---
title: "Unlock an Authenticator via API Call"
slug: "oca-ig-unlock-an-authenticator-via-api-call"
updated: 2026-08-06T14:59:17Z
published: 2026-08-06T14:59:17Z
canonical: "docs.onespan.com/oca-ig-unlock-an-authenticator-via-api-call"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.onespan.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Unlock an Authenticator via API Call

The Unlock Device feature allows you to unlock an authenticator that has been locked after too many incorrect PIN entries. OneSpan Cloud Authentication supports unlocking the authenticator via the OneSpan Trusted Identity platform API. To unlock the authenticator, it is necessary to send an unlock challenge that will be generated when the authenticator is turned on the next time after it has been locked.

An authenticator can be unlocked via a POST call to the [POST /authenticators/{serialNumber}/applications/{applName}/unlock](https://community.onespan.com/products/onespan-cloud-authentication/sandbox#/Authenticators/unlockUsingPOST) endpoint. Depending on the type of authenticator, you can select either Plain Text Format for non-Cronto authenticators or Secure Channel Format for Cronto-based authenticators. The endpoint accepts `outputFormat` as payload and `UnlockChallengeInput` as input object. The created output depends on the chosen parameter: if you either do not use this field or enter “outputFormat”: “PlainText", the created output will contain the `unlockCode` field. If you enter “outputFormat”: “SecureChannel", the created output will contain the `unlockRequestMessage` field.

The responses include:

- 200: Unlock completed successfully, unlock code generated and returned in response.
- 400: The input is invalid.
- 404: Authenticator or application not found.
- 409: The authenticator unlock challenge is invalid.
- 500: Internal error, sub-service failure, server crash.