curl --request GET \
--url https://api.cloud.corbado.io/v1/observe/challengeVariants \
--header 'Authorization: Bearer <token>'import requests
url = "https://api.cloud.corbado.io/v1/observe/challengeVariants"
headers = {"Authorization": "Bearer <token>"}
response = requests.get(url, headers=headers)
print(response.text)const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};
fetch('https://api.cloud.corbado.io/v1/observe/challengeVariants', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.cloud.corbado.io/v1/observe/challengeVariants",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "GET",
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://api.cloud.corbado.io/v1/observe/challengeVariants"
req, _ := http.NewRequest("GET", url, nil)
req.Header.Add("Authorization", "Bearer <token>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.get("https://api.cloud.corbado.io/v1/observe/challengeVariants")
.header("Authorization", "Bearer <token>")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.cloud.corbado.io/v1/observe/challengeVariants")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Get.new(url)
request["Authorization"] = 'Bearer <token>'
response = http.request(request)
puts response.read_body[
{
"id": "<string>",
"subFlowType": "passkey-login",
"type": "request",
"data": "<string>"
}
]{
"error": {
"message": "Validation failed",
"details": [
{
"field": "projectID",
"message": "required"
}
]
}
}List challenge variants
Lists Observe challenge/config variants (format chv-<number>) for the authenticated project — the
distinct WebAuthn request options and ceremony responses observed per subflow type. A request
variant describes the options served to the browser (e.g. a passkey-login request variant carries
allowCredentialCount, timeout, userVerification, hints and the estimated authenticator names behind the
allowlist). A response variant describes what the authenticator and browser returned (user
verification and backup flags, authenticator attachment, origin, extension results). Optionally filters
by subflow type and variant type. Use this to resolve the configVariantID / responseVariantID
returned by /observe/subFlows, or the t8 dimension of the login-subflow-passkey-v1 time series, into
readable data.
Required API key permission: observe:catalog:read.
curl --request GET \
--url https://api.cloud.corbado.io/v1/observe/challengeVariants \
--header 'Authorization: Bearer <token>'import requests
url = "https://api.cloud.corbado.io/v1/observe/challengeVariants"
headers = {"Authorization": "Bearer <token>"}
response = requests.get(url, headers=headers)
print(response.text)const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};
fetch('https://api.cloud.corbado.io/v1/observe/challengeVariants', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.cloud.corbado.io/v1/observe/challengeVariants",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "GET",
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://api.cloud.corbado.io/v1/observe/challengeVariants"
req, _ := http.NewRequest("GET", url, nil)
req.Header.Add("Authorization", "Bearer <token>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.get("https://api.cloud.corbado.io/v1/observe/challengeVariants")
.header("Authorization", "Bearer <token>")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.cloud.corbado.io/v1/observe/challengeVariants")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Get.new(url)
request["Authorization"] = 'Bearer <token>'
response = http.request(request)
puts response.read_body[
{
"id": "<string>",
"subFlowType": "passkey-login",
"type": "request",
"data": "<string>"
}
]{
"error": {
"message": "Validation failed",
"details": [
{
"field": "projectID",
"message": "required"
}
]
}
}Authorizations
Use an Observe API key from the management console. The key selects the project and must grant the permission listed on the operation. Keep this key on your server.
Query Parameters
Filter variants by subflow type.
passkey-login, passkey-enrollment Filter variants by type (request options or response data).
request, response Response
Challenge variants.
Challenge variant ID (format chv-<number>). The numeric part equals the raw config_variant_id surfaced
as the t8 dimension of the login-subflow-passkey-v1 time series.
Subflow type the variant belongs to.
passkey-login, passkey-enrollment Type of challenge variant (request options or response data).
request, response JSON-encoded variant data. For passkey-login request variants: allowCredentialCount, timeout, userVerification, hints, authenticatorEstimates (estimated provider names behind the allowlist, e.g. icloud-keychain; absent when the login ran without an allowlist). For passkey-enrollment request variants: excludeCredentialCount, timeout, attestation, authenticatorSelection, hints. Response variants (both subflow types): userPresent, userVerified, backupEligible, backupState (authenticator data flags), signCountZero (the authenticator reported no signature counter), attachment (platform, cross-platform or other; Safari reports platform even for cross-device logins), origin, crossOrigin, topOriginPresent, extensions (names of the returned extension results). Passkey-login response variants add userHandlePresent and inAllowList (whether the used credential was in the served allowlist; absent without an allowlist). Passkey-enrollment response variants add algorithm (COSE name of the created key, e.g. ES256), residentKey (credProps.rk), prfEnabled, transports (response.transports in the reported order; unknown values become other), credProtect (the policy the authenticator applied, e.g. userVerificationRequired) and authenticatorExtensions (names of the authenticator data extension outputs: credProtect, minPinLength, credBlob, hmac-secret, uvm, other). Fields absent from the browser response are omitted.
Was this page helpful?