---
title: "Challenge a ringing inbound SIP leg with a 401 digest auth request"
method: POST
path: "/legs/{id}/challenge"
tags: ["Legs"]
---

# Challenge a ringing inbound SIP leg with a 401 digest auth request

`POST /legs/{id}/challenge`

Sends a SIP 401 Unauthorized carrying a `WWW-Authenticate` digest challenge on an unanswered inbound INVITE. The current leg is torn down (a `leg.disconnected` with `reason="challenged"` is published); the UAC's credentialed re-INVITE arrives as a new inbound call surfaced via `leg.ringing` with `authenticated=true` once VoiceBlender verifies the response against the supplied credential. Provide either `password` or `ha1`. An invalid retry is answered with 403 Forbidden and never surfaced.

## Request body

- ChallengeRequest
  - `realm` string, required
  - `username` string
  - `password` string
  - `ha1` string
  - `algorithm` string
  - `qop` string[]
  - `max_expires` integer

## Response `202`

401 challenge queued

## Other responses

- `400` — Not a SIP inbound leg, or missing realm/credential
- `404` — Leg not found
- `409` — Leg is not in ringing or early_media state

---

[API](https://skmtc.net/voiceblender/apis/voiceblender-api.md) · [All operations](https://skmtc.net/voiceblender/apis/voiceblender-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/voiceblender/voiceblender-api/versions/ad30827d3b57/schema)