---
title: "Create an OTP challenge for an unauthenticated step-up action"
method: POST
path: "/v1/public/challenges"
tags: ["Challenges"]
---

# Create an OTP challenge for an unauthenticated step-up action

`POST /v1/public/challenges`

## Request

- Base URL: `https://identity-api.paymongo.com`
- URL: `https://identity-api.paymongo.com/v1/public/challenges`
- Auth: none required

Issues an email OTP for actions that don't require an existing session (e.g. reset_password). Always returns 201 to avoid leaking account existence.

## Request body

- MfaCreatePublicChallengeRequestEnvelopeDTO
  - `data` object
    - `attributes` MfaCreatePublicChallengeRequestDTO
      - `action` string, required
      - `email` string, required
      - `factor` 'email' | 'sms'

## Response `201`

Created

- object: Standard response containing data and its metadata if any
  - `data` object
    - `attributes` MfaCreateChallengeAttributesDTO
      - `expiration_at` integer
      - `factor` string
    - `id` string
    - `type` string
  - `has_more` boolean

## Other responses

- `400`: Bad Request
- `422`: Unprocessable Entity
- `429`: Too Many Requests
- `500`: Internal Server Error
- `502`: Bad Gateway

---

[API](https://skmtc.dev/paymongo/apis/identity.md) - [All operations](https://skmtc.dev/paymongo/apis/identity/llms.txt) - [OpenAPI document](https://skmtc.dev/paymongo/apis/identity/revisions/cc3056164874?raw)