Challenges

A challenge is the interactive verification step Rupt runs when an evaluation's verdict is challenge. It interrupts the user, asks them to prove they own the account through a channel you trust, and records the outcome on the challenge.

Challenges fire automatically. When a policy whose action is challenge matches, Rupt creates the challenge and the SDK redirects the user to the challenge UI.

Channels

A challenge verifies the user over the channels you've configured:

• Email: a code sent to the email on file.
• SMS: a code sent to the phone on file.

You can require every configured channel, or accept any one of them.

Status lifecycle

Every challenge moves through a fixed set of statuses:

created → presented → code_sent → verified → completed
                          ↓
                    skipped / overridden

• created: the policy fired and the challenge record exists, but the user hasn't seen it yet.
• presented: the user has loaded the challenge UI.
• code_sent: a verification code has gone out.
• verified: the user entered the right code.
• completed: the challenge is fully resolved in the user's favor.
• skipped: the user chose to skip the challenge. Skipping is off by default; it's available only when you allow it, and only up to the skip limit you set.
• overridden: a newer challenge replaced this one. When Rupt issues a fresh challenge for the same user and device, it marks any still-pending earlier one as overridden.

The verdict on the evaluation is a snapshot from the moment it ran. It stays challenge and doesn't flip to allow on its own. To decide whether to honor the action, read the challenge's status: honor it once the status is completed, and keep blocking for anything else, like skipped or a challenge that simply hasn't completed yet. See Quick start step 3.

Categories

Each challenge carries a type that records why it fired:

• account_sharing: too many concurrent users or devices on the account.
• account_takeover: a login from an unfamiliar device or location.
• multi_accounting: the same fingerprint across accounts that should be independent.
• fake_account: the signup looks synthetic.
• repeat_trial: the same person re-creating throwaway accounts.

The type comes back on the challenge object returned with the evaluation, and Rupt uses it to tailor the wording the user sees.

The challenge UI

The SDK redirects the user to Rupt's hosted challenge UI. It handles channel selection, code entry, retries, and rate-limiting, and applies the branding and language you've configured: English, Spanish, French, and Arabic out of the box.