---
title: "List identity challenges"
method: GET
path: "/api/v1/identity-challenges"
tags: ["HITL"]
---

# List identity challenges

`GET /api/v1/identity-challenges`

## Request

- Base URL: `https://api.proof.holdings`
- URL: `https://api.proof.holdings/api/v1/identity-challenges`
- Auth: one of:
  - HTTP bearer
  - API key in cookie `auth_token`

The account's identity challenges, newest first, each with the same status a single read reports.

## Query parameters

- `circle_id` string: Only this Circle's challenges
- `page` integer: Page number (default 1)
- `limit` integer: Page size (default 20, max 100)

## Response `200`

Identity challenges

- IdentityChallengeListResponse: Identity challenges, newest first
  - `data` IdentityChallengeResponse[], required
    - `id` string, required
    - `status` 'pending' | 'confirmed' | 'denied' | 'cancelled' | 'failed' | 'expired' | 'revoked' | 'suspended', required: The one status every read reports. `pending` — waiting for the person being checked; `confirmed` — they confirmed; `denied` — they denied; `cancelled` — whoever started the check withdrew it; `failed` — the check could not be delivered; `expired` — nobody answered in time; `revoked` / `suspended` — the confirmation's proof was revoked or suspended (`POST /proofs/{proof_id}/revoke` or `/suspend`; revoking a denial's proof leaves it `denied`), or — `revoked` only — the member being checked was removed from the Circle while the check was still pending, which leaves `proof_id` null. Removing a member is not guaranteed to revoke a confirmation they already gave; revoke that one by its `proof_id`. A proof that merely reached its own expiry still reads `confirmed`; whether its token is still valid is `POST /proofs/validate`'s answer.
    - `channel` string: Channel the CONFIRM was dispatched on (GET)
    - `confirm_channel` string: Channel the CONFIRM was dispatched on (POST)
    - `single_channel_warning` boolean: True when the account holder has only one channel, so the CONFIRM ran on the same channel as the suspicious contact (degraded)
    - `circle_id` string, nullable: The Circle the check belongs to (GET)
    - `is_drill` boolean: True for a drill (scheduled, or started from the dashboard) rather than a real check (GET)
    - `proof_id` string, nullable: Public handle of the decision's proof — what `POST /proofs/{proof_id}/revoke` takes. Null until a decision minted one (GET).
    - `proof_token` string, nullable: Signed proof token, present once the person being checked decided
    - `created_at` string: ISO 8601 timestamp
    - `resolved_at` string, nullable: ISO 8601 timestamp of the decision — the CONFIRM, the DENY, the cancellation or the delivery failure — or null while the check is unanswered and after a timeout.
    - `expires_at` string: ISO 8601 timestamp
  - `pagination` object, required
    - `page` integer, required
    - `limit` integer, required
    - `total` integer, required
    - `total_pages` integer, required

## Other responses

- `400`: Malformed query (e.g. a `circle_id` that is not an id)

---

[API](https://skmtc.dev/proof/apis/proof-holdings-api.md) · [All operations](https://skmtc.dev/proof/apis/proof-holdings-api/llms.txt) · [OpenAPI document](https://skmtc.dev/proof/apis/proof-holdings-api/revisions/6b8d61ee354f?raw)