---
title: "Allows verification of a controller or cluster of controllers as being the valid target for enrollment."
method: POST
path: "/enroll/challenge"
tags: ["Enroll"]
---

# Allows verification of a controller or cluster of controllers as being the valid target for enrollment.

`POST /enroll/challenge`

A caller may submit a nonce and a key id (kid) from the enrollment JWKS endpoint or enrollment JWT that will
be used to sign the nonce. The resulting signature may be validated with the associated public key in order
to verify a networks identity during enrollment. The nonce must be a valid formatted UUID.

## Request body

- NonceChallenge
  - `keyId` string, required
  - `nonce` string, uuid, required

## Response `200`

A nonce challenge response. The contents will be the signature of the nonce, the key id used, and algorithm used to produce the signature.

- NonceSignature
  - `algorithm` string, required
  - `caPool` string, required
  - `kid` string, required
  - `signature` string, required

## Other responses

- `400` — The supplied request contains invalid fields or could not be parsed (json and non-json bodies). The error's code, message, and cause fields can be inspected for further information
- `429` — The resource requested is rate limited and the rate limit has been exceeded

---

[API](https://skmtc.net/openziti/apis/ziti-edge-client.md) · [All operations](https://skmtc.net/openziti/apis/ziti-edge-client/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/openziti/ziti-edge-client/revisions/25da9a73a095/schema)