> ## Documentation Index > Fetch the complete documentation index at: https://docs.corbado.com/llms.txt > Use this file to discover all available pages before exploring further. # List challenge variants > Lists Observe challenge/config variants (format `chv-`) for the authenticated project — the distinct WebAuthn request/response configurations observed per subflow type (e.g. a passkey-login request variant carries allowCredentialCount, timeout, userVerification, hints and the estimated authenticator names behind the allowlist). Optionally filters by subflow type. Use this to resolve the configVariantID returned by /observe/subFlows or the t8 dimension of the login-subflow-passkey-v1 time series into readable configuration data. Required API key permission: `observe:catalog:read`. ## OpenAPI ````yaml /api-reference/openapi/observe.yaml get /observe/challengeVariants openapi: 3.1.1 info: version: 1.0.0 title: Corbado API description: > # Introduction This documentation gives an overview of all Corbado API calls to implement authentication observe. contact: name: Corbado team email: support@corbado.com url: https://www.corbado.com servers: - url: https://api.cloud.corbado.io/v1 security: - bearerAuth: [] tags: - name: ObserveFlow description: Flow search and related APIs x-group: Journeys and users - name: ObserveSubFlow description: Subflow search and related APIs x-group: Journeys and users - name: ObserveUser description: User search and related APIs x-group: Journeys and users - name: ObserveClientEnv description: Client environment search APIs x-group: Journeys and users - name: ObserveTimeSeries description: Time series query APIs x-group: Metrics and funnels - name: ObserveFunnel description: Historical funnel metrics, dictionaries and coverage. x-group: Metrics and funnels - name: ObserveEvent description: Event ingestion and event feed APIs x-group: Events - name: ObserveError description: Named authentication errors and recommendations. x-group: Error management - name: ObserveErrorFlavour description: Error variants and their impact on authentication outcomes. x-group: Error management - name: ObserveAlert description: Authentication alert rules, instances and history. x-group: Alert management - name: ObserveAnnotation description: Annotation APIs (dated notes for analytics context) x-group: Annotations - name: ObserveTableExport description: Table export file listing and download APIs x-group: Data exports - name: ObserveTimeSeriesExport description: Time-series export generation and downloads. x-group: Data exports - name: ObserveDataExport description: Data export APIs x-group: User data - name: ObserveDataDeletionJob description: Data deletion job APIs x-group: User data - name: ObserveFlowTypeDefinition description: Flow type definitions used in authentication journeys. x-group: Catalogs and labels - name: ObserveCatalog description: Catalog APIs x-group: Catalogs and labels - name: OpenAPI description: Downloadable API specification - name: ProjectOperationExecution description: Project-scoped operation history and pipeline health - name: ObserveClassification description: Flow and subflow classification APIs - name: ObserveIntegrationStats description: Integration stats APIs - name: ObserveTimeSeriesPrecalculation description: Time series precalculation APIs - name: ObserveIDList x-group: Saved ID lists description: Stored ID-list selection APIs - name: ObserveDataContext description: Schema-loose data context APIs for agent and debugging tooling - name: ObserveData description: Observe data administration APIs - name: ObserveTrackingStats description: Tracking ingestion stats APIs - name: ObserveExperiment x-group: Experiments description: Experiment catalog and run APIs - name: ObserveDataPolicy description: >- Project data policy catalogue (retention selected by the SDK's meta.dataPolicy code) - name: ObserveMetadata x-group: Metadata description: Authenticator metadata APIs (FIDO MDS + passkey AAGUID) - name: ObservePasskey x-group: Passkey analysis description: Observed passkey search and cohort analysis. paths: /observe/challengeVariants: get: tags: - ObserveCatalog summary: List challenge variants description: >- Lists Observe challenge/config variants (format `chv-`) for the authenticated project — the distinct WebAuthn request/response configurations observed per subflow type (e.g. a passkey-login request variant carries allowCredentialCount, timeout, userVerification, hints and the estimated authenticator names behind the allowlist). Optionally filters by subflow type. Use this to resolve the configVariantID returned by /observe/subFlows or the t8 dimension of the login-subflow-passkey-v1 time series into readable configuration data. Required API key permission: `observe:catalog:read`. operationId: ObserveChallengeVariantList parameters: - name: subFlowType in: query required: false description: Filter variants by subflow type. schema: type: string enum: - passkey-login - passkey-enrollment x-oapi-codegen-extra-tags: validate: omitempty,oneof=passkey-login passkey-enrollment responses: '200': description: Challenge variants. content: application/json: schema: type: array items: $ref: '#/components/schemas/observeChallengeVariant' default: $ref: '#/components/responses/error' security: - bearerAuth: - observe:catalog:read components: schemas: observeChallengeVariant: type: object required: - id - subFlowType - type - data properties: id: type: string description: >- Challenge variant ID (format `chv-`). The numeric part equals the raw config_variant_id surfaced as the t8 dimension of the login-subflow-passkey-v1 time series. subFlowType: type: string description: Subflow type the variant belongs to. enum: - passkey-login - passkey-enrollment type: type: string description: Type of challenge variant (request options or response data). enum: - request - response data: type: string description: >- JSON-encoded variant data. For passkey-login request variants: allowCredentialCount, timeout, userVerification, hints, authenticatorEstimates (estimated provider names behind the allowlist, e.g. icloud-keychain; absent when the login ran without an allowlist). errorRspV2: type: object required: - error properties: error: type: object required: - message properties: message: description: Error message type: string example: Validation failed details: description: Validation error details per field type: array items: type: object required: - field - message properties: field: description: Field name that failed validation type: string example: projectID message: description: Validation error message type: string example: required responses: error: description: Error content: application/json: schema: $ref: '#/components/schemas/errorRspV2' securitySchemes: bearerAuth: type: http scheme: bearer description: >- Use an Observe API key from the management console. The key selects the project and must grant the permission listed on the operation. Keep this key on your server. ````