---
title: "Respond to Authorization Challenge"
method: POST
path: "/v1/card_authorizations/{event_token}/challenge_response"
tags: ["Card Authorizations"]
---

# Respond to Authorization Challenge

`POST /v1/card_authorizations/{event_token}/challenge_response`

Card program's response to Authorization Challenge.
Programs that have Authorization Challenges configured as Out of Band receive a [card_authorization.challenge](https://docs.lithic.com/reference/cardauthorizationchallengewebhook) webhook when an authorization attempt triggers a challenge.
The card program should respond using this endpoint after the cardholder completes the challenge.

## Path parameters

- `event_token` string, uuid, required

## Request body

- object — Card program's response to Authorization Challenge
  - `response` 'APPROVE' | 'DECLINE', required — Whether the cardholder has approved or declined the issued challenge

## Response `200`

Challenge response recorded

## Other responses

- `400` — Invalid request (e.g. challenge method does not support this endpoint)
- `404` — Challenge not found
- `409` — Challenge has already been completed
- `410` — Challenge has expired
- `500` — Lithic Error

## Changes

- **2026-05-15** `161d70ef4fdf` — 1 info
  - endpoint added

[Change history](https://skmtc.dev/lithic-com/apis/lithic-developer-api/changes/v1/card_authorizations/:event_token/challenge_response/post.md)

---

[API](https://skmtc.dev/lithic-com/apis/lithic-developer-api.md) · [All operations](https://skmtc.dev/lithic-com/apis/lithic-developer-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/lithic-com/lithic-developer-api/revisions/53ab5d4e2adb/schema)