---
title: "Get a payment challenge"
method: GET
path: "/x402/challenges/{id}"
tags: ["Payments"]
---

# Get a payment challenge

`GET /x402/challenges/{id}`

Fetch a challenge you created, to poll its `status` and settlement
receipt (`settle_tx`). Scoped to the challenger org that created it.

## Path parameters

- `id` string, uuid, required

## Response `200`

The challenge

- object
  - `success` true, required
  - `data` object, required
    - `id` string, uuid, required
    - `status` 'pending' | 'settling' | 'settled' | 'failed' | 'expired', required
    - `network` 'base' | 'base-sepolia', required
    - `asset` string, required — Token contract address (checksummed).
    - `amount` string, required — Amount in token base units.
    - `pay_to` string, required — The payee's resolved payout address (checksummed).
    - `payer_org` string, nullable — The org id bound as payer, if one was set at creation.
    - `resource` string, nullable
    - `description` string, nullable
    - `nonce_binding` object, required — The interaction binding the payer hashes into the EIP-3009 nonce (`deriveEip3009Nonce`). Pinning the nonce to this binding is what lets an x402 payment ride asynchronous transports safely: a replayed challenge can't redirect funds and a signed payment can't settle twice.
      - `interaction_id` string, required — Interaction id, including its `@domain` part.
      - `challenge_step_id` string, uuid, required
      - `challenge_nonce` string, required — 32 random bytes as 64 lowercase hex chars.
    - `settle_tx` string, nullable — On-chain settlement transaction hash once settled.
    - `settled_at` string, date-time, nullable
    - `failure_reason` string, nullable
    - `expires_at` string, date-time, required
    - `created_at` string, date-time
    - `payment_requirements` object — The x402 `PaymentRequirements` the payer signs over. Field names are x402's native camelCase, preserved byte-for-byte.
      - `scheme` string, required — The x402 settlement scheme. Always `exact` for v1.
      - `network` 'base' | 'base-sepolia', required
      - `maxAmountRequired` string, required — Amount in token base units.
      - `payTo` string, required — The payee's resolved payout address (checksummed).
      - `asset` string, required — The token contract address (checksummed). USDC.
      - `resource` string
      - `description` string
      - `maxTimeoutSeconds` integer
      - `extra` object, required — The token's load-bearing EIP-712 domain params. `name` differs by chain (Base mainnet USDC is `USD Coin`, Base Sepolia is `USDC`); a wrong value produces a signature the verifier rejects.
        - `name` string, required
        - `version` string, required

## Other responses

- `400` — Invalid request parameters
- `401` — Invalid or missing API key
- `403` — Authenticated caller lacks permission for the operation
- `404` — Resource not found
- `429` — Rate limit exceeded

---

[API](https://skmtc.dev/primitive/apis/primitive-api.md) · [All operations](https://skmtc.dev/primitive/apis/primitive-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/primitive/primitive-api/revisions/c2299d28022c/schema)