Authorization

No API key or access token is required. This sign-in operation validates the registered application and challenge proof.

Application and challenge validation

Request headers

Content-Typeapplication/json: Encode the request body as JSON.

Path parameters

idstring · required: Opaque identifier in the authorized resource scope. Nested identifiers must belong to their parent resource.

Request body

applicationIdstring · required: The same registered application that initiated the challenge.
codestring · required: One-time code delivered to the enrolled identity.
codeVerifierstring · required: Original secret proof-key verifier generated when starting this challenge.

Response

200OK

Returns the authorized resource or result for this operation. List results use items, nextCursor, and hasMore.

Behavior to account for

No API key is used. Application registration does not authenticate a person. Rate limits, proof-key binding, expiry, and single-use verification protect this flow.

Consume the challenge atomically. Bind the code and proof key to the same tenant, application, and identity. Establish only previously granted resource relationships.

Errors

Authentication failures return 401 or 403. Inaccessible resources return 404. Business and idempotency conflicts return 409. Rate limits return 429 with retry guidance.

Error handling guide

curl --request POST 'https://api.wincora.com/api/v1/auth/challenges/id_example/verifications' \ --header 'Content-Type: application/json' \ --data '{ "applicationId": "app_example", "code": "123456", "codeVerifier": "YOUR_ORIGINAL_PROOF_KEY_VERIFIER" }'

const response = await fetch('https://api.wincora.com/api/v1/auth/challenges/id_example/verifications', { method: 'POST', headers: { "Content-Type": "application/json" }, body: JSON.stringify({ "applicationId": "app_example", "code": "123456", "codeVerifier": "YOUR_ORIGINAL_PROOF_KEY_VERIFIER" }) }); if (!response.ok) throw new Error(await response.text()); const result = await response.json();

import os import requests response = requests.request( 'POST', 'https://api.wincora.com/api/v1/auth/challenges/id_example/verifications', headers={ "Content-Type": "application/json" }, json={ "applicationId": "app_example", "code": "123456", "codeVerifier": "YOUR_ORIGINAL_PROOF_KEY_VERIFIER" }, timeout=30, ) response.raise_for_status() result = response.json()

{ "sessionId": "session_example", "accessToken": "CUSTOMER_ACCESS_TOKEN", "tokenType": "Bearer", "expiresIn": 300, "scopes": [ "traveler:profile:read", "traveler:cases:read" ], "renewalToken": "SINGLE_USE_RENEWAL_TOKEN", "renewalExpiresIn": 28800 }