# Validate device key

Verifies that the user's device is in their possession. Before calling this API, the device signs a challenge using the private key stored by the device. This API is used to verify the signed challenge using the device public key. In case the device is blocked, this validation will fail.<br><br>**Note: The challenge should be generated by your client backend.**. <br><br>**Required permissions**: `apps:execute`, `[appId]:execute`, `devices:execute`.

Endpoint: POST /v1/users/{user_id}/device-keys/{key_id}/validate
Security: ClientAccessToken

## Path parameters:

  - `user_id` (string, required)
    ID of the user

  - `key_id` (string, required)
    An identifier for the user's device

## Request fields (application/json):

  - `challenge` (string, required)
    Raw challenge before it was signed by the device

  - `signature` (string, required)
    Signed challenge

## Response 200 fields (application/json):

  - `result` (boolean, required)
    Boolean value indicating if device key validation succeeded