---
title: "Read a scoped challenge"
method: GET
path: "/api/v1/challenges/{challenge_id}"
tags: ["canonical"]
---

# Read a scoped challenge

`GET /api/v1/challenges/{challenge_id}`

## Request

- Base URL: `https://app.graypass.org` (the document declares no server; this is the origin it was published from)
- URL: `https://app.graypass.org/api/v1/challenges/{challenge_id}`
- Auth: HTTP bearer

Retrieve a challenge’s current state, permitted methods, expiry and action display for explicit confirmation.

## Path parameters

- `challenge_id` string, required

## Response `200`

Current challenge state, available methods, expiry and browser-safe action display.

- ChallengePublicView: Browser-safe view of a scoped challenge and the action it asks the subject to approve.
  - `display` ChallengeDisplay, required: Display information for explicit action confirmation. Digests complement the relying party’s independently retained business details.
    - `action` string, required: Customer-visible protected-action name.
    - `action_key` string, required: Stable registered key for the action being approved.
    - `audience` string, required: Expected relying-party audience. It must be permitted by the action and independently known to the verifier.
    - `consequence` string, required: Plain-language consequence if the wrong person performs the protected action.
    - `context_digest` string, required: Digest of the context binding. Render your independently retained business details for user confirmation.
    - `requesting_application` string, required: Relying-party application identified in the challenge display.
    - `resource_digest` string, required: One-way digest of the resource binding.
    - `resource_type` string, required: Customer-defined category of the protected resource, such as merchant.
  - `expires_at` string, required: Expiry time as an ISO 8601 timestamp. Use the capability before this time; obtain a fresh one afterward.
  - `id` string, required: Identifier of this record. Treat it as opaque and retain it for subsequent operations.
  - `methods` string[], required: Permitted challenge methods. sandbox_confirm is a simulated ceremony restricted to the sandbox.
  - `status` string, required: Lifecycle state of this record; use the operation-specific values listed in the schema.

## Other responses

- `422`: The canonical handler returns a Problem for invalid input; correct the request before retrying.

---

[API](https://skmtc.dev/graypass/apis/graypass-api.md) - [All operations](https://skmtc.dev/graypass/apis/graypass-api/llms.txt) - [OpenAPI document](https://skmtc.dev/graypass/apis/graypass-api/revisions/5f9ab64fdfdb?raw)