---
title: "Update action"
method: PATCH
path: "/users/{userId}/actions/{action}/{idempotencyKey}"
tags: ["users"]
---

# Update action

`PATCH /users/{userId}/actions/{action}/{idempotencyKey}`

Update an action.

## Path parameters

- `userId` string, required
- `action` string, required
- `idempotencyKey` string, required

## Response `200`

OK

- UpdateActionResponseBody
  - `state` 'ALLOW' | 'BLOCK' | 'CHALLENGE_REQUIRED' | 'CHALLENGE_FAILED' | 'CHALLENGE_SUCCEEDED' | 'REVIEW_REQUIRED' | 'REVIEW_FAILED' | 'REVIEW_SUCCEEDED' — The current state of the action.
  - `createdAt` string, date-time — The time in ISO 8061 format when the action was first created via track.
  - `stateUpdatedAt` string, date-time — The time in ISO 8061 format when the state of the action was last updated.
  - `output` ActionOutput — The output produced by the rules engine when determining if the action requires a challenge.
    - `custom` object — The custom data passed as input when tracking the action.
    - `device` object — Device information associated with the action.
      - `attestationResult` AttestationResult
        - `verdict` 'VALID' | 'FAILED_INTEGRITY' | 'FAILED_APP_IDENTITY' | 'FAILED_DEVICE' | 'ERROR', required — The overall attestation verdict.
        - `provider` 'APP_ATTEST' | 'PLAY_INTEGRITY', required — The attestation provider used.
        - `deviceIntegrity` boolean, required — Whether the device passed integrity checks (not rooted/jailbroken).
        - `appIntegrity` boolean, required — Whether the calling app matches the expected package/bundle.
        - `riskMetric` number — iOS only. Approximate count of unique attestations for this device over the past 30 days.
        - `keyId` string — iOS only. The attestation key identifier.
        - `bundleId` string — iOS only. The matched bundle identifier.
        - `deviceActivityLevel` string — Android only. Token request volume level: LEVEL_1 (low) to LEVEL_4 (high).
        - `playProtectVerdict` string — Android only. Play Protect malware status: NO_ISSUES, MEDIUM_RISK, HIGH_RISK, etc.
        - `deviceRecognitionVerdict` string[] — Android only. Device integrity labels (e.g. MEETS_BASIC_INTEGRITY, MEETS_DEVICE_INTEGRITY, MEETS_STRONG_INTEGRITY).
        - `appRecognitionVerdict` string — Android only. App recognition verdict: PLAY_RECOGNIZED, UNRECOGNIZED_VERSION, UNEVALUATED.
        - `appLicensingVerdict` string — Android only. App licensing verdict: LICENSED, UNLICENSED, UNEVALUATED.
        - `sdkVersion` number — Android only. Android SDK version of the OS running on the device.
        - `requestPackageName` string — Android only. The package name from the request.
        - `versionCode` string — Android only. The app version code.
        - `appAccessRiskVerdict` string[] — Android only. Apps detected on device by App Access Risk (e.g. KNOWN_INSTALLED, UNKNOWN_INSTALLED).
  - `verificationMethod` 'SMS' | 'AUTHENTICATOR_APP' | 'EMAIL_MAGIC_LINK' | 'EMAIL_OTP' | 'PUSH' | 'DEVICE' | 'SECURITY_KEY' | 'PASSKEY' | 'VERIFF' | 'IPROOV' | 'PALM_BIOMETRICS_RR' | 'IDVERSE'
  - `ruleIds` string[] — The IDs of the triggered rules.

## Other responses

- `400` — Invalid Request
- `401` — Unauthorized
- `404` — Not Found

---

[API](https://skmtc.net/authsignal/apis/call-connect-api.md) · [All operations](https://skmtc.net/authsignal/apis/call-connect-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/authsignal/call-connect-api/versions/5604d744e3ad/schema)