# Get a challenge for App Attest

The first step of a session without an account. The challenge is valid for five minutes.

`POST https://api.switchfile.io/v1/app/guest/challenge`

No API key needed.

## Example

cURL:

```bash
curl "https://api.switchfile.io/v1/app/guest/challenge" \
  -d ""
```

Node.js:

```js
const res = await fetch("https://api.switchfile.io/v1/app/guest/challenge", {
  method: "POST",
});
if (!res.ok) throw new Error(`HTTP ${res.status}: ${await res.text()}`);
console.log(await res.json());
```

PHP:

```php
<?php
$ch = curl_init('https://api.switchfile.io/v1/app/guest/challenge');
curl_setopt_array($ch, [
    CURLOPT_POST => true,
    CURLOPT_POSTFIELDS => '',
    CURLOPT_RETURNTRANSFER => true,
]);
$response = curl_exec($ch);
$status = curl_getinfo($ch, CURLINFO_RESPONSE_CODE);
curl_close($ch);

if ($status >= 400) {
    throw new RuntimeException("HTTP $status: $response");
}
print_r(json_decode($response, true));
```

Python:

```python
import requests

res = requests.post(
    "https://api.switchfile.io/v1/app/guest/challenge",
)
res.raise_for_status()
print(res.json())
```

## Responses

### 200: OK

| Name | Type | Required | Description |
| --- | --- | --- | --- |
| `challenge` | string | yes | Pass the SHA-256 of these bytes (UTF-8) as clientDataHash to App Attest |
| `expires_in` | string (integer) \| integer | yes | Seconds the challenge stays valid |

Example (application/json):

```json
{
  "challenge": "1763116800.q8Jx2v3mQ0yS6nB1kR9tLw.Wm9vYmFyYmF6cXV4",
  "expires_in": 300
}
```

### 429: Too many requests or a daily quota is used up. See Retry-After (`RATE_LIMIT_EXCEEDED`)

Example (application/problem+json):

```json
{
  "type": "https://switchfile.io/docs/api/v1#errors-rate-limit-exceeded",
  "title": "Rate limit exceeded",
  "status": 429,
  "code": "RATE_LIMIT_EXCEEDED",
  "detail": "Too many requests. Try again in 12 seconds."
}
```

Error bodies and codes are explained in [Errors](https://switchfile.io/docs/errors).