Create AAL2 Challenge
curl --request POST \
--url https://api.sandbox.metriport.com/medical/v1/identity/aal2/challenge \
--header 'Content-Type: application/json' \
--header 'x-api-key: <api-key>' \
--data '
{
"proofedIdentityId": "<string>",
"redirectUrl": "<string>"
}
'import requests
url = "https://api.sandbox.metriport.com/medical/v1/identity/aal2/challenge"
payload = {
"proofedIdentityId": "<string>",
"redirectUrl": "<string>"
}
headers = {
"x-api-key": "<api-key>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {'x-api-key': '<api-key>', 'Content-Type': 'application/json'},
body: JSON.stringify({proofedIdentityId: '<string>', redirectUrl: '<string>'})
};
fetch('https://api.sandbox.metriport.com/medical/v1/identity/aal2/challenge', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.sandbox.metriport.com/medical/v1/identity/aal2/challenge",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'proofedIdentityId' => '<string>',
'redirectUrl' => '<string>'
]),
CURLOPT_HTTPHEADER => [
"Content-Type: application/json",
"x-api-key: <api-key>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.sandbox.metriport.com/medical/v1/identity/aal2/challenge"
payload := strings.NewReader("{\n \"proofedIdentityId\": \"<string>\",\n \"redirectUrl\": \"<string>\"\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("x-api-key", "<api-key>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.sandbox.metriport.com/medical/v1/identity/aal2/challenge")
.header("x-api-key", "<api-key>")
.header("Content-Type", "application/json")
.body("{\n \"proofedIdentityId\": \"<string>\",\n \"redirectUrl\": \"<string>\"\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.sandbox.metriport.com/medical/v1/identity/aal2/challenge")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["x-api-key"] = '<api-key>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"proofedIdentityId\": \"<string>\",\n \"redirectUrl\": \"<string>\"\n}"
response = http.request(request)
puts response.read_body{
"challengeId": "<string>",
"challengeUrl": "<string>",
"expiresAt": "<string>",
"method": "<string>"
}IAS
Create AAL2 Challenge
Issues a fresh multifactor challenge for a verified user.
POST
/
medical
/
v1
/
identity
/
aal2
/
challenge
Create AAL2 Challenge
curl --request POST \
--url https://api.sandbox.metriport.com/medical/v1/identity/aal2/challenge \
--header 'Content-Type: application/json' \
--header 'x-api-key: <api-key>' \
--data '
{
"proofedIdentityId": "<string>",
"redirectUrl": "<string>"
}
'import requests
url = "https://api.sandbox.metriport.com/medical/v1/identity/aal2/challenge"
payload = {
"proofedIdentityId": "<string>",
"redirectUrl": "<string>"
}
headers = {
"x-api-key": "<api-key>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {'x-api-key': '<api-key>', 'Content-Type': 'application/json'},
body: JSON.stringify({proofedIdentityId: '<string>', redirectUrl: '<string>'})
};
fetch('https://api.sandbox.metriport.com/medical/v1/identity/aal2/challenge', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.sandbox.metriport.com/medical/v1/identity/aal2/challenge",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'proofedIdentityId' => '<string>',
'redirectUrl' => '<string>'
]),
CURLOPT_HTTPHEADER => [
"Content-Type: application/json",
"x-api-key: <api-key>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.sandbox.metriport.com/medical/v1/identity/aal2/challenge"
payload := strings.NewReader("{\n \"proofedIdentityId\": \"<string>\",\n \"redirectUrl\": \"<string>\"\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("x-api-key", "<api-key>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.sandbox.metriport.com/medical/v1/identity/aal2/challenge")
.header("x-api-key", "<api-key>")
.header("Content-Type", "application/json")
.body("{\n \"proofedIdentityId\": \"<string>\",\n \"redirectUrl\": \"<string>\"\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.sandbox.metriport.com/medical/v1/identity/aal2/challenge")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["x-api-key"] = '<api-key>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"proofedIdentityId\": \"<string>\",\n \"redirectUrl\": \"<string>\"\n}"
response = http.request(request)
puts response.read_body{
"challengeId": "<string>",
"challengeUrl": "<string>",
"expiresAt": "<string>",
"method": "<string>"
}Returns a single-use URL where the user authenticates with their enrolled authenticator. After the
user satisfies the challenge, they’re redirected to your
redirectUrl with
?aal2SessionId=aal2_...&status=verified appended. Pass the aal2SessionId on subsequent
IAS-purposed queries via the x-aal2-session header.
Body
string
required
The verified identity to challenge. Must be in
active
status.string
required
HTTPS URL on your account’s allowlist.
Response
string
required
Unique identifier for this AAL2 challenge.
string
required
Single-use URL for the user to complete the challenge.
string
required
ISO-8601 timestamp when the challenge URL expires.
string
required
How the user will complete the challenge:
totp is a time-based one-time password from an
authenticator app (e.g. Google Authenticator, 1Password). webauthn is a Web Authentication
challenge in the browser (passkey or security key).Response
{
"challengeId": "aalc_018f7c40...",
"challengeUrl": "https://auth.ias.metriport.com/aal2/eyJhbGc...",
"expiresAt": "2026-04-29T14:42:00.000Z",
"method": "totp"
}
⌘I

