---
title: "Create a challenge for a user"
method: POST
path: "/users/{userID}/challenges"
tags: ["Challenges"]
---

# Create a challenge for a user

`POST /users/{userID}/challenges`

Creates a new challenge to verify a login identifier for a user by given `userID`. Challenges come in three flavors: **Email OTP**, **SMS OTP**, and **Email Magiclink**.

**OTP** stands for One-Time Password. It is a unique code sent to the user via email or SMS, which they must enter to complete the verification process.

## Path parameters

- `userID` string, required

## Request body

- ChallengeCreateReq
  - `challengeType` 'email_otp' | 'email_link' | 'sms_otp', required
  - `identifierValue` string, required
  - `challengeMetadata` object
  - `lifetimeSeconds` integer
  - `clientInformation` ClientInformation, required
    - `remoteAddress` string, required — Client's IP address
    - `userAgent` string, required — Client's user agent
    - `clientEnvHandle` string — Client's environment handle
    - `javascriptFingerprint` string — Client's fingerprint
    - `javaScriptHighEntropy` JavaScriptHighEntropy
      - `platform` string, required
      - `platformVersion` string, required
      - `mobile` boolean, required
    - `bluetoothAvailable` boolean — Client's Bluetooth availability
    - `passwordManagerAvailable` boolean — Client's password manager availability
    - `userVerifyingPlatformAuthenticatorAvailable` boolean, required
    - `conditionalMediationAvailable` boolean, required
    - `clientCapabilities` ClientCapabilities, required
      - `conditionalCreate` boolean
      - `conditionalMediation` boolean
      - `hybridTransport` boolean
      - `passkeyPlatformAuthenticator` boolean
      - `userVerifyingPlatformAuthenticator` boolean
    - `privateMode` boolean
    - `parsedDeviceInfo` ParsedDeviceInfo, required
      - `browserName` string, required
      - `browserVersion` string, required
      - `osName` string, required
      - `osVersion` string, required
    - `nativeMeta` NativeMeta
      - `build` string, required
      - `deviceOwnerAuth` string
      - `isPlatformAuthenticatorAPISupported` boolean
      - `isBluetoothAvailable` boolean
      - `isBluetoothOn` boolean
      - `googlePlayServices` boolean
      - `deviceSecure` boolean
      - `brand` string
      - `model` string

## Response `200`

Challenge has been created.

- Challenge
  - `challengeID` string, required
  - `type` 'email_otp' | 'email_link' | 'sms_otp', required
  - `identifierValue` string, required
  - `value` string, required
  - `expires` integer, required
  - `status` 'pending' | 'completed' | 'expired', required

## Other responses

- `default` — Error

---

[API](https://skmtc.net/corbado/apis/corbado-backend-api.md) · [All operations](https://skmtc.net/corbado/apis/corbado-backend-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/corbado/corbado-backend-api/versions/1f6143efe426/schema)