientChallenge` string
- `identity` string

## Response `200`

OK

- AuthenticationChallenge — A challenge for WebAuthN (registration & authentication) and PKI Auth. The challenge expires at the expires date after which a new challenge would need to be requested
  - `base64EncodedChallenge` string, required — PKI or WebAuthN challenge data
  - `base64EncodedClientChallengeResponse` string — For PKI: Base64 encoded SHA256 of Eclipses decryption of the client challenge sent through so that the client can verify the authenticity of the server
  - `expires` string, date-time — ISO 8601 date/time of when the challenge expires

## Other responses

- `404` — Identity not found or no PKI key set
- `500` — Internal Server Error

---

[API](https://skmtc.dev/eftcorp/apis/eclipse-rest-api.md) · [All operations](https://skmtc.dev/eftcorp/apis/eclipse-rest-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/eftcorp/eclipse-rest-api/revisions/9213d52d49a3/schema)