Skip to content
Authrim

Create a DID authentication challenge.

POST
/api/auth/dids/challenge
Code sample: Shell / cURL 
curl --request POST \
  --url https://auth.example.com/api/auth/dids/challenge \
  --header 'Content-Type: application/json' \
  --data '{ "did": "did:web:example.com" }'

DID login is off unless the tenant turns it on (authentication-methods.did.login_enabled, default false). Where it is off the request is refused with 403 (503 when the tenant’s settings cannot be read) before the DID is resolved or a challenge is stored, whatever the DID, so nothing about a DID or its link to an account is revealed.

Request Body required

Section titled “Request Body required ”
Media type application/json
object
did
required
string
nonce
string
Example 
{
  "did": "did:web:example.com"
}

Responses

Section titled “ Responses ”

200

Section titled “200 ”

Successful JSON response.

Media type application/json
object
challenge_id
required
string
challenge
required
string
nonce
required
string
allowed_verification_methods
required
Array<object>
object
id
string
type
string
controller
string
publicKeyJwk
object
key
additional properties
expires_in
required
integer
Example 
{
  "challenge_id": "challenge_123",
  "challenge": "Sign this challenge",
  "nonce": "nonce_123",
  "allowed_verification_methods": [
    {
      "id": "did:web:example.com#key-1",
      "type": "JsonWebKey2020",
      "controller": "did:web:example.com",
      "publicKeyJwk": {
        "kty": "OKP",
        "crv": "Ed25519",
        "x": "..."
      }
    }
  ],
  "expires_in": 300
}

403

Section titled “403 ”

Error response.

Media type application/json
object
error
string
error_description
string
message
string
webauthn_signal

Optional browser-side WebAuthn Signal API hint. When unknown_credential is true, clients that just received a WebAuthn credential assertion may call PublicKeyCredential.signalUnknownCredential() for that credential ID.

object
unknown_credential
boolean
key
additional properties
Example generated
{
  "error": "example",
  "error_description": "example",
  "message": "example",
  "webauthn_signal": {
    "unknown_credential": true
  }
}

503

Section titled “503 ”

Error response.

Media type application/json
object
error
string
error_description
string
message
string
webauthn_signal

Optional browser-side WebAuthn Signal API hint. When unknown_credential is true, clients that just received a WebAuthn credential assertion may call PublicKeyCredential.signalUnknownCredential() for that credential ID.

object
unknown_credential
boolean
key
additional properties
Example generated
{
  "error": "example",
  "error_description": "example",
  "message": "example",
  "webauthn_signal": {
    "unknown_credential": true
  }
}