> ## Documentation Index
> Fetch the complete documentation index at: https://docs.scute.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Verify a challenge

> Submit verification for a challenge.

**For OTP/backup code verification:** Send `code` parameter
**For WebAuthn verification:** Send `credential` parameter with assertion

On successful verification:
- `authenticate` and `mfa` challenges return session tokens
- `step_up`, `verify_contact`, `custom` challenges return completion status
- If MFA is required after authentication, returns `mfa_required: true` with a new MFA challenge




## OpenAPI

````yaml /swagger.json post /v1/auth/{app_id}/challenges/{token}/verify
openapi: 3.0.1
info:
  title: Scute API
  version: v1
  description: API for managing users in Scute applications
servers:
  - url: https://{defaultHost}
    variables:
      defaultHost:
        default: api.scute.io
  - url: http://localhost:3333
    description: Development server
security:
  - apiSecret: []
    userAccess: []
paths:
  /v1/auth/{app_id}/challenges/{token}/verify:
    parameters:
      - name: app_id
        in: path
        required: true
        description: App ID
        schema:
          type: string
      - name: token
        in: path
        description: Challenge token
        required: true
        schema:
          type: string
    post:
      tags:
        - Challenges
      summary: Verify a challenge
      description: >
        Submit verification for a challenge.


        **For OTP/backup code verification:** Send `code` parameter

        **For WebAuthn verification:** Send `credential` parameter with
        assertion


        On successful verification:

        - `authenticate` and `mfa` challenges return session tokens

        - `step_up`, `verify_contact`, `custom` challenges return completion
        status

        - If MFA is required after authentication, returns `mfa_required: true`
        with a new MFA challenge
      operationId: verifyChallenge
      parameters: []
      responses:
        '200':
          description: verification successful - step-up/custom
          content:
            application/json:
              schema:
                type: object
                properties:
                  access:
                    type: string
                    description: JWT access token
                  refresh:
                    type: string
                    description: JWT refresh token
                  csrf:
                    type: string
                    description: CSRF token
                  access_expires_at:
                    type: string
                    format: date-time
                  refresh_expires_at:
                    type: string
                    format: date-time
                  user_id:
                    type: string
                    description: App user ID
                  challenge:
                    $ref: '#/components/schemas/Challenge'
                  mfa_required:
                    type: boolean
                    example: true
                  mfa_challenge:
                    $ref: '#/components/schemas/Challenge'
                  available_methods:
                    type: array
                    items:
                      type: string
                    description: Available MFA methods for the user
                    example:
                      - totp
                      - sms
                      - email
                  status:
                    type: string
                    example: completed
                  intent:
                    type: string
                    description: The custom intent name
                  intent_fields:
                    type: object
                    description: Intent-specific data
        '422':
          description: verification failed
          content:
            application/json:
              schema:
                type: object
                properties:
                  error:
                    type: string
                    example: Invalid code
                  remaining_attempts:
                    type: integer
                    example: 2
                    description: Number of attempts remaining before lockout
      security: []
components:
  schemas:
    Challenge:
      type: object
      properties:
        token:
          type: string
          description: Unique challenge token
          example: ch_abc123xyz789
        status:
          type: string
          enum:
            - pending
            - completed
            - failed
            - expired
            - cancelled
            - denied
          description: Current challenge status
        purpose:
          type: string
          enum:
            - authenticate
            - mfa
            - step_up
            - verify_contact
            - verify_identity
            - custom
            - change_identifier
          description: Purpose of the challenge
        method:
          type: string
          enum:
            - email_otp
            - sms_otp
            - magic_link
            - totp
            - backup_code
            - webauthn
            - push
            - plaid_idv
          description: Verification method
        expires_at:
          type: string
          format: date-time
          description: When the challenge expires
        remaining_attempts:
          type: integer
          description: Number of verification attempts remaining
          example: 3
        time_remaining:
          type: integer
          description: Seconds until challenge expires
          example: 540
        intent:
          type: string
          nullable: true
          description: Custom intent name for custom challenges
        delivery_required:
          type: boolean
          description: Whether this challenge type requires delivery (OTP/magic link)
      required:
        - token
        - status
        - purpose
        - method
        - expires_at
  securitySchemes:
    apiSecret:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: API Secret token
    userAccess:
      type: apiKey
      name: X-Authorization
      in: header
      description: User Access token

````