Skip to main content
POST
/
auth
/
credentials
/
{id}
/
challenge
cURL
curl --request POST \
  --url https://api.lightspark.com/grid/2025-10-13/auth/credentials/{id}/challenge \
  --header 'Authorization: Basic <encoded-value>'
{
  "id": "AuthMethod:019542f5-b3e7-1d02-0000-000000000001",
  "accountId": "InternalAccount:019542f5-b3e7-1d02-0000-000000000002",
  "type": "EMAIL_OTP",
  "nickname": "example@lightspark.com",
  "createdAt": "2026-04-08T15:30:01Z",
  "updatedAt": "2026-04-08T15:35:00Z"
}

Authorizations

​
Authorization
string
header
required

API token authentication using format <api token id>:<api client secret>

Path Parameters

​
id
string
required

The id of the authentication credential to re-challenge (the id field of the AuthMethod returned from POST /auth/credentials).

Response

Challenge re-issued for the authentication credential. For EMAIL_OTP the body is a plain AuthMethod and a new OTP email has been sent. For PASSKEY the body is a PasskeyAuthChallenge carrying the freshly issued challenge, requestId, and expiresAt required to complete reauthentication via POST /auth/credentials/{id}/verify.

Strict wrapper around AuthMethod used inside AuthCredentialResponseOneOf for the EMAIL_OTP and OAUTH branches. The only difference from AuthMethod is unevaluatedProperties: false, which disambiguates the oneOf against PasskeyAuthChallenge — without the strictness, an AuthMethod with extra fields would ambiguously match both branches.

​
id
string
required

System-generated unique identifier for the authentication credential.

Example:

"AuthMethod:019542f5-b3e7-1d02-0000-000000000001"

​
accountId
string
required

Identifier of the internal account that this credential authenticates.

Example:

"InternalAccount:019542f5-b3e7-1d02-0000-000000000002"

​
type
enum<string>
required

The type of authentication credential.

  • OAUTH: OpenID Connect (OIDC) token issued by an identity provider such as Google or Apple.
  • EMAIL_OTP: A one-time password delivered to the user's email address.
  • PASSKEY: A WebAuthn passkey bound to the user's device.
Available options:
OAUTH,
EMAIL_OTP,
PASSKEY
​
nickname
string
required

Human-readable identifier for this credential. For EMAIL_OTP credentials this is the email address; for OAUTH credentials it is typically the email claim from the OIDC token; for PASSKEY credentials it is the nickname provided at registration time.

Example:

"example@lightspark.com"

​
createdAt
string<date-time>
required

Creation timestamp.

Example:

"2026-04-08T15:30:01Z"

​
updatedAt
string<date-time>
required

Last update timestamp.

Example:

"2026-04-08T15:35:00Z"