---
title: "Register a hashed one-time Portal auth challenge"
method: POST
path: "/portal-auth/challenges/register"
---

# Register a hashed one-time Portal auth challenge

`POST /portal-auth/challenges/register`

## Request

- Base URL: `https://api.gravityads.dev` (the document declares no server; this is the origin it was published from)
- URL: `https://api.gravityads.dev/portal-auth/challenges/register`
- Auth: HTTP bearer

## Request body

- object
  - `challenge_hash` string, required: SHA-256 hash of the token nonce; raw nonce is forbidden.
  - `challenge_type` 'email_magic_link' | 'github_oauth_state' | 'google_oauth_state' | 'microsoft_oauth_state' | 'password_reset', required
  - `identity_hash` string
  - `expires_at` string, date-time, required
  - `resolve_email_identity` boolean: Consume only: resolve canonical membership after an isolated Portal email attestation. No provider binding or automatic membership updates.
  - `email_attestation` string

## Response `200`

Portal auth challenge registered

- object
  - `status` 'portal_auth_challenge_registered' | 'portal_auth_challenge_already_exists' | 'portal_auth_challenge_consumed' | 'portal_auth_challenge_unavailable' | 'portal_auth_challenge_unconfigured' | 'portal_auth_challenge_degraded' | 'portal_auth_challenge_failed', required
  - `registered` boolean
  - `consumed` boolean
  - `email_identity` object
    - `status` 'existing' | 'new' | 'ambiguous' | 'inactive'
    - `user` object: Canonical active DB membership and plan; existing status only.
  - `challenge_type` string, required
  - `hosted_auth_context` object
  - `raw_challenge_returned` false, required
  - `raw_identity_returned` false, required
  - `raw_secrets_returned` false, required

---

[API](https://skmtc.dev/gravityads/apis/gravityads-api.md) · [All operations](https://skmtc.dev/gravityads/apis/gravityads-api/llms.txt) · [OpenAPI document](https://skmtc.dev/gravityads/apis/gravityads-api/revisions/124cd07d534d?raw)