--- title: Authentication challenge responses description: This table describes the authentication challenge responses generated by PingAccess, based on its configuration and properties of the request. component: pingaccess version: 9.0 page_id: pingaccess:pingaccess_user_interface_reference_guide:pa_authentication_challenge_responses canonical_url: https://docs.pingidentity.com/pingaccess/9.0/pingaccess_user_interface_reference_guide/pa_authentication_challenge_responses.html revdate: February 6, 2023 --- # Authentication challenge responses This table describes the authentication challenge responses generated by PingAccess, based on its configuration and properties of the request. An authentication challenge response is an HTTP response sent to a user agent (such as a web browser) by PingAccess, telling the user agent that the corresponding request did not contain a valid authentication token. Some responses also provide instructions to the user agent to obtain a valid authentication token such as an HTTP redirect response containing an encoded OpenID Connect (OIDC) *(tooltip: \
\

An authentication protocol built on top of OAuth that authenticates users and enables clients (relying parties) of all types to request and receive information about authenticated sessions and users. OIDC is extensible, allowing clients to use optional features such as encryption of identity data, discovery of OpenID Providers (OAuth authorization servers), and session management.\

\
)* authentication request. When onboarding new applications to PingAccess, the recommended configuration is `SPA Support = Enabled`, `Request Preservation = POST and Fragment`, and `Fail on Unsupported Content Type = false`, regardless of the behavior of the application. This configuration is displayed in the first table. **Recommended configurations** | PingAccess configuration | | | Request properties | | | Response characteristics | | | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------- | ------------------------------------- | ------------------ | ---------------- | ----------------------- | ------------------------ | ---------------- | | **SPA Support**1 | **Request Preservation**2 | **Fail on Unsupported Content Type**3 | **Method** | **Content Type** | **Accept Header Field** | **Response Code** | **Body Content** | | Enabled | POST, POST and Fragment | Any | GET4 | Any | NOTapplication/json | 401 | HTML | | Enabled | POST, POST and Fragment | Any | GET4 | Any | application/json | 401 | JSON | | Enabled | POST, POST and Fragment | false | POST | Any | NOTapplication/json | 401 | HTML | | Enabled | POST, POST and Fragment | false | POST | Any | application/json | 401 | JSON | | 1Configured on an application. In the Admin application programming interface (API) *(tooltip: \
\

A specification of interactions available for building software to access an application or service.\

\
)*, the field is **spaSupportEnabled**. In the UI, the field is **SPA Support**. See [Adding an application](pa_adding_an_app.html) for more information about this field. | | | | | | | | | 2Configured on a web session. In the Admin API, the field is **requestPreservationType**. In the UI, the field is **Request Preservation**. See [Creating web sessions](pa_creating_web_sessions.html) for more information about this field. | | | | | | | | | 3This option is only available through the Admin API. | | | | | | | | | 4Any non-POST method receives the same response as a GET. | | | | | | | | **Additional configurations** | PingAccess configuration | | | Request properties | | | Response characteristics | | | ------------------------ | ------------------------- | ------------------------------------- | ------------------ | ------------------------------------ | ----------------------- | ------------------------ | ---------------- | | **SPA Support**1 | **Request Preservation**2 | **Fail on Unsupported Content Type**3 | **Method** | **Content Type** | **Accept Header Field** | **Response Code** | **Body Content** | | Disabled | None | Any | Any | Any | Any | 302 | None | | Disabled | POST | Any | GET4 | Any | Any | 302 | None | | Disabled | POST | Any | POST | application/x-www-form-urlencoded | Any | 200 | HTML | | Disabled | POST | false | POST | NOTapplication/x-www-form-urlencoded | Any | 302 | None | | Disabled | POST | true | POST | NOTapplication/x-www-form-urlencoded | Any | 415 | HTML | | Disabled | POST and Fragment | Any | GET4 | Any | Any | 200 | HTML | | Disabled | POST and Fragment | Any | POST | application/x-www-form-urlencoded | Any | 200 | HTML | | Disabled | POST and Fragment | false | POST | NOTapplication/x-www-form-urlencoded | Any | 302 | None | | Disabled | POST and Fragment | true | POST | NOTapplication/x-www-form-urlencoded | Any | 415 | HTML | | Enabled | None | Any | Any | Any | NOTapplication/json | 401 | HTML | | Enabled | None | Any | Any | Any | application/json | 401 | JSON | | Enabled | POST, POST and Fragment | true | POST | NOTapplication/x-www-form-urlencoded | NOTapplication/json | 415 | HTML | | Enabled | POST, POST and Fragment | true | POST | application/x-www-form-urlencoded | NOTapplication/json | 401 | HTML | | Enabled | POST, POST and Fragment | true | POST | Any | application/json | 401 | JSON |