# Verify a specific Challenge.

**POST /v2/Services/{ServiceSid}/Entities/{Identity}/Challenges/{Sid}**

Verify a specific Challenge.


## Servers
- https://verify.twilio.com: https://verify.twilio.com ()


## Authentication methods
- Account sid auth token


## Parameters

### Path parameters
- **ServiceSid** (string)
  The unique SID identifier of the Service.
- **Identity** (string)
  Customer unique identity for the Entity owner of the Challenge. This identifier should be immutable, not PII, length between 8 and 64 characters, and generated by your external system, such as your user's UUID, GUID, or SID. It can only contain dash (-) separated alphanumeric characters.
- **Sid** (string)
  A 34 character string that uniquely identifies this Challenge.


### Body: application/x-www-form-urlencoded (object)

- **AuthPayload** (string)
  The optional payload needed to verify the Challenge. E.g., a TOTP would use the numeric code. For `TOTP` this value must be between 3 and 8 characters long. For `Push` this value can be up to 5456 characters in length
- **Metadata** ()
  Custom metadata associated with the challenge. This is added by the Device/SDK directly to allow for the inclusion of device information. It must be a stringified JSON with only strings values eg. `{"os": "Android"}`. Can be up to 1024 characters in length.


## Responses
### 200
OK
#### Headers
- **Twilio-Verify-Challenge-Signature** (string)

- **Access-Control-Allow-Origin** (string)
  Specify the origin(s) allowed to access the resource
- **Access-Control-Allow-Methods** (string)
  Specify the HTTP methods allowed when accessing the resource
- **Access-Control-Allow-Headers** (string)
  Specify the headers allowed when accessing the resource
- **Access-Control-Allow-Credentials** (boolean)
  Indicates whether the browser should include credentials
- **Access-Control-Expose-Headers** (string)
  Headers exposed to the client

#### Body: application/json (object)
- **sid** (string | null)
  A 34 character string that uniquely identifies this Challenge.
- **account_sid** (string | null)
  The unique SID identifier of the Account.
- **service_sid** (string | null)
  The unique SID identifier of the Service.
- **entity_sid** (string | null)
  The unique SID identifier of the Entity.
- **identity** (string | null)
  Customer unique identity for the Entity owner of the Challenge. This identifier should be immutable, not PII, length between 8 and 64 characters, and generated by your external system, such as your user's UUID, GUID, or SID. It can only contain dash (-) separated alphanumeric characters.
- **factor_sid** (string | null)
  The unique SID identifier of the Factor.
- **date_created** (string(date-time) | null)
  The date that this Challenge was created, given in [ISO 8601](https://en.wikipedia.org/wiki/ISO_8601) format.
- **date_updated** (string(date-time) | null)
  The date that this Challenge was updated, given in [ISO 8601](https://en.wikipedia.org/wiki/ISO_8601) format.
- **date_responded** (string(date-time) | null)
  The date that this Challenge was responded, given in [ISO 8601](https://en.wikipedia.org/wiki/ISO_8601) format.
- **expiration_date** (string(date-time) | null)
  The date-time when this Challenge expires, given in [ISO 8601](https://en.wikipedia.org/wiki/ISO_8601) format. The default value is five (5) minutes after Challenge creation. The max value is sixty (60) minutes after creation.
- **status** (string)
  The Status of this Challenge. One of `pending`, `expired`, `approved` or `denied`.
- **responded_reason** (string)
  Reason for the Challenge to be in certain `status`. One of `none`, `not_needed` or `not_requested`.
- **details** ()
  Details provided to give context about the Challenge. Intended to be shown to the end user.
- **hidden_details** ()
  Details provided to give context about the Challenge. Intended to be hidden from the end user. It must be a stringified JSON with only strings values eg. `{"ip": "172.168.1.234"}`
- **metadata** ()
  Custom metadata associated with the challenge. This is added by the Device/SDK directly to allow for the inclusion of device information. It must be a stringified JSON with only strings values eg. `{"os": "Android"}`. Can be up to 1024 characters in length.
- **factor_type** (string)
  The Factor Type of this Challenge. Currently `push` and `totp` are supported.
- **url** (string(uri) | null)
  The URL of this resource.
- **links** (object(uri-map) | null)
  Contains a dictionary of URL links to nested resources of this Challenge.


[Powered by Bump.sh](https://bump.sh)