Get Challenge

This endpoint is called automatically by the SDK. You typically don’t need to call it directly.

Request

GET /api/v1/attestation/challenge

Header	Required	Description
`X-Bundle-ID`	Yes	App bundle identifier
`X-Team-ID`	Yes	Apple Developer Team ID

Parameter	Type	Description
`device_id`	`string`	Optional device identifier. Stored with the challenge and echoed into the `deviceId` claim of the token minted by validate

{
  "challenge": "a1b2c3d4e5f6...",
  "expiresAt": "2026-03-10T12:05:00Z"
}

Field	Type	Description
`challenge`	`string`	Cryptographic challenge token
`expiresAt`	`string`	ISO 8601 expiration timestamp

Challenges are single-use and expire after 5 minutes by default. The SDK handles expiration and retries automatically.

Status	Code	Meaning
400	`bad_request`	Missing `X-Bundle-ID` or `X-Team-ID` header
402	`quota_exceeded`	Monthly active device limit reached and the grace period has expired. The check runs here so the SDK fails before spending a challenge. Response includes `limit`, `current`, and `upgradeUrl`
403	`forbidden`	Organization account is not active
404	`not_found`	No active app registered for this Bundle ID + Team ID pair
429	`rate_limited`	Per-IP limit or the per-tenant `challenge` bucket. Check `Retry-After` and the `X-RateLimit-*` headers

Both a per-IP limit and the per-tenant challenge bucket apply to this endpoint — see API Conventions.