---
title: "Open a passkey write-intent ceremony (write-approval)"
method: POST
path: "/agent/v1/control-plane/write-approval/challenges"
tags: ["ControlPlane"]
---

# Open a passkey write-intent ceremony (write-approval)

`POST /agent/v1/control-plane/write-approval/challenges`

## Request

- Base URL: `https://api.run402.com`
- URL: `https://api.run402.com/agent/v1/control-plane/write-approval/challenges`
- Auth: HTTP bearer

Issues a one-time, server-bound write-intent challenge for an action (org.project.create | project.deploy | project.secret.write) on an explicit target org/project. Returns a confirm_url — a gateway-rendered confirmation page on the console origin where the user approves with their passkey. The resulting write approval is target-scoped (one org or one project), 30 min idle / 4 h absolute, and only ever works alongside the issuing control-plane session (dual-header).

## Request body

- object
  - `action` 'org.project.create' | 'project.deploy' | 'project.secret.write', required
  - `org_id` string: Required for org-scoped actions (org.project.create).
  - `project_id` string: Required for project-scoped actions (project.deploy, project.secret.write).

## Response `201`

challenge_id + confirm_url + expires_at

- object

## Other responses

- `403`: Not authorized for the target, recovery/device-flow session, or HUMAN_WRITE_AUTH disabled

---

[API](https://skmtc.dev/run402/apis/run402-api.md) · [All operations](https://skmtc.dev/run402/apis/run402-api/llms.txt) · [OpenAPI document](https://skmtc.dev/run402/apis/run402-api/revisions/893607557f50?raw)