How to complete the challenge `PUT /api/challenger/guid (409) mismatch`

By Alan RichardsonPublished 2026-07-20

Get your current challenger state from /api/challenger/{guid}.

Then send that JSON payload to PUT /api/challenger/{different-guid} while leaving the payload xChallenger value unchanged.

The response should be 409 Conflict:

{
  "errorMessages": [
    "URL GUID does not match payload X-CHALLENGER"
  ]
}

This is a conflict because the URL identifies one challenger while the payload identifies another.

If you want to inspect the challenger payload first, get it with GET /api/challenger/{guid}. See the solution.

GET /api/challenger/{guid} to get the challenger payload

PUT /api/challenger/{different-guid} to trigger a GUID mismatch

Lessons Learned

409 Conflict exposes a mismatch between the target guid and the challenger data being restored.
Restore endpoints need consistency checks so one session cannot be accidentally written as another.
Conflict tests should compare identifiers in the URL, body, and X-CHALLENGER header.

Change only the URL guid while keeping the saved payload untouched and confirm the conflict remains.
Correct the guid mismatch and compare the successful restore response.

Experiment with this endpoint