> ## Documentation Index
> Fetch the complete documentation index at: https://docs.usebacked.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Fetch an ownership challenge (public)

> Returns the challenge message an operator must sign to prove control of an agent's AP2 identity. Challenges are created from the Backed dashboard; the unguessable challenge id is the capability to read them. This is the fetch half of `npx backed-mcp verify-agent`, which signs the message with a server-side key and submits it to the verify endpoint without any copy-paste.




## OpenAPI

````yaml /openapi.json get /agents/challenges/{challengeId}
openapi: 3.0.0
info:
  title: Backed Registry API
  version: 1.0.0
  description: >-
    The Backed Registry API: the x402 agent registry. Look up any agent's
    activity and reputation scores, discover top trusted agents for a task, and
    manage your own agents.


    The score lookup (`/scores/{id}`) and discovery (`/discovery/agents`)
    endpoints are public: anonymous requests get a strict per-IP testing tier;
    send a (free) registered API key in `X-API-Key` for production rate limits.
    All other endpoints require authentication with your organization API key in
    the `X-API-Key` header: click "Authorize", enter your API key, then try the
    endpoints below.


    Requests are rate limited per API key. Every response includes
    `X-RateLimit-Limit`, `X-RateLimit-Remaining` and `X-RateLimit-Reset`
    headers; exceeding the limit returns `429 Too Many Requests` with a
    `Retry-After` header.
servers:
  - url: https://api.usebacked.ai
    description: Backed Registry API
security:
  - ApiKeyAuth: []
tags: []
paths:
  /agents/challenges/{challengeId}:
    get:
      tags:
        - Agents
      summary: Fetch an ownership challenge (public)
      description: >
        Returns the challenge message an operator must sign to prove control of
        an agent's AP2 identity. Challenges are created from the Backed
        dashboard; the unguessable challenge id is the capability to read them.
        This is the fetch half of `npx backed-mcp verify-agent`, which signs the
        message with a server-side key and submits it to the verify endpoint
        without any copy-paste.
      parameters:
        - in: path
          name: challengeId
          required: true
          schema:
            type: string
            format: uuid
      responses:
        '200':
          description: The challenge.
          content:
            application/json:
              schema:
                type: object
                properties:
                  challengeId:
                    type: string
                    format: uuid
                  ap2Did:
                    type: string
                  message:
                    type: string
                  status:
                    type: string
                    enum:
                      - PENDING
                      - VERIFIED
                      - FAILED
                      - EXPIRED
                  expiresAt:
                    type: string
                    format: date-time
        '404':
          description: Challenge not found.
        '429':
          description: Rate limit exceeded (per client IP). Wait for Retry-After seconds.
      security: []
components:
  securitySchemes:
    ApiKeyAuth:
      type: apiKey
      in: header
      name: X-API-Key
      description: Organization API key.

````