Per https://tools.ietf.org/html/rfc8555#section-7.5.1
> The client indicates to the server that it is ready for the challenge
> validation by sending an empty JSON body ("{}") carried in a POST
> request to the challenge URL (not the authorization URL).