---
title: "Approve a Passkeys Challenge"
method: POST
path: "/v2/Services/{ServiceSid}/Passkeys/ApproveChallenge"
---

# Approve a Passkeys Challenge

`POST /v2/Services/{ServiceSid}/Passkeys/ApproveChallenge`

Approve a Passkeys challenge

## Path parameters

- `ServiceSid` string, required

## Request body

- object
  - `id` string, required — A [base64url](https://base64.guru/standards/base64url) encoded representation of `rawId`.
  - `rawId` string, required — The globally unique identifier for this `PublicKeyCredential`.
  - `authenticatorAttachment` 'platform' | 'cross-platform', required — A string that indicates the mechanism by which the WebAuthn implementation is attached to the authenticator at the time the associated `navigator.credentials.create()` or `navigator.credentials.get()` call completes.
  - `type` 'public-key' — The valid credential types supported by the API. The values of this enumeration are used for versioning the `AuthenticatorAssertion` and `AuthenticatorAttestation` structures according to the type of the authenticator.
  - `response` object, required — The result of a WebAuthn authentication via a `navigator.credentials.get()` request, as specified in [AuthenticatorAttestationResponse](https://developer.mozilla.org/en-US/docs/Web/API/AuthenticatorAttestationResponse).
    - `authenticatorData` string, required — The [authenticator data](https://developer.mozilla.org/en-US/docs/Web/API/Web_Authentication_API/Authenticator_data) structure contains information from the authenticator about the processing of a credential creation or authentication request.
    - `clientDataJSON` string, required — This property contains the JSON-compatible serialization of the data passed from the browser to the authenticator in order to generate this credential.
    - `signature` string, required — An assertion signature over `authenticatorData` and `clientDataJSON`. The assertion signature is created with the private key of the key pair that was created during the originating `navigator.credentials.create()` call and verified using the public key of that same key pair.
    - `userHandle` string — The user handle stored in the authenticator, specified as `user.id` in the options passed to the originating `navigator.credentials.create()` call. This property should contain a base64url-encoded entity SID.

## Response `200`

Approved

- object
  - `sid` string, nullable — A 34 character string that uniquely identifies this Challenge.
  - `account_sid` string, nullable — The unique SID identifier of the Account.
  - `service_sid` string, nullable — The unique SID identifier of the Service.
  - `entity_sid` string, nullable — The unique SID identifier of the Entity.
  - `identity` string, nullable — Customer unique identity for the Entity owner of the Challenge.
  - `factor_sid` string, nullable — The unique SID identifier of the Factor.
  - `date_created` string, date-time, nullable — The date that this Challenge was created, given in [ISO 8601](https://en.wikipedia.org/wiki/ISO_8601) format.
  - `date_updated` string, date-time, nullable — The date that this Challenge was updated, given in [ISO 8601](https://en.wikipedia.org/wiki/ISO_8601) format.
  - `date_responded` string, date-time, nullable — The date that this Challenge was responded, given in [ISO 8601](https://en.wikipedia.org/wiki/ISO_8601) format.
  - `expiration_date` string, date-time, nullable — The date-time when this Challenge expires, given in [ISO 8601](https://en.wikipedia.org/wiki/ISO_8601) format.
  - `status` 'pending' | 'expired' | 'approved' | 'denied' — The Status of this Challenge. One of `pending`, `expired`, `approved` or `denied`.
  - `responded_reason` 'none' | 'not_needed' | 'not_requested' — Reason for the Challenge to be in certain `status`. One of `none`, `not_needed` or `not_requested`.
  - `details` unknown
  - `hidden_details` unknown
  - `metadata` unknown
  - `factor_type` 'push' | 'totp' | 'passkeys' — The Factor Type of this Challenge. Currently `push` and `totp` are supported.
  - `url` string, uri, nullable — The URL of this resource.
  - `links` object, nullable — Contains a dictionary of URL links to nested resources of this Challenge.
  - `options` object — An object that contains challenge options. Currently only used for `passkeys`.

---

[API](https://skmtc.net/twilio/apis/verify-v2.md) · [All operations](https://skmtc.net/twilio/apis/verify-v2/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/twilio/verify-v2/versions/976da0a42d57/schema)