---
title: "GET /user/{userID}/challenge-request/{itemId}"
method: GET
path: "/user/{userID}/challenge-request/{itemId}"
tags: ["challenge-request"]
---

# GET /user/{userID}/challenge-request/{itemId}

`GET /user/{userID}/challenge-request/{itemId}`

Endpoint for apps to fetch a challenge request.

## Path parameters

- `userID` integer, required
- `itemId` integer, required

## Headers

- `Cache-Control` string
- `User-Agent` string, required
- `X-Bunq-Language` string
- `X-Bunq-Region` string
- `X-Bunq-Client-Request-Id` string
- `X-Bunq-Geolocation` string
- `X-Bunq-Client-Authentication` string, required

## Response `200`

Endpoint for apps to fetch a challenge request.

- MasterCardIdentityCheckChallengeRequestUserRead
  - `amount` string — The transaction amount.
  - `expiry_time` string — When the identity check expires.
  - `description` string — The description of the purchase. NULL if no description is given.
  - `status` string — The status of the secure code. Can be PENDING, ACCEPTED, REJECTED, EXPIRED.
  - `decision_description` string — Textual explanation of the decision.
  - `decision_description_translated` string — Textual explanation of the decision in user's language.
  - `url_merchant_app` string — The return url for the merchant app after the challenge is accepted or rejected.
  - `counterparty_alias` LabelMonetaryAccount
    - `iban` string — The IBAN of the monetary account.
    - `display_name` string — The name to display with this monetary account.
    - `avatar` Avatar
      - `uuid` string — The public UUID of the avatar.
      - `anchor_uuid` string — The public UUID of object this avatar is anchored to.
      - `image` Image[] — The actual image information of this avatar.
        - `attachment_public_uuid` string — The public UUID of the public attachment containing the image.
        - `content_type` string — The content-type as a MIME filetype.
        - `height` integer — The image height in pixels.
        - `width` integer — The image width in pixels.
      - `style` string — The style (if applicable) for this Avatar.
    - `label_user` LabelUser
      - `uuid` string — The public UUID of the label-user.
      - `display_name` string — The name to be displayed for this user, as it was given on the request.
      - `country` string — The country of the user. 000 stands for "unknown"
      - `avatar` Avatar
        - `uuid` string — The public UUID of the avatar.
        - `anchor_uuid` string — The public UUID of object this avatar is anchored to.
        - `image` Image[] — The actual image information of this avatar.
          - `attachment_public_uuid` string — The public UUID of the public attachment containing the image.
          - `content_type` string — The content-type as a MIME filetype.
          - `height` integer — The image height in pixels.
          - `width` integer — The image width in pixels.
        - `style` string — The style (if applicable) for this Avatar.
      - `public_nick_name` string — The current nickname of the user.
    - `country` string — The country of the user. Formatted as a ISO 3166-1 alpha-2 country code.
    - `bunq_me` Pointer
      - `type` string — The alias type, can be: EMAIL|PHONE_NUMBER|IBAN.
      - `value` string — The alias value.
      - `name` string — The alias name.
      - `service` string — The pointer service. Only required for external counterparties.
    - `is_light` boolean — Whether or not the monetary account is light.
    - `swift_bic` string — The BIC used for a SWIFT payment.
    - `swift_account_number` string — The account number used for a SWIFT payment. May or may not be an IBAN.
    - `transferwise_account_number` string — The account number used for a Transferwise payment. May or may not be an IBAN.
    - `transferwise_bank_code` string — The bank code used for a Transferwise payment. May or may not be a BIC.
    - `merchant_category_code` string — The merchant category code.
  - `event_id` integer — The ID of the latest event for the identity check.
  - `card_id` integer — The ID of the card used for the authentication request of the identity check.

## Other responses

- `400` — This is how the error response looks like for 4XX response codes

---

[API](https://skmtc.net/bunq/apis/bunq-api.md) · [All operations](https://skmtc.net/bunq/apis/bunq-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/bunq/bunq-api/revisions/369477c7bd26/schema)