--- title: "Submit Play age range" method: POST path: "/users/@me/age-range/play-integrity" tags: ["Users"] --- # Submit Play age range `POST /users/@me/age-range/play-integrity` ## Request - Base URL: `https://web.fluxer.app/api/v1` - URL: `https://web.fluxer.app/api/v1/users/@me/age-range/play-integrity` - Auth: API key in header `Authorization` - TypeScript: (a function with typed inputs; its response is checked against the schema) Submits the age range that the Google Play Age Signals API reported, bound to a standard Play Integrity token. client_data holds the exact JSON bytes the app hashed, with the challenge from the Play Integrity challenge endpoint, age_lower, age_upper and age_range_source. The token must be requested with requestHash set to the SHA-256 of those bytes as unpadded base64url. Fluxer checks the token with Google Play and accepts the range only when age_lower is 18. An accepted range is stored as the adult floor with the time it was received, as with the iOS app. The token, the verdict, the range and its source are not stored. Any other range returns AGE_RANGE_NOT_ADULT with status 403 and nothing is stored. Returns PLAY_INTEGRITY_APP_NOT_RECOGNIZED when the app was not installed from Google Play, and PLAY_INTEGRITY_DEVICE_NOT_TRUSTED when the device fails the Play device check. Returns PLAY_INTEGRITY_UNAVAILABLE with status 503 when Google Play could not be asked, in which case the app should try again later with a new challenge. Returns PLAY_INTEGRITY_NOT_AVAILABLE with status 404 when this instance does not accept Play Integrity. Returns FEATURE_NOT_AVAILABLE_SELF_HOSTED with status 403 on a self-hosted instance, and AGE_RANGE_NOT_NEEDED with status 403 when the request does not come from a region where a date of birth typed in is not enough for mature content. ## Request body - PlayIntegrityAgeSubmitRequest - `package_name` string, required: Package name of the Android app that asked for the integrity token, such as com.fluxer - `integrity_token` string, required: Token from a standard Play Integrity request, made with requestHash set to the SHA-256 of client_data as unpadded base64url - `client_data` string, required: The exact UTF-8 JSON bytes the app hashed, as standard base64 on one line with no line breaks (Base64.NO_WRAP on Android). The JSON holds challenge, age_lower, age_upper and age_range_source ## Response `200` Success - AgeRangeSubmitResponse - `age_floor` 'adult', required: Age floor that was accepted, which is always adult ## Other responses - `400`: Bad Request - The request was malformed or contained invalid data - `401`: Unauthorized - Authentication is required or the token is invalid - `403`: Forbidden - You do not have permission to perform this action - `404`: Not Found - The requested resource was not found - `429`: Too Many Requests - You are being rate limited - `500`: Internal Server Error - An unexpected error occurred - `503`: Service Unavailable - The request could not be completed right now ## Changes > 63 revisions in range; 2 not diffed. - **2026-11-07** `fb6a6a77d71f`: 1 info - endpoint added [Operation history](https://skmtc.dev/fluxer/apis/fluxer-api/changes/users/@me/age-range/play-integrity/post.md) --- [API](https://skmtc.dev/fluxer/apis/fluxer-api.md) - [All operations](https://skmtc.dev/fluxer/apis/fluxer-api/llms.txt) - [OpenAPI document](https://skmtc.dev/fluxer/apis/fluxer-api/revisions/fb6a6a77d71f?raw)