Skip to main content
POST
Replace an owned code challenge

Authorizations

X-Customer-Auth-Intent
string
header
required

Original 256-bit client admission/replay secret, never a verification proof.

X-Customer-Challenge
string
header
required

Purpose-limited challenge capability, paired with the original intent secret.

Headers

Idempotency-Key
string
required

Caller-stable key reused only for retries of this exact request.

Required string length: 16 - 128
Pattern: ^[A-Za-z0-9._:-]{16,128}$

Path Parameters

merchantSlug
string
required
Required string length: 1 - 128
challengeId
string
required
Required string length: 1 - 128

Body

application/json

The body is of type object.

Response

Replacement grant. Lost responses replay only with original intent, old capability and exact resend key.

challengeId
string<uuid>
required
Pattern: ^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-4[0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12})$
challengeAccessToken
string
required
Pattern: ^[a-f0-9]{64}$
expiresAt
string<date-time>
required
Pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d:[0-5]\d(?:\.\d+)?(?:Z))$
resendAfter
string<date-time>
required
Pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d:[0-5]\d(?:\.\d+)?(?:Z))$