---
title: "Challenge a ringing inbound SIP leg with a 401 digest auth request"
method: POST
path: "/legs/{id}/challenge"
tags: ["Legs"]
---

# Challenge a ringing inbound SIP leg with a 401 digest auth request

`POST /legs/{id}/challenge`

Sends a SIP 401 Unauthorized carrying a `WWW-Authenticate` digest challenge on an unanswered inbound INVITE. The current leg is torn down (a `leg.disconnected` with `reason="challenged"` is published); the UAC's credentialed re-INVITE arrives as a new inbound call surfaced via `leg.ringing` with `authenticated=true` once VoiceBlender verifies the response against the supplied credential. Provide either `password` or `ha1`. An invalid retry is answered with 403 Forbidden and never surfaced.

## Request body

- ChallengeRequest
  - `realm` string, required
  - `username` string
  - `password` string
  - `ha1` string
  - `algorithm` string
  - `qop` string[]
  - `max_expires` integer

## Response `202`

401 challenge queued

## Other responses

- `400` — Not a SIP inbound leg, or missing realm/credential
- `404` — Leg not found
- `409` — Leg is not in ringing or early_media state

## Changes

- **2026-07-08** `dd81a8d77dba` — 1 info
  - added the new optional request property `max_expires`
- **2026-07-04** `8e2966a803c8` — 1 info
  - endpoint added
- **2026-03-26** `d09c97c6ca8c` — 1 breaking
  - api path removed without deprecation

[Change history](https://skmtc.dev/voiceblender/apis/voiceblender-api/changes/legs/:id/challenge/post.md)

---

[API](https://skmtc.dev/voiceblender/apis/voiceblender-api.md) · [All operations](https://skmtc.dev/voiceblender/apis/voiceblender-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/voiceblender/voiceblender-api/revisions/89ff267f0958/schema)