---
title: "Create an authenticated iPhone App Attest challenge"
method: POST
path: "/v1/account/agent-location/app-attest/challenges"
tags: ["Customer Account"]
---

# Create an authenticated iPhone App Attest challenge

`POST /v1/account/agent-location/app-attest/challenges`

## Request

- Base URL: `https://loppee.com`
- URL: `https://loppee.com/v1/account/agent-location/app-attest/challenges`
- Auth: HTTP bearer

Issues a one-use App Attest challenge bound by the database to the signed-in customer and exact installation. Completion and authority_change challenges return only the server-derived account, user, connection or account action, current OAuth grant and agent key where applicable, handoff, mode, policy, and consent binding that the Loppee iPhone app must sign.

## Headers

- `X-Loppee-Client-Platform` string, required
- `X-Loppee-Installation-Id` string, required

## Request body

- union
  - object
    - `purpose` 'attestation', required
    - `installation_id` string, uuid, required
    - `key_id` string, required
  - object
    - `purpose` 'handoff_completion', required
    - `installation_id` string, uuid, required
    - `connection_id` string, uuid, required
    - `handoff_id` string, uuid, required
    - `use_mode` 'automatic' | 'approved_in_app', required
    - `key_id` string, required
  - object
    - `purpose` 'authority_change', required
    - `installation_id` string, uuid, required
    - `action` 'set_connection_policy', required
    - `connection_id` string, uuid, required
    - `policy` 'always_allowed' | 'ask_every_time', required
    - `consent_copy_version` 'agent-phone-location.v2', required
    - `key_id` string, required
  - object
    - `purpose` 'authority_change', required
    - `installation_id` string, uuid, required
    - `action` 'resume_all', required
    - `consent_copy_version` 'agent-phone-location.v2', required
    - `key_id` string, required
  - object
    - `purpose` 'authority_change', required
    - `installation_id` string, uuid, required
    - `action` 'decline_handoff', required
    - `connection_id` string, uuid, required
    - `handoff_id` string, uuid, required
    - `key_id` string, required

## Response `200`

Create an authenticated iPhone App Attest challenge response

- object
  - `challenge_id` string, uuid, required
  - `challenge` string, required
  - `purpose` 'attestation' | 'handoff_completion' | 'authority_change', required
  - `usable_until` string, date-time, required
  - `binding` union, required
    - object
      - `installation_id` string, uuid, required
      - `key_id` string, required
    - object
      - `account_id` string, required: Opaque Loppee customer service-account id; this is not assumed to be a UUID.
      - `auth_user_id` string, uuid, required
      - `installation_id` string, uuid, required
      - `connection_id` string, uuid, required
      - `oauth_grant_id` string, uuid, nullable, required
      - `agent_key_id` string, uuid, required
      - `handoff_id` string, uuid, required
      - `use_mode` 'automatic' | 'approved_in_app', required
      - `capture_source` 'loppee_ios_core_location', required
    - object
      - `account_id` string, required
      - `auth_user_id` string, uuid, required
      - `installation_id` string, uuid, required
      - `connection_id` string, uuid, nullable, required
      - `oauth_grant_id` string, uuid, nullable, required
      - `agent_key_id` string, uuid, nullable, required
      - `handoff_id` string, uuid, nullable, required
      - `request_mode` 'automatic' | 'approval_required' | 'null', nullable, required
      - `action` 'set_connection_policy' | 'resume_all' | 'decline_handoff', required
      - `policy` 'always_allowed' | 'ask_every_time' | 'null', nullable, required
      - `consent_copy_version` 'agent-phone-location.v2' | 'null', nullable, required

## Other responses

- `400`: ErrorResponse
- `401`: ErrorResponse
- `403`: ErrorResponse
- `404`: ErrorResponse
- `409`: ErrorResponse
- `413`: ErrorResponse
- `429`: RateLimitError
- `default`: ErrorResponse

---

[API](https://skmtc.dev/loppee/apis/loppee-business-registry-api-for-external-agents.md) · [All operations](https://skmtc.dev/loppee/apis/loppee-business-registry-api-for-external-agents/llms.txt) · [OpenAPI document](https://skmtc.dev/loppee/apis/loppee-business-registry-api-for-external-agents/revisions/37285f7cddcd?raw)