> ## Documentation Index
> Fetch the complete documentation index at: https://docs.usebacked.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Submit an ownership-challenge signature (public)

> Completes an ownership proof issued from the Backed dashboard. The signature must be over the challenge message with the private key behind the agent's AP2 identity: EIP-191 personal_sign for did:pkh:eip155 identities, raw ed25519 for did:key. No API key is required — the unguessable challenge id plus a valid signature from the identity's key is the proof. This is the submit half of `npx backed-mcp verify-agent`, for operators whose key lives server-side.




## OpenAPI

````yaml /openapi.json post /agents/challenges/{challengeId}/verify
openapi: 3.0.0
info:
  title: Backed Registry API
  version: 1.0.0
  description: >-
    The Backed Registry API: the x402 agent registry. Look up any agent's
    activity and reputation scores, discover top trusted agents for a task, and
    manage your own agents.


    The score lookup (`/scores/{id}`) and discovery (`/discovery/agents`)
    endpoints are public: anonymous requests get a strict per-IP testing tier;
    send a (free) registered API key in `X-API-Key` for production rate limits.
    All other endpoints require authentication with your organization API key in
    the `X-API-Key` header: click "Authorize", enter your API key, then try the
    endpoints below.


    Requests are rate limited per API key. Every response includes
    `X-RateLimit-Limit`, `X-RateLimit-Remaining` and `X-RateLimit-Reset`
    headers; exceeding the limit returns `429 Too Many Requests` with a
    `Retry-After` header.
servers:
  - url: https://api.usebacked.ai
    description: Backed Registry API
security:
  - ApiKeyAuth: []
tags: []
paths:
  /agents/challenges/{challengeId}/verify:
    post:
      tags:
        - Agents
      summary: Submit an ownership-challenge signature (public)
      description: >
        Completes an ownership proof issued from the Backed dashboard. The
        signature must be over the challenge message with the private key behind
        the agent's AP2 identity: EIP-191 personal_sign for did:pkh:eip155
        identities, raw ed25519 for did:key. No API key is required — the
        unguessable challenge id plus a valid signature from the identity's key
        is the proof. This is the submit half of `npx backed-mcp verify-agent`,
        for operators whose key lives server-side.
      parameters:
        - in: path
          name: challengeId
          required: true
          schema:
            type: string
            format: uuid
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required:
                - signature
              properties:
                signature:
                  type: string
                  description: >-
                    Hex (0x-prefixed or not) or base64 signature over the
                    challenge message.
      responses:
        '200':
          description: Ownership proven; the agent is verified.
          content:
            application/json:
              schema:
                type: object
                properties:
                  verified:
                    type: boolean
                  agentId:
                    type: string
                    format: uuid
                  ap2Did:
                    type: string
        '400':
          description: Invalid body or the signature does not match the identity.
        '404':
          description: Challenge not found.
        '409':
          description: >-
            Challenge is not pending, or the identity was registered by another
            organization.
        '410':
          description: Challenge has expired.
        '429':
          description: Rate limit exceeded (per client IP). Wait for Retry-After seconds.
      security: []
components:
  securitySchemes:
    ApiKeyAuth:
      type: apiKey
      in: header
      name: X-API-Key
      description: Organization API key.

````