Method: oauthClients.exchangeAppAttestAssertion
Stay organized with collections
Save and categorize content based on your preferences.
HTTP request
POST https://firebaseappcheck.googleapis.com/v1/{app=oauthClients/*}:exchangeAppAttestAssertion
The URL uses
gRPC Transcoding
syntax.
Path parameters
Parameters
|
app
|
string
Required. The relative resource name of the iOS app, in the format:
projects/{project_number}/apps/{app_id}
If necessary, the
project_number
element can be replaced with the project ID of the Firebase project. Learn more about using project identifiers in Google's
AIP 2510
standard.
|
Request body
The request body contains data with the following structure:
JSON representation
|
{
"artifact": string,
"assertion": string,
"challenge": string,
"limitedUse": boolean
}
|
Fields
|
artifact
|
string (
bytes
format)
Required. The artifact returned by a previous call to
oauthClients.exchangeAppAttestAttestation
.
A base64-encoded string.
|
assertion
|
string (
bytes
format)
Required. The CBOR-encoded assertion returned by the client-side App Attest API.
A base64-encoded string.
|
challenge
|
string (
bytes
format)
Required. A one-time challenge returned by an immediately prior call to
oauthClients.generateAppAttestChallenge
.
A base64-encoded string.
|
limitedUse
|
boolean
Specifies whether this attestation is for use in a
limited use
(
true
) or
session based
(
false
) context. To enable this attestation to be used with the
replay protection
feature, set this to
true
. The default value is
false
.
|
Response body
If successful, the response body contains an instance of
AppCheckToken
.
Except as otherwise noted, the content of this page is licensed under the Creative Commons Attribution 4.0 License, and code samples are licensed under the Apache 2.0 License. For details, see the Google Developers Site Policies. Java is a registered trademark of Oracle and/or its affiliates.
Last updated 2024-09-26 UTC.
[null,null,["Last updated 2024-09-26 UTC."],[],[],null,["# Method: oauthClients.exchangeAppAttestAssertion\n\nAccepts an App Attest assertion and an artifact previously obtained from\n`\n`[oauthClients.exchangeAppAttestAttestation](/docs/reference/appcheck/rest/v1/projects.apps/exchangeAppAttestAttestation#google.firebase.appcheck.v1.TokenExchangeService.ExchangeAppAttestAttestation)`\n`\nand verifies those with Apple. If valid, returns an\n`\n`[AppCheckToken](/docs/reference/appcheck/rest/v1/AppCheckToken)`\n`\n.\n\n### HTTP request\n\n\n`\nPOST https://firebaseappcheck.googleapis.com/v1/{app=oauthClients/*}:exchangeAppAttestAssertion\n`\n\n\nThe URL uses\n[gRPC Transcoding](https://google.aip.dev/127)\nsyntax.\n\n### Path parameters\n\n| Parameters ||\n|---------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|\n| ` app ` | ` string ` Required. The relative resource name of the iOS app, in the format: projects/{project_number}/apps/{app_id} If necessary, the ` project_number ` element can be replaced with the project ID of the Firebase project. Learn more about using project identifiers in Google's [AIP 2510](https://google.aip.dev/cloud/2510) standard. |\n\n### Request body\n\n\nThe request body contains data with the following structure:\n\n| JSON representation |\n|-------------------------------------------------------------------------------------------------|\n| ``` { \"artifact\": string, \"assertion\": string, \"challenge\": string, \"limitedUse\": boolean } ``` |\n\n| Fields ||\n|----------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|\n| ` artifact ` | ` string ( `[bytes](https://developers.google.com/discovery/v1/type-format)` format) ` Required. The artifact returned by a previous call to ` `[oauthClients.exchangeAppAttestAttestation](/docs/reference/appcheck/rest/v1/projects.apps/exchangeAppAttestAttestation#google.firebase.appcheck.v1.TokenExchangeService.ExchangeAppAttestAttestation)` ` . A base64-encoded string. |\n| ` assertion ` | ` string ( `[bytes](https://developers.google.com/discovery/v1/type-format)` format) ` Required. The CBOR-encoded assertion returned by the client-side App Attest API. A base64-encoded string. |\n| ` challenge ` | ` string ( `[bytes](https://developers.google.com/discovery/v1/type-format)` format) ` Required. A one-time challenge returned by an immediately prior call to ` `[oauthClients.generateAppAttestChallenge](/docs/reference/appcheck/rest/v1/projects.apps/generateAppAttestChallenge#google.firebase.appcheck.v1.TokenExchangeService.GenerateAppAttestChallenge)` ` . A base64-encoded string. |\n| ` limitedUse ` | ` boolean ` Specifies whether this attestation is for use in a *limited use* ( ` true ` ) or *session based* ( ` false ` ) context. To enable this attestation to be used with the *replay protection* feature, set this to ` true ` . The default value is ` false ` . |\n\n### Response body\n\n\nIf successful, the response body contains an instance of\n`\n`[AppCheckToken](/docs/reference/appcheck/rest/v1/AppCheckToken)`\n`\n."]]