---
title: "Submit attested age floor"
method: POST
path: "/users/@me/age-range"
tags: ["Users"]
---

# Submit attested age floor

`POST /users/@me/age-range`

## Request

- Base URL: `https://web.fluxer.app/api/v1`
- URL: `https://web.fluxer.app/api/v1/users/@me/age-range`
- Auth: API key in header `Authorization`
- TypeScript: <https://skmtc.dev/fluxer/apis/fluxer-api/docs/users/@me/age-range/post.ts> (a function with typed inputs; its response is checked against the schema)

Submits the age floor the device reported, signed by a registered App Attest key. client_data holds the exact JSON bytes the app signed, with the challenge from a challenge with purpose assert and the age_floor. Only the adult floor is accepted. It stores that the account's age range is 18 or over, with the time it was received, which unlocks mature content in regions where a date of birth typed in is not enough for mature content. It does not change the date of birth or any setting. Any other floor returns AGE_RANGE_NOT_ADULT with status 403 and nothing is stored. When the request ends, whatever the outcome, every App Attest key registered to the current user is deleted, so the app registers a new key before each submit. Returns APP_ATTEST_KEY_NOT_REGISTERED when the key is unknown, in which case the app should register a new key. Returns APP_ATTEST_NOT_AVAILABLE with status 404 when this instance does not accept App Attest. Returns FEATURE_NOT_AVAILABLE_SELF_HOSTED with status 403 on a self-hosted instance, and AGE_RANGE_NOT_NEEDED with status 403 when the request does not come from a region where a date of birth typed in is not enough for mature content.

## Request body

- AgeRangeSubmitRequest
  - `key_id` string, required: App Attest key identifier from DCAppAttestService, 32 bytes as standard base64
  - `assertion` string, required: Assertion from DCAppAttestService.generateAssertion as standard base64
  - `client_data` string, required: The exact UTF-8 JSON bytes the app signed, as standard base64. The JSON holds challenge and age_floor

## Response `200`

Success

- AgeRangeSubmitResponse
  - `age_floor` 'adult', required: Age floor that was accepted, which is always adult

## Other responses

- `400`: Bad Request - The request was malformed or contained invalid data
- `401`: Unauthorized - Authentication is required or the token is invalid
- `403`: Forbidden - You do not have permission to perform this action
- `404`: Not Found - The requested resource was not found
- `429`: Too Many Requests - You are being rate limited
- `500`: Internal Server Error - An unexpected error occurred

## Changes

> 64 revisions in range; 2 not diffed.

- **2026-11-07** `fb6a6a77d71f`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/fluxer/apis/fluxer-api/changes/users/@me/age-range/post.md)

---

[API](https://skmtc.dev/fluxer/apis/fluxer-api.md) - [All operations](https://skmtc.dev/fluxer/apis/fluxer-api/llms.txt) - [OpenAPI document](https://skmtc.dev/fluxer/apis/fluxer-api/revisions/2092bc8b2edf?raw)