Verify Push API

Verify Push endpoints exposed by the Devotel CPaaS API Base path: /api/v1/verify/push Endpoint count: 4

title: “Errors worth branching on” description: “Per-endpoint failure templates matching the envelope — what actually fires, what to retry, what to surface to the operator.”

Errors worth branching on

These five failures cover the verification issue (POST /api/v1/verify-push), triggered on every factor prompt from auth flows. Each block below is a full { error, meta } envelope as the API returns it, and the matrix at the bottom answers retry vs surface for the same five classes. For the platform-wide decision table these branches plug into, see the error handling guide.

401 — Unauthorized

  {
    "error": {
      "code": "UNAUTHORIZED",
      "message": "The API key is invalid, expired, or lacks the required scope.",
      "status": 401
    },
    "meta": {
      "request_id": "req_verifypua1",
      "timestamp": "2026-09-03T12:00:00Z"
    }
  }

A 401 on this page is the bearer key failing before the route ran — it never means the resource is wrong. Rotate the key or re-mint the scoped token; retrying the same request changes nothing.

403 — Forbidden

  {
    "error": {
      "code": "FORBIDDEN",
      "message": "The key is valid but does not have the scope this operation requires.",
      "status": 403
    },
    "meta": {
      "request_id": "req_verifypua1f",
      "timestamp": "2026-09-03T12:00:00Z"
    }
  }

A 403 means the key authenticated but the operation is gated by scope — check the key’s scopes on the developer page; a 403 is never a data-not-found shape.

422 — Schema

  {
    "error": {
      "code": "VALIDATION_ERROR",
      "message": "The request failed input validation.",
      "status": 422,
      "details": { "field": "device_token", "value": "tok-0192", "expected": "the full APNs/FCM device token, not its prefix" }
    },
    "meta": {
      "request_id": "req_verifypub2",
      "timestamp": "2026-09-03T12:00:00Z"
    }
  }

A 422 means the payload did not match the request schema — branch on error.details.field and resend with the full device token instead of blind-retrying the same body.

429 — Rate

  {
    "error": {
      "code": "RATE_LIMITED",
      "message": "Too many requests in the current window.",
      "status": 429,
      "details": { "retry_after": 12 }
    },
    "meta": {
      "request_id": "req_verifypuc3",
      "timestamp": "2026-09-03T12:00:00Z",
      "docs_url": "https://docs.orbit.devotel.io/errors/RATE_LIMITED"
    }
  }

The Retry-After header and error.details.retry_after are both set on every 429 — resend the SAME request after the lower of the two.

402 — Feature gate

  {
    "error": {
      "code": "PUSH_VERIFICATION_RATE_HOISTED",
      "message": "This verification has hit the per-device push limit for the current window.",
      "status": 402,
      "details": { "window_seconds": 300, "device_limit": 5 }
    },
    "meta": {
      "request_id": "req_verifypud4",
      "timestamp": "2026-09-03T12:00:00Z"
    }
  }

Surface the fallback channel — push cannot retry; offer the SMS/voice fallback instead.

60-second retry matrix

Class	Meaning	Branch response
401 `UNAUTHORIZED`	the bearer key itself fails	Surface. Rotate the key or re-mint the scoped token; do not retry the same request.
403 `FORBIDDEN`	the key lacks this operation’s scope	Surface. Fix the key’s scope set; a retry with the same key never heals it.
422 `VALIDATION_ERROR`	the payload does not match the schema	Fix, then resend intentionally. Branch on `error.details.field`; a blind retry repeats the same 422.
429 `RATE_LIMITED`	the window quota is exhausted	Retry after `error.details.retry_after` (or the `Retry-After` header) with the same request body.
`PUSH_VERIFICATION_RATE_HOISTED` (402 feature gate)	Surface the fallback channel	Branch on `error.code`. Push cannot retry; offer the SMS/voice fallback instead.

Verify a push challenge signature

POST /api/v1/verify/push/challenges/{challengeId}/verify

Verify the device’s signature over the challenge’s signing string. On match: challenge moves to approved, factor flips to verified. On mismatch: attempts increment; auto-denied at maxAttempts.

string

required

—

string

Stripe-style idempotency token. Pass a stable, client-generated value (1-255 chars) to dedupe retries on transient timeouts. The same key+credential+path replays the original response for 24h on 2xx (5min on 4xx, 30s on 5xx). Returns 409 if a concurrent request with the same key is already in flight; replayed responses include the Idempotency-Replay: true response header.

string (enum: true|false)

Sandbox opt-in for Clerk-session-authenticated requests. Set to true to route the call through the test-mode pipeline: no real provider delivery, no credits deducted, response meta.test_mode: true. Ignored for live API keys (dv_live_sk_*) — server-to-server clients must use a test-prefixed key (dv_test_sk_*) to exercise sandbox. Test-prefixed keys unconditionally enable sandbox regardless of this header.

string

required

The device’s base64-encoded signature over the challenge signing string factorId.challengeId.nonce (1–4096 characters).

cURL

curl -X POST "https://api.orbit.devotel.io/api/v1/verify/push/challenges/{challengeId}/verify" \
  -H "X-API-Key: dv_live_sk_your_key_here" \
  -H "Content-Type: application/json" \
  -d '{
  "signature": "c2lnbmF0dXJlX2Jhc2U2NF9wbGFjZWhvbGRlcl9kZW1vX29ubHlfbm90X2FfcmVhbF9zaWduYXR1cmVfdmFsdWU="
}'

Node.js

import { Orbit } from '@devotel-orbit/node'

const orbit = new Orbit({
  apiKey: process.env.ORBIT_API_KEY!,
})

const res = await fetch('https://api.orbit.devotel.io/api/v1/verify/push/challenges/{challengeId}/verify', {
  method: 'POST',
  headers: {
    'X-API-Key': process.env.ORBIT_API_KEY!,
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
  "signature": "c2lnbmF0dXJlX2Jhc2U2NF9wbGFjZWhvbGRlcl9kZW1vX29ubHlfbm90X2FfcmVhbF9zaWduYXR1cmVfdmFsdWU="
}),
})
console.log(await res.json())

Python

import os, requests

headers = {"X-API-Key": os.environ["ORBIT_API_KEY"]}
headers["Content-Type"] = "application/json"
r = requests.post("https://api.orbit.devotel.io/api/v1/verify/push/challenges/{challengeId}/verify", headers=headers, json={
  "signature": "c2lnbmF0dXJlX2Jhc2U2NF9wbGFjZWhvbGRlcl9kZW1vX29ubHlfbm90X2FfcmVhbF9zaWduYXR1cmVfdmFsdWU="
})
print(r.json())

package main

import (
	"bytes"
	"net/http"
	"os"
)

func main() {
	req, _ := http.NewRequest("POST", "https://api.orbit.devotel.io/api/v1/verify/push/challenges/{challengeId}/verify", bytes.NewBuffer([]byte(`{
  "signature": "c2lnbmF0dXJlX2Jhc2U2NF9wbGFjZWhvbGRlcl9kZW1vX29ubHlfbm90X2FfcmVhbF9zaWduYXR1cmVfdmFsdWU="
}`)))
	req.Header.Set("X-API-Key", os.Getenv("ORBIT_API_KEY"))
	req.Header.Set("Content-Type", "application/json")
	http.DefaultClient.Do(req)
}

Ruby

require 'net/http'
require 'json'

uri = URI('https://api.orbit.devotel.io/api/v1/verify/push/challenges/{challengeId}/verify')
req = Net::HTTP::Post.new(uri)
req['X-API-Key'] = ENV['ORBIT_API_KEY']
req['Content-Type'] = 'application/json'
req.body = {
  "signature": "c2lnbmF0dXJlX2Jhc2U2NF9wbGFjZWhvbGRlcl9kZW1vX29ubHlfbm90X2FfcmVhbF9zaWduYXR1cmVfdmFsdWU="
}.to_json
res = Net::HTTP.start(uri.host, uri.port, use_ssl: true) { |h| h.request(req) }
puts res.body

PHP

<?php
$ch = curl_init('https://api.orbit.devotel.io/api/v1/verify/push/challenges/{challengeId}/verify');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_CUSTOMREQUEST, 'POST');
curl_setopt($ch, CURLOPT_HTTPHEADER, [
  'X-API-Key: ' . getenv('ORBIT_API_KEY'),
  'Content-Type: application/json',
]);
curl_setopt($ch, CURLOPT_POSTFIELDS, <<<JSON
{
  "signature": "c2lnbmF0dXJlX2Jhc2U2NF9wbGFjZWhvbGRlcl9kZW1vX29ubHlfbm90X2FfcmVhbF9zaWduYXR1cmVfdmFsdWU="
}
JSON);
echo curl_exec($ch);

{
  "data": {
    "challengeId": "vpch_7c1e2a4b6f8a0c2e4f6a8b2c",
    "factorId": "vpf_9b6c2d5e1a13f8c2b4d6e0a1",
    "status": "approved"
  },
  "meta": {
    "request_id": "req_01HZQX4E7JQ4M2E2H2DM9XE5FJ",
    "timestamp": "2026-08-26T12:00:00.000Z"
  }
}

Register a push factor

POST /api/v1/verify/push/factors

Register a device’s public key for phishing-resistant MFA. Returns a binding challenge the device must sign to activate the factor.

string

string (enum: true|false)

string

required

Stable identifier for the end user this device belongs to — your user id, email, or username (1–255 characters).

string

required

Human-readable label for the paired device, shown when the user reviews their registered factors (1–120 characters).

string (enum: ed25519|ecdsa-p256)

required

Signature algorithm of the device key pair — ed25519 or ecdsa-p256.

string

required

The device’s base64-encoded public key. The matching private key never leaves the device; it signs each challenge (1–4096 characters).

string (enum: raw|spki)

required

Encoding of publicKey — raw for a bare key or spki for a SubjectPublicKeyInfo-wrapped key.

string

Optional push-token id (FCM, APNs, or Web Push) the service uses to deliver challenge notifications to this device (1–120 characters).

object

Optional free-form key/value bag — device model, OS version, attestation chain. The caller defines the contract.

cURL

curl -X POST "https://api.orbit.devotel.io/api/v1/verify/push/factors" \
  -H "X-API-Key: dv_live_sk_your_key_here" \
  -H "Content-Type: application/json" \
  -d '{
  "identity": "user_1a2b3c",
  "friendlyName": "iPhone 15 Pro",
  "algorithm": "ed25519",
  "publicKey": "3Mv6c0kZ8y2Qb7pL9dWfX1aRtH4sN6uG0eI2oJ5PqE=",
  "keyFormat": "raw",
  "deviceTokenId": "fcm_e8b1c2d3a4f5",
  "metadata": {
    "deviceModel": "iPhone15,3",
    "os": "iOS 17.4"
  }
}'

Node.js

import { Orbit } from '@devotel-orbit/node'

const orbit = new Orbit({
  apiKey: process.env.ORBIT_API_KEY!,
})

const res = await fetch('https://api.orbit.devotel.io/api/v1/verify/push/factors', {
  method: 'POST',
  headers: {
    'X-API-Key': process.env.ORBIT_API_KEY!,
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
  "identity": "user_1a2b3c",
  "friendlyName": "iPhone 15 Pro",
  "algorithm": "ed25519",
  "publicKey": "3Mv6c0kZ8y2Qb7pL9dWfX1aRtH4sN6uG0eI2oJ5PqE=",
  "keyFormat": "raw",
  "deviceTokenId": "fcm_e8b1c2d3a4f5",
  "metadata": {
    "deviceModel": "iPhone15,3",
    "os": "iOS 17.4"
  }
}),
})
console.log(await res.json())

Python

import os, requests

headers = {"X-API-Key": os.environ["ORBIT_API_KEY"]}
headers["Content-Type"] = "application/json"
r = requests.post("https://api.orbit.devotel.io/api/v1/verify/push/factors", headers=headers, json={
  "identity": "user_1a2b3c",
  "friendlyName": "iPhone 15 Pro",
  "algorithm": "ed25519",
  "publicKey": "3Mv6c0kZ8y2Qb7pL9dWfX1aRtH4sN6uG0eI2oJ5PqE=",
  "keyFormat": "raw",
  "deviceTokenId": "fcm_e8b1c2d3a4f5",
  "metadata": {
    "deviceModel": "iPhone15,3",
    "os": "iOS 17.4"
  }
})
print(r.json())

package main

import (
	"bytes"
	"net/http"
	"os"
)

func main() {
	req, _ := http.NewRequest("POST", "https://api.orbit.devotel.io/api/v1/verify/push/factors", bytes.NewBuffer([]byte(`{
  "identity": "user_1a2b3c",
  "friendlyName": "iPhone 15 Pro",
  "algorithm": "ed25519",
  "publicKey": "3Mv6c0kZ8y2Qb7pL9dWfX1aRtH4sN6uG0eI2oJ5PqE=",
  "keyFormat": "raw",
  "deviceTokenId": "fcm_e8b1c2d3a4f5",
  "metadata": {
    "deviceModel": "iPhone15,3",
    "os": "iOS 17.4"
  }
}`)))
	req.Header.Set("X-API-Key", os.Getenv("ORBIT_API_KEY"))
	req.Header.Set("Content-Type", "application/json")
	http.DefaultClient.Do(req)
}

Ruby

require 'net/http'
require 'json'

uri = URI('https://api.orbit.devotel.io/api/v1/verify/push/factors')
req = Net::HTTP::Post.new(uri)
req['X-API-Key'] = ENV['ORBIT_API_KEY']
req['Content-Type'] = 'application/json'
req.body = {
  "identity": "user_1a2b3c",
  "friendlyName": "iPhone 15 Pro",
  "algorithm": "ed25519",
  "publicKey": "3Mv6c0kZ8y2Qb7pL9dWfX1aRtH4sN6uG0eI2oJ5PqE=",
  "keyFormat": "raw",
  "deviceTokenId": "fcm_e8b1c2d3a4f5",
  "metadata": {
    "deviceModel": "iPhone15,3",
    "os": "iOS 17.4"
  }
}.to_json
res = Net::HTTP.start(uri.host, uri.port, use_ssl: true) { |h| h.request(req) }
puts res.body

PHP

<?php
$ch = curl_init('https://api.orbit.devotel.io/api/v1/verify/push/factors');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_CUSTOMREQUEST, 'POST');
curl_setopt($ch, CURLOPT_HTTPHEADER, [
  'X-API-Key: ' . getenv('ORBIT_API_KEY'),
  'Content-Type: application/json',
]);
curl_setopt($ch, CURLOPT_POSTFIELDS, <<<JSON
{
  "identity": "user_1a2b3c",
  "friendlyName": "iPhone 15 Pro",
  "algorithm": "ed25519",
  "publicKey": "3Mv6c0kZ8y2Qb7pL9dWfX1aRtH4sN6uG0eI2oJ5PqE=",
  "keyFormat": "raw",
  "deviceTokenId": "fcm_e8b1c2d3a4f5",
  "metadata": {
    "deviceModel": "iPhone15,3",
    "os": "iOS 17.4"
  }
}
JSON);
echo curl_exec($ch);

{
  "data": {
    "factorId": "vpf_9b6c2d5e1a13f8c2b4d6e0a1",
    "identity": "user_1a2b3c",
    "friendlyName": "iPhone 15 Pro",
    "algorithm": "ed25519",
    "publicKey": "3Mv6c0kZ8y2Qb7pL9dWfX1aRtH4sN6uG0eI2oJ5PqE=",
    "keyFormat": "raw",
    "status": "unverified",
    "bindingChallenge": {
      "challengeId": "vpch_5e1f2a3b4c5d6e7f8a9b0c1d",
      "factorId": "vpf_9b6c2d5e1a13f8c2b4d6e0a1",
      "nonce": "d2hUaEp0c1RLaGx0YmtIY2tsWnJDKw==",
      "expiresAt": "2026-08-26T12:02:00.000Z"
    },
    "createdAt": "2026-08-26T12:00:00.000Z"
  },
  "meta": {
    "request_id": "req_01HZQX4E7JQ4M2E2H2DM9XE5FJ",
    "timestamp": "2026-08-26T12:00:00.000Z"
  }
}

Issue a push challenge

POST /api/v1/verify/push/factors/{factorId}/challenges

Mint a server-issued nonce + persist a pending challenge row. The device signs <factorId>.<challengeId>.<nonce> and submits the signature via /verify/push/challenges/:challengeId/verify.

string

required

—

string

string (enum: true|false)

string

Human-readable prompt shown in the push notification so the user knows what they are approving, e.g. the action or device (1–280 characters).

integer

Lifetime of the issued challenge, in seconds, before it expires. Defaults to 120; range 30–600.

cURL

curl -X POST "https://api.orbit.devotel.io/api/v1/verify/push/factors/{factorId}/challenges" \
  -H "X-API-Key: dv_live_sk_your_key_here" \
  -H "Content-Type: application/json" \
  -d '{
  "contextMessage": "Approve sign-in from Chrome on macOS",
  "ttlSeconds": 120
}'

Node.js

import { Orbit } from '@devotel-orbit/node'

const orbit = new Orbit({
  apiKey: process.env.ORBIT_API_KEY!,
})

const res = await fetch('https://api.orbit.devotel.io/api/v1/verify/push/factors/{factorId}/challenges', {
  method: 'POST',
  headers: {
    'X-API-Key': process.env.ORBIT_API_KEY!,
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
  "contextMessage": "Approve sign-in from Chrome on macOS",
  "ttlSeconds": 120
}),
})
console.log(await res.json())

Python

import os, requests

headers = {"X-API-Key": os.environ["ORBIT_API_KEY"]}
headers["Content-Type"] = "application/json"
r = requests.post("https://api.orbit.devotel.io/api/v1/verify/push/factors/{factorId}/challenges", headers=headers, json={
  "contextMessage": "Approve sign-in from Chrome on macOS",
  "ttlSeconds": 120
})
print(r.json())

package main

import (
	"bytes"
	"net/http"
	"os"
)

func main() {
	req, _ := http.NewRequest("POST", "https://api.orbit.devotel.io/api/v1/verify/push/factors/{factorId}/challenges", bytes.NewBuffer([]byte(`{
  "contextMessage": "Approve sign-in from Chrome on macOS",
  "ttlSeconds": 120
}`)))
	req.Header.Set("X-API-Key", os.Getenv("ORBIT_API_KEY"))
	req.Header.Set("Content-Type", "application/json")
	http.DefaultClient.Do(req)
}

Ruby

require 'net/http'
require 'json'

uri = URI('https://api.orbit.devotel.io/api/v1/verify/push/factors/{factorId}/challenges')
req = Net::HTTP::Post.new(uri)
req['X-API-Key'] = ENV['ORBIT_API_KEY']
req['Content-Type'] = 'application/json'
req.body = {
  "contextMessage": "Approve sign-in from Chrome on macOS",
  "ttlSeconds": 120
}.to_json
res = Net::HTTP.start(uri.host, uri.port, use_ssl: true) { |h| h.request(req) }
puts res.body

PHP

<?php
$ch = curl_init('https://api.orbit.devotel.io/api/v1/verify/push/factors/{factorId}/challenges');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_CUSTOMREQUEST, 'POST');
curl_setopt($ch, CURLOPT_HTTPHEADER, [
  'X-API-Key: ' . getenv('ORBIT_API_KEY'),
  'Content-Type: application/json',
]);
curl_setopt($ch, CURLOPT_POSTFIELDS, <<<JSON
{
  "contextMessage": "Approve sign-in from Chrome on macOS",
  "ttlSeconds": 120
}
JSON);
echo curl_exec($ch);

{
  "data": {
    "challengeId": "vpch_7c1e2a4b6f8a0c2e4f6a8b2c",
    "factorId": "vpf_9b6c2d5e1a13f8c2b4d6e0a1",
    "nonce": "U2NhcGllciBMZXNvbDRoN1pSRjNYZw==",
    "expiresAt": "2026-08-26T12:02:00.000Z",
    "contextMessage": "Approve sign-in from Chrome on macOS"
  },
  "meta": {
    "request_id": "req_01HZQX4E7JQ4M2E2H2DM9XE5FJ",
    "timestamp": "2026-08-26T12:00:00.000Z"
  }
}

Revoke a push factor

POST /api/v1/verify/push/factors/{factorId}/revoke

Mark a factor as revoked. All subsequent challenges are rejected with a 409 + reason=FACTOR_REVOKED. Irreversible.

string

required

—

string

string (enum: true|false)

cURL

curl -X POST "https://api.orbit.devotel.io/api/v1/verify/push/factors/{factorId}/revoke" \
  -H "X-API-Key: dv_live_sk_your_key_here" \
  -H "Content-Type: application/json" \
  -d '{}'

Node.js

import { Orbit } from '@devotel-orbit/node'

const orbit = new Orbit({
  apiKey: process.env.ORBIT_API_KEY!,
})

const res = await fetch('https://api.orbit.devotel.io/api/v1/verify/push/factors/{factorId}/revoke', {
  method: 'POST',
  headers: {
    'X-API-Key': process.env.ORBIT_API_KEY!,
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({}),
})
console.log(await res.json())

Python

import os, requests

headers = {"X-API-Key": os.environ["ORBIT_API_KEY"]}
headers["Content-Type"] = "application/json"
r = requests.post("https://api.orbit.devotel.io/api/v1/verify/push/factors/{factorId}/revoke", headers=headers, json={})
print(r.json())

package main

import (
	"bytes"
	"net/http"
	"os"
)

func main() {
	req, _ := http.NewRequest("POST", "https://api.orbit.devotel.io/api/v1/verify/push/factors/{factorId}/revoke", bytes.NewBuffer([]byte(`{}`)))
	req.Header.Set("X-API-Key", os.Getenv("ORBIT_API_KEY"))
	req.Header.Set("Content-Type", "application/json")
	http.DefaultClient.Do(req)
}

Ruby

require 'net/http'
require 'json'

uri = URI('https://api.orbit.devotel.io/api/v1/verify/push/factors/{factorId}/revoke')
req = Net::HTTP::Post.new(uri)
req['X-API-Key'] = ENV['ORBIT_API_KEY']
req['Content-Type'] = 'application/json'
req.body = {}.to_json
res = Net::HTTP.start(uri.host, uri.port, use_ssl: true) { |h| h.request(req) }
puts res.body

PHP

<?php
$ch = curl_init('https://api.orbit.devotel.io/api/v1/verify/push/factors/{factorId}/revoke');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_CUSTOMREQUEST, 'POST');
curl_setopt($ch, CURLOPT_HTTPHEADER, [
  'X-API-Key: ' . getenv('ORBIT_API_KEY'),
  'Content-Type: application/json',
]);
curl_setopt($ch, CURLOPT_POSTFIELDS, <<<JSON
{}
JSON);
echo curl_exec($ch);

{
  "data": {
    "factorId": "vpf_9b6c2d5e1a13f8c2b4d6e0a1",
    "revoked": true
  },
  "meta": {
    "request_id": "req_01HZQX4E7JQ4M2E2H2DM9XE5FJ",
    "timestamp": "2026-08-26T12:00:00.000Z"
  }
}

API Reference

All Endpoints

Verify Push API

Verify Push API

title: “Errors worth branching on” description: “Per-endpoint failure templates matching the envelope — what actually fires, what to retry, what to surface to the operator.”

Errors worth branching on

401 — Unauthorized

403 — Forbidden

422 — Schema

429 — Rate

402 — Feature gate

60-second retry matrix

Verify a push challenge signature

Register a push factor

Issue a push challenge

Revoke a push factor

​Verify Push API

​title: “Errors worth branching on” description: “Per-endpoint failure templates matching the envelope — what actually fires, what to retry, what to surface to the operator.”

​Errors worth branching on

​401 — Unauthorized

​403 — Forbidden

​422 — Schema

​429 — Rate

​402 — Feature gate

​60-second retry matrix

​Verify a push challenge signature

​Register a push factor

​Issue a push challenge

​Revoke a push factor

Verify Push API

title: “Errors worth branching on” description: “Per-endpoint failure templates matching the envelope — what actually fires, what to retry, what to surface to the operator.”

Errors worth branching on

401 — Unauthorized

403 — Forbidden

422 — Schema

429 — Rate

402 — Feature gate

60-second retry matrix

Verify a push challenge signature

Register a push factor

Issue a push challenge

Revoke a push factor