---
title: Challenges
description: A challenge is the interactive verification step Rupt runs when a verdict is challenge. It walks the user through email or SMS verification and records whether they passed.
---

# Challenges

A challenge is the interactive verification step Rupt runs when an [evaluation's](/docs/v3/concepts/evaluations) [verdict](/docs/v3/concepts/verdicts) is `challenge`. It interrupts the user, asks them to prove they own the account through a channel you trust, and records the outcome on the challenge.

Challenges fire automatically. When a [policy](/docs/v3/concepts/policies) whose action is `challenge` matches, Rupt creates the challenge and the SDK redirects the user to the challenge UI.

## Channels

A challenge verifies the user over the channels you've configured:

- **Email**: a code sent to the email on file.
- **SMS**: a code sent to the phone on file.

You can require every configured channel, or accept any one of them.

## Status lifecycle

Every challenge moves through a fixed set of statuses:

```sh
created → presented → code_sent → verified → completed
                          ↓
                    skipped / overridden
```

- **`created`**: the policy fired and the challenge record exists, but the user hasn't seen it yet.
- **`presented`**: the user has loaded the challenge UI.
- **`code_sent`**: a verification code has gone out.
- **`verified`**: the user entered the right code.
- **`completed`**: the challenge is fully resolved in the user's favor.
- **`skipped`**: the user chose to skip the challenge. Skipping is off by default; it's available only when you allow it, and only up to the skip limit you set.
- **`overridden`**: a newer challenge replaced this one. When Rupt issues a fresh challenge for the same user and device, it marks any still-pending earlier one as overridden.

The [verdict](/docs/v3/concepts/verdicts) on the evaluation is a snapshot from the moment it ran. It stays `challenge` and doesn't flip to `allow` on its own. To decide whether to honor the action, read the challenge's `status`: honor it once the status is `completed`, and keep blocking for anything else, like `skipped` or a challenge that simply hasn't completed yet. See [Quick start step 3](/docs/v3/quick-start#3-confirm-the-evaluation-server-side).

## Categories

Each challenge carries a `type` that records why it fired:

- **`account_sharing`**: too many concurrent users or devices on the account.
- **`account_takeover`**: a login from an unfamiliar device or location.
- **`multi_accounting`**: the same fingerprint across accounts that should be independent.
- **`fake_account`**: the signup looks synthetic.
- **`repeat_trial`**: the same person re-creating throwaway accounts.

The `type` comes back on the challenge object returned with the [evaluation](/docs/v3/concepts/evaluations), and Rupt uses it to tailor the wording the user sees.

## The challenge UI

The SDK redirects the user to Rupt's hosted challenge UI. It handles channel selection, code entry, retries, and rate-limiting, and applies the branding and language you've configured: English, Spanish, French, and Arabic out of the box.