---
title: "Track action"
method: POST
path: "/users/{userId}/actions/{action}"
tags: ["users"]
---

# Track action

`POST /users/{userId}/actions/{action}`

Record authentication events performed by users and initiate challenges via Authsignal's pre-built UI or Authsignal Client SDKs.

## Path parameters

- `userId` string, required
- `action` string, required

## Request body

- object
  - `redirectUrl` string — The URL which the pre-built UI will redirect back to after the user exits Authsignal's pre-built UI. Only required when using the pre-built UI in redirect mode.
  - `redirectToSettings` boolean — If set to true, the user will be shown the authentication settings screen after completing a challenge. Use this flag to allow users to manage their own authenticators through Authsignal's pre-built UI.
  - `email` string — The user's email address.
  - `phoneNumber` string — The user's phone number in E.164 format.
  - `ipAddress` string — The user's IP address. Should be provided when using rules based on location or other IP-derived features.
  - `userAgent` string — The user agent identifying a browser or app. Should be provided when using rules based on device.
  - `deviceId` string — An ID which identifies the user's device. Should be provided when using rules based on device.
  - `scope` string — The scopes granted to the pre-built UI and the token which can be passed to Client SDKs. By default the only scope is `read:authenticators`.
  - `custom` object — A JSON object which can include any key/value pairs. Should be provided when using rules based on custom data points from your own app.
  - `locale` string — The locale of the user in BCP 47 format. Used to localize the pre-built UI, email, and SMS messages.
  - `crypto` Crypto
    - `asset` string
    - `address` string
    - `txnHash` string
    - `assetAmount` number
    - `assetAmountUsd` number
  - `customDomain` string — The custom domain to use for the pre-built UI. If not provided, the default domain will be used.

## Response `200`

OK

- object
  - `state` 'ALLOW' | 'BLOCK' | 'CHALLENGE_REQUIRED' | 'CHALLENGE_FAILED' | 'CHALLENGE_SUCCEEDED' | 'REVIEW_REQUIRED' | 'REVIEW_FAILED' | 'REVIEW_SUCCEEDED' — The current state of the action.
  - `url` string — The URL for initiating a challenge using Authsignal's pre-built UI. You can redirect to this URL if the state determines that a challenge is required, or if you want to allow the user to enroll or to manage their existing authenticator settings.
  - `token` string — A short-lived token which can be passed to Authsignal's Client SDKs (e.g. when using passkeys) or to authenticate to Authsignal's client API.
  - `isEnrolled` boolean — True if the user is enrolled with at least one verification method and can be challenged.
  - `idempotencyKey` string — A unique key which identifies a particular action. This key can be used to determine if the user has successfully completed a challenge.
  - `allowedVerificationMethods` VerificationMethod[] — The list of verification methods which the user is permitted to enroll.
  - `enrolledVerificationMethods` VerificationMethod[] — The list of verification methods which the user has enrolled.
  - `defaultVerificationMethod` 'SMS' | 'AUTHENTICATOR_APP' | 'EMAIL_MAGIC_LINK' | 'EMAIL_OTP' | 'PUSH' | 'DEVICE' | 'SECURITY_KEY' | 'PASSKEY' | 'VERIFF' | 'IPROOV' | 'PALM_BIOMETRICS_RR' | 'IDVERSE'
  - `ruleIds` string[] — The IDs of the triggered rules.

## Other responses

- `400` — Invalid Request
- `401` — Unauthorized
- `404` — Not Found

---

[API](https://skmtc.net/authsignal/apis/call-connect-api.md) · [All operations](https://skmtc.net/authsignal/apis/call-connect-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/authsignal/call-connect-api/versions/5604d744e3ad/schema)