---
title: "Request a Relay challenge"
method: POST
path: "/relays/challenge"
tags: ["relay"]
---

# Request a Relay challenge

`POST /relays/challenge`

## Request

- Base URL: `https://api.withpersona.com/api/v1`
- URL: `https://api.withpersona.com/api/v1/relays/challenge`
- Auth: none declared

Requests a Privacy Pass challenge for a claim type. The challenge materials returned here are used to obtain a Privacy Pass token, which is then redeemable to read claims from Relays with the same claim type.

## Headers

- `Key-Inflection` 'camel' | 'kebab' | 'snake'
- `Persona-Version` '2026-09-29' | '2025-12-08' | '2025-10-27' | '2023-01-05' | '2022-09-01' | '2021-08-18' | '2021-07-05' | '2021-02-21' | '2020-05-18': Server API version. More info on versioning can be found [here](https://docs.withpersona.com/versioning).

## Request body

- object
  - `claim-type` string, required: Possible values: - live_human_presence - age_over18_germany - age_over18_united_kingdom - age_over18_verified - age_over18_france - age_over18_italy - age_over18_brazil - age_over18_australia - age_over16_australia - age_over21_verified Do not assume this is a static enumeration; Persona may add new claim types in the future without a versioned update.
  - `sandbox` boolean: When true, Persona issues a sandbox-namespace challenge, redeemable only against sandbox Relays. When omitted or false, Persona issues a challenge for the claim-type namespace.

## Response `200`

Returns the Privacy Pass challenge materials for the requested claim type.

- RelayRequestARelayChallengeResponse200
  - `challenge` string, required: base64url-encoded PrivateToken challenge object (RFC 9577). Pass this to the Privacy Pass issuance flow to obtain a token.
  - `token-key` string, required: base64url-encoded DER public key used to issue the token.
  - `token-key-id` string, required: hex-encoded SHA-256 of `token-key`.

## Other responses

- `400`: The request was unacceptable, often due to invalid parameters.
- `401`: An invalid API key was provided.
- `403`: The given API key doesn’t have permissions to perform the request or a quota has been exceeded.
- `404`: The requested resource doesn’t exist.
- `409`: The request conflicts with another request, often due to attempting to create a duplicate resource.
- `422`: The request modifies the resource in an unacceptable way, often due to an invalid action or parameter.
- `429`: Your organization’s rate limit has been exceeded. We recommend an exponential backoff on requests.

---

[API](https://skmtc.dev/withpersona/apis/withpersona-7.md) - [All operations](https://skmtc.dev/withpersona/apis/withpersona-7/llms.txt) - [OpenAPI document](https://skmtc.dev/withpersona/apis/withpersona-7/revisions/904c4b28844f?raw)