# Method: challenge.create

- [HTTP request](https://developers.google.com/chrome/verified-access/reference/rest/v1/challenge/create#body.HTTP_TEMPLATE)
- [Request body](https://developers.google.com/chrome/verified-access/reference/rest/v1/challenge/create#body.request_body)
- [Response body](https://developers.google.com/chrome/verified-access/reference/rest/v1/challenge/create#body.response_body)
  - [JSON representation](https://developers.google.com/chrome/verified-access/reference/rest/v1/challenge/create#body.Challenge.SCHEMA_REPRESENTATION)
- [Authorization scopes](https://developers.google.com/chrome/verified-access/reference/rest/v1/challenge/create#body.aspect)

challenge.create API

### HTTP request

`POST https://verifiedaccess.googleapis.com/v1/challenge`

The URL uses [gRPC Transcoding](https://google.aip.dev/127) syntax.

### Request body

The request body must be empty.

### Response body

Result message for VerifiedAccess.CreateChallenge.

If successful, the response body contains data with the following structure:

| JSON representation |
|---|
| ``` { "challenge": { object (`https://developers.google.com/chrome/verified-access/reference/rest/v1/SignedData`) }, "alternativeChallenge": { object (`https://developers.google.com/chrome/verified-access/reference/rest/v1/SignedData`) } } ``` |

| Fields ||
|---|---|
| `challenge` | ``object (`https://developers.google.com/chrome/verified-access/reference/rest/v1/SignedData`)`` Generated challenge |
| `alternativeChallenge` | ``object (`https://developers.google.com/chrome/verified-access/reference/rest/v1/SignedData`)`` Challenge generated with the old signing key (this will only be present during key rotation) |

### Authorization scopes

Requires the following OAuth scope:

- `https://www.googleapis.com/auth/verifiedaccess`

For more information, see the [OAuth 2.0 Overview](https://developers.google.com/identity/protocols/OAuth2).