---
title: "POST /v1/{+app}:exchangeAppAttestAssertion"
method: POST
path: "/v1/{+app}:exchangeAppAttestAssertion"
tags: ["projects"]
---

# POST /v1/{+app}:exchangeAppAttestAssertion

`POST /v1/{+app}:exchangeAppAttestAssertion`

Accepts an App Attest assertion and an artifact previously obtained from ExchangeAppAttestAttestation and verifies those with Apple. If valid, returns an AppCheckToken.

## Path parameters

- `app` string, required

## Request body

- GoogleFirebaseAppcheckV1ExchangeAppAttestAssertionRequest — Request message for the ExchangeAppAttestAssertion method.
  - `artifact` string, byte — Required. The artifact returned by a previous call to ExchangeAppAttestAttestation.
  - `assertion` string, byte — Required. The CBOR-encoded assertion returned by the client-side App Attest API.
  - `challenge` string, byte — Required. A one-time challenge returned by an immediately prior call to GenerateAppAttestChallenge.
  - `limitedUse` boolean — Specifies whether this attestation is for use in a *limited use* (`true`) or *session based* (`false`) context. To enable this attestation to be used with the *replay protection* feature, set this to `true`. The default value is `false`.

## Response `200`

Successful response

---

[API](https://skmtc.net/google/apis/firebaseappcheck.md) · [All operations](https://skmtc.net/google/apis/firebaseappcheck/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/google/firebaseappcheck/revisions/b321501ef5a5/schema)