# Method: challenge.generate

- [HTTP request](https://developers.google.com/chrome/verified-access/reference/rest/v2/challenge/generate#body.HTTP_TEMPLATE)
- [Request body](https://developers.google.com/chrome/verified-access/reference/rest/v2/challenge/generate#body.request_body)
- [Response body](https://developers.google.com/chrome/verified-access/reference/rest/v2/challenge/generate#body.response_body)
  - [JSON representation](https://developers.google.com/chrome/verified-access/reference/rest/v2/challenge/generate#body.Challenge.SCHEMA_REPRESENTATION)
- [Authorization scopes](https://developers.google.com/chrome/verified-access/reference/rest/v2/challenge/generate#body.aspect)

Generates a new challenge.

### HTTP request

`POST https://verifiedaccess.googleapis.com/v2/challenge:generate`

The URL uses [gRPC Transcoding](https://google.aip.dev/127) syntax.

### Request body

The request body must be empty.

### Response body

Result message for VerifiedAccess.GenerateChallenge.

If successful, the response body contains data with the following structure:

| JSON representation |
|---|
| ``` { "challenge": string } ``` |

| Fields ||
|---|---|
| `challenge` | `string (https://developers.google.com/discovery/v1/type-format format)` Generated challenge, the bytes representation of SignedData. A base64-encoded string. |

### Authorization scopes

Requires the following OAuth scope:

- `https://www.googleapis.com/auth/verifiedaccess`

For more information, see the [OAuth 2.0 Overview](https://developers.google.com/identity/protocols/OAuth2).