Google Chrome Challenge API

openapi: 3.2.0
info:
  title: Chrome Verified Access Challenge API
  version: v2
  description: Generated from Google's published Discovery document for Chrome Verified Access API (verifiedaccess v2, revision 20261110). 2 operation(s).
  contact:
    name: Google
    url: https://developers.google.com/
  termsOfService: https://developers.google.com/terms
servers:
- url: https://verifiedaccess.googleapis.com
tags:
- name: Challenge
paths:
  /v2/challenge:generate:
    post:
      operationId: verifiedaccess.challenge.generate
      summary: Generate challenge
      description: Generates a new challenge.
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Empty'
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Challenge'
        4XX:
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GoogleRpcError'
          description: 'Client error (google.rpc.Status: INVALID_ARGUMENT, PERMISSION_DENIED, NOT_FOUND ...)'
        default:
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GoogleRpcError'
          description: Error response (google.rpc.Status)
      security:
      - oauth2:
        - https://www.googleapis.com/auth/verifiedaccess
      - apiKey: []
      tags:
      - Challenge
  /v2/challenge:verify:
    post:
      operationId: verifiedaccess.challenge.verify
      summary: Verify challenge
      description: Verifies the challenge response.
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/VerifyChallengeResponseRequest'
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/VerifyChallengeResponseResult'
        4XX:
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GoogleRpcError'
          description: 'Client error (google.rpc.Status: INVALID_ARGUMENT, PERMISSION_DENIED, NOT_FOUND ...)'
        default:
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GoogleRpcError'
          description: Error response (google.rpc.Status)
      security:
      - oauth2:
        - https://www.googleapis.com/auth/verifiedaccess
      - apiKey: []
      tags:
      - Challenge
components:
  schemas:
    CrowdStrikeAgent:
      description: Properties of the CrowdStrike agent installed on a device.
      properties:
        customerId:
          readOnly: true
          type: string
          description: Output only. The Customer ID to which the agent belongs to.
        agentId:
          type: string
          description: Output only. The Agent ID of the Crowdstrike agent.
          readOnly: true
      type: object
    VerifyChallengeResponseRequest:
      type: object
      properties:
        challengeResponse:
          description: Required. The generated response to the challenge, the bytes representation of SignedData.
          format: byte
          type: string
        expectedIdentity:
          description: Optional. Service can optionally provide identity information about the device or user associated with the key. For an EMK, this value is the enrolled domain. For an EUK, this value is the user's email address. If present, this value will be checked against contents of the response, and verification will fail if there is no match.
          type: string
      description: Signed ChallengeResponse.
    DeviceSignals:
      properties:
        diskEncryption:
          enum:
          - DISK_ENCRYPTION_UNSPECIFIED
          - DISK_ENCRYPTION_UNKNOWN
          - DISK_ENCRYPTION_DISABLED
          - DISK_ENCRYPTION_ENCRYPTED
          readOnly: true
          type: string
          description: Output only. The encryption state of the disk. On ChromeOS, the main disk is always ENCRYPTED.
        realtimeUrlCheckMode:
          enum:
          - REALTIME_URL_CHECK_MODE_UNSPECIFIED
          - REALTIME_URL_CHECK_MODE_DISABLED
          - REALTIME_URL_CHECK_MODE_ENABLED_MAIN_FRAME
          description: 'Output only. Whether Enterprise-grade (i.e. custom) unsafe URL scanning is enabled or not. This setting may be controlled by an enterprise policy: https://chromeenterprise.google/policies/#EnterpriseRealTimeUrlCheckMode'
          type: string
          readOnly: true
        safeBrowsingProtectionLevel:
          type: string
          description: 'Output only. Safe Browsing Protection Level. That setting may be controlled by an enterprise policy: https://chromeenterprise.google/policies/#SafeBrowsingProtectionLevel.'
          readOnly: true
          enum:
          - SAFE_BROWSING_PROTECTION_LEVEL_UNSPECIFIED
          - INACTIVE
          - STANDARD
          - ENHANCED
        antivirus:
          $ref: '#/components/schemas/Antivirus'
          description: Output only. Information about Antivirus software on the device. Available on Windows only.
        trigger:
          description: Output only. The trigger which generated this set of signals.
          readOnly: true
          enum:
          - TRIGGER_UNSPECIFIED
          - TRIGGER_BROWSER_NAVIGATION
          - TRIGGER_LOGIN_SCREEN
          type: string
        allowScreenLock:
          type: boolean
          readOnly: true
          description: Output only. Value of the AllowScreenLock policy on the device. See https://chromeenterprise.google/policies/?policy=AllowScreenLock for more details. Available on ChromeOS only.
        windowsUserDomain:
          type: string
          description: Output only. Windows domain for the current OS user. Available on Windows only.
          readOnly: true
        crowdStrikeAgent:
          $ref: '#/components/schemas/CrowdStrikeAgent'
          description: Output only. Crowdstrike agent properties installed on the device, if any. Available on Windows and MacOS only.
        systemDnsServers:
          type: array
          description: List of the addesses of all OS level DNS servers configured in the device's network settings.
          items:
            type: string
        osFirewall:
          enum:
          - OS_FIREWALL_UNSPECIFIED
          - OS_FIREWALL_UNKNOWN
          - OS_FIREWALL_DISABLED
          - OS_FIREWALL_ENABLED
          description: Output only. The state of the OS level firewall. On ChromeOS, the value will always be ENABLED on regular devices and UNKNOWN on devices in developer mode. Support for MacOS 15 (Sequoia) and later has been introduced in Chrome M131.
          type: string
          readOnly: true
        windowsMachineDomain:
          type: string
          description: Output only. Windows domain that the current machine has joined. Available on Windows only.
          readOnly: true
        screenLockSecured:
          readOnly: true
          enum:
          - SCREEN_LOCK_SECURED_UNSPECIFIED
          - SCREEN_LOCK_SECURED_UNKNOWN
          - SCREEN_LOCK_SECURED_DISABLED
          - SCREEN_LOCK_SECURED_ENABLED
          type: string
          description: Output only. The state of the Screen Lock password protection. On ChromeOS, this value will always be ENABLED as there is not way to disable requiring a password or pin when unlocking the device.
        operatingSystem:
          enum:
          - OPERATING_SYSTEM_UNSPECIFIED
          - CHROME_OS
          - CHROMIUM_OS
          - WINDOWS
          - MAC_OS_X
          - LINUX
          - IOS
          - ANDROID
          type: string
          description: Output only. The type of the Operating System currently running on the device.
          readOnly: true
        imei:
          type: array
          readOnly: true
          description: Output only. International Mobile Equipment Identity (IMEI) of the device. Available on ChromeOS only.
          items:
            type: string
        meid:
          readOnly: true
          description: Output only. Mobile Equipment Identifier (MEID) of the device. Available on ChromeOS only.
          type: array
          items:
            type: string
        browserVersion:
          type: string
          readOnly: true
          description: 'Output only. Current version of the Chrome browser which generated this set of signals. Example value: "107.0.5286.0".'
        deviceManufacturer:
          description: Output only. The name of the device's manufacturer.
          readOnly: true
          type: string
        chromeRemoteDesktopAppBlocked:
          readOnly: true
          description: Output only. Whether access to the Chrome Remote Desktop application is blocked via a policy.
          type: boolean
        deviceModel:
          description: Output only. The name of the device's model.
          readOnly: true
          type: string
        displayName:
          description: Output only. The display name of the device, as defined by the user.
          readOnly: true
          type: string
        profileAffiliationIds:
          readOnly: true
          type: array
          description: Output only. Affiliation IDs of the organizations that are affiliated with the organization that is currently managing the Chrome Profile’s user or ChromeOS user.
          items:
            type: string
        hostname:
          description: Hostname of the device.
          type: string
        serialNumber:
          readOnly: true
          description: Output only. The serial number of the device. On Windows, this represents the BIOS's serial number. Not available on most Linux distributions.
          type: string
        macAddresses:
          items:
            type: string
          type: array
          description: Output only. MAC addresses of the device.
          readOnly: true
        deviceEnrollmentDomain:
          description: Output only. Enrollment domain of the customer which is currently managing the device.
          readOnly: true
          type: string
        deviceAffiliationIds:
          description: Output only. Affiliation IDs of the organizations that are affiliated with the organization that is currently managing the device. When the sets of device and profile affiliation IDs overlap, it means that the organizations managing the device and user are affiliated. To learn more about user affiliation, visit https://support.google.com/chrome/a/answer/12801245?ref_topic=9027936.
          readOnly: true
          type: array
          items:
            type: string
        siteIsolationEnabled:
          type: boolean
          readOnly: true
          description: 'Output only. Whether the Site Isolation (a.k.a Site Per Process) setting is enabled. That setting may be controlled by an enterprise policy: https://chromeenterprise.google/policies/#SitePerProcess'
        osVersion:
          readOnly: true
          description: Output only. The current version of the Operating System. On Windows and linux, the value will also include the security patch information.
          type: string
        profileEnrollmentDomain:
          type: string
          readOnly: true
          description: Output only. Enrollment domain of the customer which is currently managing the profile.
        secureBootMode:
          type: string
          readOnly: true
          enum:
          - SECURE_BOOT_MODE_UNSPECIFIED
          - SECURE_BOOT_MODE_UNKNOWN
          - SECURE_BOOT_MODE_DISABLED
          - SECURE_BOOT_MODE_ENABLED
          description: Output only. Whether the device's startup software has its Secure Boot feature enabled. Available on Windows only.
        thirdPartyBlockingEnabled:
          readOnly: true
          description: 'Output only. Deprecated. The corresponding policy is now deprecated. Whether Chrome is blocking third-party software injection or not. This setting may be controlled by an enterprise policy: https://chromeenterprise.google/policies/?policy=ThirdPartyBlockingEnabled. Available on Windows only.'
          type: boolean
          deprecated: true
        passwordProtectionWarningTrigger:
          type: string
          description: 'Output only. Whether the Password Protection Warning feature is enabled or not. Password protection alerts users when they reuse their protected password on potentially suspicious sites. This setting is controlled by an enterprise policy: https://chromeenterprise.google/policies/#PasswordProtectionWarningTrigger. Note that the policy unset does not have the same effects as having the policy explicitly set to `PASSWORD_PROTECTION_OFF`.'
          readOnly: true
          enum:
          - PASSWORD_PROTECTION_WARNING_TRIGGER_UNSPECIFIED
          - POLICY_UNSET
          - PASSWORD_PROTECTION_OFF
          - PASSWORD_REUSE
          - PHISHING_REUSE
        builtInDnsClientEnabled:
          type: boolean
          readOnly: true
          description: 'Output only. Whether Chrome''s built-in DNS client is used. The OS DNS client is otherwise used. This value may be controlled by an enterprise policy: https://chromeenterprise.google/policies/#BuiltInDnsClientEnabled.'
      description: The device signals as reported by Chrome. Unless otherwise specified, signals are available on all platforms.
      type: object
    Antivirus:
      description: Antivirus information on a device.
      type: object
      properties:
        state:
          description: Output only. The state of the antivirus on the device. Introduced in Chrome M136.
          readOnly: true
          type: string
          enum:
          - STATE_UNSPECIFIED
          - MISSING
          - DISABLED
          - ENABLED
    Empty:
      description: 'A generic empty message that you can re-use to avoid defining duplicated empty messages in your APIs. A typical example is to use it as the request or the response type of an API method. For instance: service Foo { rpc Bar(google.protobuf.Empty) returns (google.protobuf.Empty); }'
      properties: {}
      type: object
    Challenge:
      description: Result message for VerifiedAccess.GenerateChallenge.
      type: object
      properties:
        challenge:
          format: byte
          description: Generated challenge, the bytes representation of SignedData.
          type: string
    GoogleRpcError:
      type: object
      description: The error envelope every Google API returns.
      properties:
        error:
          type: object
          properties:
            code:
              type: integer
            message:
              type: string
            status:
              type: string
            details:
              type: array
              items:
                type: object
    VerifyChallengeResponseResult:
      description: Result message for VerifiedAccess.VerifyChallengeResponse. The response returned when successful for Managed profiles on Unmanaged browsers will NOT have devicePermanentId, keyTrustLevel, virtualDeviceId and customerId fields. Managed profiles will INSTEAD have the profileCustomerId, virtualProfileId, profilePermanentId and profileKeyTrustLevel fields.
      type: object
      properties:
        profilePermanentId:
          readOnly: true
          type: string
          description: Output only. The unique server-side ID of a profile on the device.
        deviceSignals:
          $ref: '#/components/schemas/DeviceSignals'
          description: Output only. Device signals.
        virtualProfileId:
          description: Output only. The client-provided ID of a profile on the device.
          readOnly: true
          type: string
        devicePermanentId:
          description: Output only. Device permanent id is returned in this field (for the machine response only).
          readOnly: true
          type: string
        profileKeyTrustLevel:
          enum:
          - KEY_TRUST_LEVEL_UNSPECIFIED
          - CHROME_OS_VERIFIED_MODE
          - CHROME_OS_DEVELOPER_MODE
          - CHROME_BROWSER_HW_KEY
          - CHROME_BROWSER_OS_KEY
          - CHROME_BROWSER_NO_KEY
          - CHROME_OS_NO_KEY
          description: Output only. Profile attested key trust level.
          readOnly: true
          type: string
        virtualDeviceId:
          type: string
          description: Output only. Virtual device id of the device. The definition of virtual device id is platform-specific.
          readOnly: true
        attestedDeviceId:
          readOnly: true
          type: string
          description: Output only. Attested device ID (ADID).
        keyTrustLevel:
          type: string
          readOnly: true
          description: Output only. Device attested key trust level.
          enum:
          - KEY_TRUST_LEVEL_UNSPECIFIED
          - CHROME_OS_VERIFIED_MODE
          - CHROME_OS_DEVELOPER_MODE
          - CHROME_BROWSER_HW_KEY
          - CHROME_BROWSER_OS_KEY
          - CHROME_BROWSER_NO_KEY
          - CHROME_OS_NO_KEY
        signedPublicKeyAndChallenge:
          readOnly: true
          type: string
          description: Output only. Certificate Signing Request (in the SPKAC format, base64 encoded) is returned in this field. This field will be set only if device has included CSR in its challenge response. (the option to include CSR is now available for both user and machine responses)
        profileCustomerId:
          readOnly: true
          type: string
          description: Output only. Unique customer id that this profile belongs to, as defined by the Google Admin SDK at https://developers.google.com/admin-sdk/directory/v1/guides/manage-customers
        customerId:
          type: string
          description: Output only. Unique customer id that this device belongs to, as defined by the Google Admin SDK at https://developers.google.com/admin-sdk/directory/v1/guides/manage-customers
          readOnly: true
        deviceSignal:
          description: Output only. Deprecated. Device signal in json string representation. Prefer using `device_signals` instead.
          readOnly: true
          type: string
        deviceEnrollmentId:
          readOnly: true
          type: string
          description: Output only. Device enrollment id for ChromeOS devices.
  securitySchemes:
    apiKey:
      type: apiKey
      in: query
      name: key
      description: API key; accepted by methods that do not need user data.
    oauth2:
      type: oauth2
      flows:
        authorizationCode:
          authorizationUrl: https://accounts.google.com/o/oauth2/auth
          tokenUrl: https://oauth2.googleapis.com/token
          scopes:
            https://www.googleapis.com/auth/verifiedaccess: Verify your enterprise credentials
externalDocs:
  url: https://developers.google.com/chrome/verified-access
x-provenance:
  method: harvested
  publisher: Google
  source: https://verifiedaccess.googleapis.com/$discovery/rest?version=v2
  note: converted by discovery-to-openapi.py from Google's Discovery document (revision 20261110)