> For clean Markdown of any page, append .md to the page URL. > For a complete documentation index, see https://docs.withpersona.com/llms.txt. > For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.withpersona.com/_mcp/server. # Request a Relay challenge POST https://api.withpersona.com/api/privacy/v1/relays/challenge Content-Type: application/json Requests a Privacy Pass challenge for a claim type. The challenge materials returned here are used to obtain a Privacy Pass token, which is then redeemable to read claims from Relays with the same claim type. Reference: https://docs.withpersona.com/api-reference/relay/request-a-relay-challenge ## Request ### Headers - `Key-Inflection` (enum, optional) — Determines casing for the API response. - Allowed values: `camel`, `kebab`, `snake` - `Persona-Version` (enum, optional) — Server API version. More info on versioning can be found [here](https://docs.withpersona.com/versioning). - Allowed values: `2025-12-08`, `2025-10-27`, `2023-01-05`, `2022-09-01`, `2021-08-18`, `2021-07-05`, `2021-02-21`, `2020-05-18` ### Body (application/json) This endpoint expects an object. - `claim-type` (string, required) — Possible values: - live_human_presence - age_over18_germany - age_over18_united_kingdom - age_over18_verified - age_over18_france - age_over18_italy - age_over18_brazil - age_over18_australia - age_over16_australia - age_over21_verified Do not assume this is a static enumeration; Persona may add new claim types in the future without a versioned update. - `sandbox` (boolean, optional) — When true, Persona issues a sandbox-namespace challenge, redeemable only against sandbox Relays. When omitted or false, Persona issues a challenge for the claim-type namespace. ## Response ### 200 Returns the Privacy Pass challenge materials for the requested claim type. - `challenge` (string, required) — base64url-encoded PrivateToken challenge object (RFC 9577). Pass this to the Privacy Pass issuance flow to obtain a token. - `token-key` (string, required) — base64url-encoded DER public key used to issue the token. - `token-key-id` (string, required) — hex-encoded SHA-256 of `token-key`. ## Errors ### 400 Bad Request Error The request was unacceptable, often due to invalid parameters. - `errors` (list of RelaysChallengePostResponsesContentApplicationJsonSchemaErrorsItems, optional) ### 401 Unauthorized Error An invalid API key was provided. - `errors` (list of RelaysChallengePostResponsesContentApplicationJsonSchemaErrorsItems, optional) ### 403 Forbidden Error The given API key doesn’t have permissions to perform the request or a quota has been exceeded. - `errors` (list of RelaysChallengePostResponsesContentApplicationJsonSchemaErrorsItems, optional) ### 404 Not Found Error The requested resource doesn’t exist. - `errors` (list of RelaysChallengePostResponsesContentApplicationJsonSchemaErrorsItems, optional) ### 409 Conflict Error The request conflicts with another request, often due to attempting to create a duplicate resource. - `errors` (list of RelaysChallengePostResponsesContentApplicationJsonSchemaErrorsItems, optional) ### 422 Unprocessable Entity Error The request modifies the resource in an unacceptable way, often due to an invalid action or parameter. - `errors` (list of RelaysChallengePostResponsesContentApplicationJsonSchemaErrorsItems, optional) ### 429 Too Many Requests Error Your organization’s rate limit has been exceeded. We recommend an exponential backoff on requests. - `errors` (list of RelaysChallengePostResponsesContentApplicationJsonSchemaErrorsItems, optional) ## Types ### RelaysChallengePostResponsesContentApplicationJsonSchemaErrorsItems - `title` (string, optional) - `details` (string, optional) ## Examples **Request** ```json { "claim-type": "live_human_presence" } ``` **Response** ```json { "challenge": "eyJ0b2tlbl90eXBlIjoyfQ", "token-key": "MIIBIjANBgkqhkiG9w0B", "token-key-id": "a3c5f8e2d1b4079c6e5a2f8b1d3c4e5f6a7b8c9d0e1f2a3b4c5d6e7f8091a2b3c" } ``` **SDK Code** ```python Success import requests url = "https://api.withpersona.com/api/privacy/v1/relays/challenge" payload = { "claim-type": "live_human_presence" } headers = {"Content-Type": "application/json"} response = requests.post(url, json=payload, headers=headers) print(response.json()) ``` ```javascript Success const url = 'https://api.withpersona.com/api/privacy/v1/relays/challenge'; const options = { method: 'POST', headers: {'Content-Type': 'application/json'}, body: '{"claim-type":"live_human_presence"}' }; try { const response = await fetch(url, options); const data = await response.json(); console.log(data); } catch (error) { console.error(error); } ``` ```go Success package main import ( "fmt" "strings" "net/http" "io" ) func main() { url := "https://api.withpersona.com/api/privacy/v1/relays/challenge" payload := strings.NewReader("{\n \"claim-type\": \"live_human_presence\"\n}") req, _ := http.NewRequest("POST", url, payload) req.Header.Add("Content-Type", "application/json") res, _ := http.DefaultClient.Do(req) defer res.Body.Close() body, _ := io.ReadAll(res.Body) fmt.Println(res) fmt.Println(string(body)) } ``` ```ruby Success require 'uri' require 'net/http' url = URI("https://api.withpersona.com/api/privacy/v1/relays/challenge") http = Net::HTTP.new(url.host, url.port) http.use_ssl = true request = Net::HTTP::Post.new(url) request["Content-Type"] = 'application/json' request.body = "{\n \"claim-type\": \"live_human_presence\"\n}" response = http.request(request) puts response.read_body ``` ```java Success import com.mashape.unirest.http.HttpResponse; import com.mashape.unirest.http.Unirest; HttpResponse response = Unirest.post("https://api.withpersona.com/api/privacy/v1/relays/challenge") .header("Content-Type", "application/json") .body("{\n \"claim-type\": \"live_human_presence\"\n}") .asString(); ``` ```php Success request('POST', 'https://api.withpersona.com/api/privacy/v1/relays/challenge', [ 'body' => '{ "claim-type": "live_human_presence" }', 'headers' => [ 'Content-Type' => 'application/json', ], ]); echo $response->getBody(); ``` ```csharp Success using RestSharp; var client = new RestClient("https://api.withpersona.com/api/privacy/v1/relays/challenge"); var request = new RestRequest(Method.POST); request.AddHeader("Content-Type", "application/json"); request.AddParameter("application/json", "{\n \"claim-type\": \"live_human_presence\"\n}", ParameterType.RequestBody); IRestResponse response = client.Execute(request); ``` ```swift Success import Foundation let headers = ["Content-Type": "application/json"] let parameters = ["claim-type": "live_human_presence"] as [String : Any] let postData = JSONSerialization.data(withJSONObject: parameters, options: []) let request = NSMutableURLRequest(url: NSURL(string: "https://api.withpersona.com/api/privacy/v1/relays/challenge")! as URL, cachePolicy: .useProtocolCachePolicy, timeoutInterval: 10.0) request.httpMethod = "POST" request.allHTTPHeaderFields = headers request.httpBody = postData as Data let session = URLSession.shared let dataTask = session.dataTask(with: request as URLRequest, completionHandler: { (data, response, error) -> Void in if (error != nil) { print(error as Any) } else { let httpResponse = response as? HTTPURLResponse print(httpResponse) } }) dataTask.resume() ```