---
title: "Solve synchronization challenge"
method: POST
path: "/rest/accesses/{access-id}/syncs/{sync-id}/challenges/{challenge-id}/response"
tags: ["Strong Customer Authentication"]
---

# Solve synchronization challenge

`POST /rest/accesses/{access-id}/syncs/{sync-id}/challenges/{challenge-id}/response`

## Request

- Base URL: `https://api.nrich.qwist.cloud`
- URL: `https://api.nrich.qwist.cloud/rest/accesses/{access-id}/syncs/{sync-id}/challenges/{challenge-id}/response`
- Auth: HTTP bearer
- TypeScript: <https://skmtc.dev/qwist/apis/finx-api/docs/rest/accesses/:access-id/syncs/:sync-id/challenges/:challenge-id/response/post.ts> (a function with typed inputs; its response is checked against the schema)

This endpoint is used to answer an authorization challenge that was issued by the financial provider.  In addition to the normal transport layer encryption it is possible to encrypt the challenge response using [JSON web encryption](/reference/jwe-encryption). Note that a challenge can only be answered once. Subsequent submission of a response to the same challenge will result in an error (HTTP status `409`).

## Parameters

- `#/paths/~1rest~1accesses~1{access-id}/get/parameters/0` (unresolved $ref)
- `#/paths/~1rest~1accesses~1{access-id}~1syncs~1{sync-id}/get/parameters/1` (unresolved $ref)
- `#/paths/~1rest~1accesses~1{access-id}~1syncs~1{sync-id}~1challenges~1{challenge-id}/get/parameters/2` (unresolved $ref)

## Request body

- union
  - object
    - `method_id` string: nrich ID of SCA method.
  - object
    - `medium_id` string: nrich ID of SCA medium.
  - object
    - `value` string: Response to the auth challenge. The source of the value depends on the selected authentication method.
  - object
    - `type` 'encrypted': The type of the `value`. Always set to the value `"encrypted"`.
    - `value` string: [JWE encrypted](#section/JWE-encryption) auth challenge response.

## Response `202`

Accepted.

## Other responses

- `400` (unresolved $ref)
- `401` (unresolved $ref)
- `409`: Conflicting resource state.

## Changes

- **2026-11-03** `398592d93b1f`: 4 breaking, 1 info
  - added the new path request parameter `access-id`
  - added the new path request parameter `challenge-id`
  - added the new path request parameter `sync-id`
  - removed `subschema #1, subschema #2` from the request body `oneOf` list
  - …1 more

[Operation history](https://skmtc.dev/qwist/apis/finx-api/changes/rest/accesses/:access-id/syncs/:sync-id/challenges/:challenge-id/response/post.md)

---

[API](https://skmtc.dev/qwist/apis/finx-api.md) - [All operations](https://skmtc.dev/qwist/apis/finx-api/llms.txt) - [OpenAPI document](https://skmtc.dev/qwist/apis/finx-api/revisions/398592d93b1f?raw)