# Ask for an Ownership Challenge

The message an external address's owner signs to prove they hold it.

## Overview

- `201` with `challengeId`, the entry's `entryVersion`, `family`, `network`, `address`, the `message` to sign, `issuedAt` and `expiresAt` (10 minutes later). No body.
- Give `message` to the address's owner exactly as it is: EIP-191 `personal_sign` on EVM, an ed25519 signature of its UTF-8 bytes on Solana. Then [Prove Ownership](https://docs.aureahub.com/docs/address-book-proof-verify.md) with the signature — [Prove an Address](https://docs.aureahub.com/docs/guide-address-book.md).
- An external entry only, not rejected or removed, in any other state (`409` `ADDRESS_BOOK_PROOF_NOT_EXTERNAL`, `ADDRESS_BOOK_ENTRY_FINAL`). At most 5 challenges open at once — not used, not expired (`409` `ADDRESS_BOOK_CHALLENGE_LIMIT`).
- For `owner`, `tenantadmin`, `non_signing_admin` and `editor`.

## Endpoint

### `POST /v1/address-book/entries/{entryId}/proof/challenge`

Authentication: bearer token required.

Issues a message for the external address's owner to sign.

**Path parameters**

| Name | Type | Required | Description |
| --- | --- | --- | --- |
| `entryId` | string (uuid) | yes | The entry's id |

**Responses**

`201` Created

```json
{
  "challengeId": "c47e0b19-3d6a-4f25-9b81-6e2d5a0c7f34",
  "entryId": "8f3c2a71-5d4e-4b9a-a6c1-2e7f9d0b3c58",
  "entryVersion": 1,
  "family": "evm",
  "network": "mainnet",
  "address": "0x5aAeb6053F3E94C9b9A09f33669435E7Ef1BeAed",
  "message": "Aurea asks you to prove that you control this address, to receive funds from an Aurea address book.\nSigning this message moves no funds and costs nothing.\n\nAddress: 0x5aAeb6053F3E94C9b9A09f33669435E7Ef1BeAed\nAddress type: EVM\nNetwork: mainnet\nTenant: 6f1e2d3c-4b5a-4968-8776-a5b4c3d2e1f0\nEntry: 8f3c2a71-5d4e-4b9a-a6c1-2e7f9d0b3c58 (version 1)\nNonce: 9b1f6c0d2e4a8c3b7f5e1d9a0c2b4e6f8a1c3e5d7b9f0a2c4e6b8d0f1a3c5e7b\nIssued at: 2026-10-08T08:05:00.000Z\nExpires at: 2026-10-08T08:15:00.000Z",
  "issuedAt": "2026-10-08T08:05:00.000Z",
  "expiresAt": "2026-10-08T08:15:00.000Z"
}
```

`409` Not external

```json
{
  "statusCode": 409,
  "error": "ConflictError",
  "message": "Only an external address is proven: an internal one is the tenant's own wallet, a contract has no key",
  "details": { "code": "ADDRESS_BOOK_PROOF_NOT_EXTERNAL" }
}
```

---

Web version: https://docs.aureahub.com/#address-book-proof-challenge