--- title: "Create Play Integrity challenge" method: POST path: "/users/@me/play-integrity/challenge" tags: ["Users"] --- # Create Play Integrity challenge `POST /users/@me/play-integrity/challenge` ## Request - Base URL: `https://web.fluxer.app/api/v1` - URL: `https://web.fluxer.app/api/v1/users/@me/play-integrity/challenge` - Auth: API key in header `Authorization` - TypeScript: (a function with typed inputs; its response is checked against the schema) Creates a single use challenge for the Android app, valid for 5 minutes. Put it in client_data before submitting an age range with a Play Integrity token. Returns PLAY_INTEGRITY_NOT_AVAILABLE with status 404 when this instance does not accept Play Integrity. Returns FEATURE_NOT_AVAILABLE_SELF_HOSTED with status 403 on a self-hosted instance, and AGE_RANGE_NOT_NEEDED with status 403 when the request does not come from a region where a date of birth typed in is not enough for mature content. ## Response `200` Success - AppAttestChallengeResponse - `challenge` string, required: Single use challenge, 32 bytes as unpadded base64url - `expires_at` string, date-time, required: When the challenge stops working ## Other responses - `400`: Bad Request - The request was malformed or contained invalid data - `401`: Unauthorized - Authentication is required or the token is invalid - `403`: Forbidden - You do not have permission to perform this action - `404`: Not Found - The requested resource was not found - `429`: Too Many Requests - You are being rate limited - `500`: Internal Server Error - An unexpected error occurred ## Changes > 64 revisions in range; 2 not diffed. - **2026-11-06** `16c56e85124a`: 1 info - endpoint added [Operation history](https://skmtc.dev/fluxer/apis/fluxer-api/changes/users/@me/play-integrity/challenge/post.md) --- [API](https://skmtc.dev/fluxer/apis/fluxer-api.md) - [All operations](https://skmtc.dev/fluxer/apis/fluxer-api/llms.txt) - [OpenAPI document](https://skmtc.dev/fluxer/apis/fluxer-api/revisions/2092bc8b2edf?raw)