---
title: "Changes to Create a new challenge for a MFA factor."
method: POST
path: "/factors/{factorId}/challenge"
---

# Changes to Create a new challenge for a MFA factor.

`POST /factors/{factorId}/challenge`

> Every recorded change to this operation, newest first.

## Timeline

Changed in 7 of 51 revisions.

- **2026-04-28** `d3f7d49a0bd6`: 1 warning
- **2025-09-24** `a222d9459767`: 1 breaking, 2 warning, 2 info
- **2025-02-07** `4d0f1a6c1ad9`: 1 breaking, 1 info
- **2024-10-11** `f89bf040698f`: 2 breaking, 2 warning
- **2024-08-01** `b33a9ea8493e`: 1 info
- **2023-12-13** `77f9aeb9339a`: 1 info
- **2023-02-01** `144a34ca6d74`: 2 breaking, 2 warning, 3 info

## Changes

- **2026-04-28** `d3f7d49a0bd6`: 1 warning
  - removed the request property `webauthn`
- **2025-09-24** `a222d9459767`: 1 breaking, 2 warning, 2 info
  - the response property `oneOf[#/components/schemas/WebAuthnChallengeResponse]/expires_at` became optional for the status `200`
  - removed the optional property `oneOf[#/components/schemas/WebAuthnChallengeResponse]/credential_creation_options` from the response with the `200` status
  - removed the optional property `oneOf[#/components/schemas/WebAuthnChallengeResponse]/credential_request_options` from the response with the `200` status
  - added the new optional request property `webauthn`
  - added the required property `oneOf[#/components/schemas/WebAuthnChallengeResponse]/webauthn` to the response with the `200` status
- **2025-02-07** `4d0f1a6c1ad9`: 1 breaking, 1 info
  - the `oneOf[#/components/schemas/WebAuthnChallengeResponse]/credential_creation_options/user/factors/items/web_authn_credential` response's property type changed from `jsonb` to `string` for status `200`
  - added the optional property `error_code` to the response with the `400` status
- **2024-10-11** `f89bf040698f`: 2 breaking, 2 warning
  - added `#/components/schemas/TOTPPhoneChallengeResponse, #/components/schemas/WebAuthnChallengeResponse` to the response body `oneOf` list for the response status `200`
  - the response's body type changed from `object` to no type for status `200`
  - removed the optional property `expires_at` from the response with the `200` status
  - removed the optional property `id` from the response with the `200` status
- **2024-08-01** `b33a9ea8493e`: 1 info
  - added optional request body
- **2023-12-13** `77f9aeb9339a`: 1 info
  - added the optional property `weak_password` to the response with the `400` status
- **2023-02-01** `144a34ca6d74`: 2 breaking, 2 warning, 3 info
  - removed the request body
  - the response's body type changed from no type to `object` for status `200`
  - removed the optional property `error_code` from the response with the `400` status
  - removed the optional property `weak_password` from the response with the `400` status
  - removed `#/components/schemas/TOTPPhoneChallengeResponse, #/components/schemas/WebAuthnChallengeResponse` from the response body `oneOf` list for the response status `200`
  - added the optional property `expires_at` to the response with the `200` status
  - added the optional property `id` to the response with the `200` status

---

[Operation](https://skmtc.dev/supabase/apis/supabase-auth-rest-api/docs/factors/:factorId/challenge/post.md) - [API](https://skmtc.dev/supabase/apis/supabase-auth-rest-api.md) - [Page](https://skmtc.dev/supabase/apis/supabase-auth-rest-api/changes/factors/:factorId/challenge/post)