sophos_create_user_attestation
Create a user attestation to verify suspicious activity by sending a security question to the user's mobile device and collecting their answer.
Instructions
Create a user activity attestation — push a security question to a user's Intercept X for Mobile device. Use this to verify whether suspicious activity (e.g. an unexpected login) was performed by the legitimate user. The user receives the question on their mobile device and selects an answer option. Poll the attestation status using sophos_get_user_attestation. Status values: 'pending' (awaiting response), 'completed' (user answered), 'expired' (timed out).
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| fields | No | Specific fields to include in a partial response (e.g. ['id', 'status']) | |
| options | No | Custom answer options (max 5). If omitted, default 'yes' and 'no' options are used. | |
| user_id | Yes | UUID of the user to send the attestation to | |
| reference | No | Optional caller-defined reference string returned with the attestation object (alphanumeric, commas, hyphens, slashes, colons; max 256 chars) | |
| tenant_id | Yes | Tenant UUID | |
| title_text | Yes | Title of the attestation question shown on the mobile device (default language, max 100 chars) | |
| question_text | Yes | The question text shown to the user on their mobile device (max 500 chars) | |
| timeout_in_seconds | No | Seconds before the attestation expires (60–86400, default 600). After expiry the attestation becomes read-only. | |
| title_translations | No | Optional translations for the title. Keys are RFC 4646 language tags (e.g. 'de', 'fr'), values are translated text. | |
| question_translations | No | Optional translations for the question. Keys are RFC 4646 language tags (e.g. 'de', 'fr'), values are translated text. |