Create an Email Verification Protocol nonce for the active runtime Flow step.

POST

/api/v1/login/interactions/{interaction_id}/email-verification/challenge

Code sample: Shell / cURL

curl --request POST \
  --url https://auth.example.com/api/v1/login/interactions/example/email-verification/challenge \
  --header 'Content-Type: application/json' \
  --data '{ "step_id": "example", "contract_hash": "example", "signature": "example" }'

Returns a short-lived nonce only when mail OTP is enabled and the active Flow step is an explicit email-verification step, or its mail-OTP branch leads directly to one. A response with available=false means the client must use the normal mail-OTP path.

Parameters

Path Parameters

interaction_id

required

string

Request Body ^required

Media type application/json

object

step_id

required

string

contract_hash

required

string

signature

required

string

key

additional properties

Example ^generated

{
  "step_id": "example",
  "contract_hash": "example",
  "signature": "example"
}

Responses

200

Email Verification Protocol availability and, when available, its nonce.

Media type application/json

object

available

required

boolean

challenge_id

string

nonce

string

expires_in

integer

interaction_id

string

step_id

string

Example ^generated

{
  "available": true,
  "challenge_id": "example",
  "nonce": "example",
  "expires_in": 1,
  "interaction_id": "example",
  "step_id": "example"
}

Headers

Cache-Control

string

Set to no-store when a nonce is returned.

400

Error response.

Media type application/json

object

error

string

error_description

string

message

string

webauthn_signal

Optional browser-side WebAuthn Signal API hint. When unknown_credential is true, clients that just received a WebAuthn credential assertion may call PublicKeyCredential.signalUnknownCredential() for that credential ID.

object

unknown_credential

boolean

key

additional properties

Example ^generated

{
  "error": "example",
  "error_description": "example",
  "message": "example",
  "webauthn_signal": {
    "unknown_credential": true
  }
}

403

Error response.

Media type application/json

object

error

string

error_description

string

message

string

webauthn_signal

Optional browser-side WebAuthn Signal API hint. When unknown_credential is true, clients that just received a WebAuthn credential assertion may call PublicKeyCredential.signalUnknownCredential() for that credential ID.

object

unknown_credential

boolean

key

additional properties

Example ^generated

{
  "error": "example",
  "error_description": "example",
  "message": "example",
  "webauthn_signal": {
    "unknown_credential": true
  }
}

404

Error response.

Media type application/json

object

error

string

error_description

string

message

string

webauthn_signal

Optional browser-side WebAuthn Signal API hint. When unknown_credential is true, clients that just received a WebAuthn credential assertion may call PublicKeyCredential.signalUnknownCredential() for that credential ID.

object

unknown_credential

boolean

key

additional properties

Example ^generated

{
  "error": "example",
  "error_description": "example",
  "message": "example",
  "webauthn_signal": {
    "unknown_credential": true
  }
}

409

Error response.

Media type application/json

object

error

string

error_description

string

message

string

webauthn_signal

Optional browser-side WebAuthn Signal API hint. When unknown_credential is true, clients that just received a WebAuthn credential assertion may call PublicKeyCredential.signalUnknownCredential() for that credential ID.

object

unknown_credential

boolean

key

additional properties

Example ^generated

{
  "error": "example",
  "error_description": "example",
  "message": "example",
  "webauthn_signal": {
    "unknown_credential": true
  }
}

500

Error response.

Media type application/json

object

error

string

error_description

string

message

string

webauthn_signal

Optional browser-side WebAuthn Signal API hint. When unknown_credential is true, clients that just received a WebAuthn credential assertion may call PublicKeyCredential.signalUnknownCredential() for that credential ID.

object

unknown_credential

boolean

key

additional properties

Example ^generated

{
  "error": "example",
  "error_description": "example",
  "message": "example",
  "webauthn_signal": {
    "unknown_credential": true
  }
}