---
title: "POST /v1/{+app}:exchangeAppAttestAttestation"
method: POST
path: "/v1/{+app}:exchangeAppAttestAttestation"
tags: ["projects"]
---

# POST /v1/{+app}:exchangeAppAttestAttestation

`POST /v1/{+app}:exchangeAppAttestAttestation`

Accepts an App Attest CBOR attestation and verifies it with Apple using your preconfigured team and bundle IDs. If valid, returns an attestation artifact that can later be exchanged for an AppCheckToken using ExchangeAppAttestAssertion. For convenience and performance, this method's response object will also contain an AppCheckToken (if the verification is successful).

## Path parameters

- `app` string, required

## Request body

- GoogleFirebaseAppcheckV1ExchangeAppAttestAttestationRequest — Request message for the ExchangeAppAttestAttestation method.
  - `keyId` string, byte — Required. The key ID generated by App Attest for the client app.
  - `attestationStatement` string, byte — Required. The App Attest statement returned by the client-side App Attest API. This is a base64url encoded CBOR object in the JSON response.
  - `challenge` string, byte — Required. A one-time challenge returned by an immediately prior call to GenerateAppAttestChallenge.
  - `limitedUse` boolean — Specifies whether this attestation is for use in a *limited use* (`true`) or *session based* (`false`) context. To enable this attestation to be used with the *replay protection* feature, set this to `true`. The default value is `false`.

## Response `200`

Successful response

---

[API](https://skmtc.net/google/apis/firebaseappcheck.md) · [All operations](https://skmtc.net/google/apis/firebaseappcheck/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/google/firebaseappcheck/versions/b321501ef5a5/schema)