> **Can't find what you're looking for?** Use `search_docs` on the docs MCP server at `https://docs.prividium.com/api/mcp` to find what you need.
>
> **Have feedback?** Use `submit_feedback` on the same MCP server.

# webauthn

## GET /admin/webauthn/users/{userId}

`GET /admin/webauthn/users/{userId}`

List all passkeys for a user (admin only)

### Path parameters

- `userId` `string` _(required)_

### Responses

#### `200`: Default Response

Body (`application/json`):

- `items` `object[]` _(required)_
  - `id` `string` _(required)_
  - `credentialId` `string` _(required)_
  - `deviceName` `string | null` _(required)_
  - `lastUsedAt` `string <date-time>` _(required)_
  - `createdAt` `string <date-time>` _(required)_

#### `401`: Default Response

Body (`application/json`):

- `error` `object` _(required)_
  - `code` `string` _(required)_
  - `message` `string` _(required)_
  - `issues` `unknown[]`

#### `403`: Default Response

Body (`application/json`):

- `error` `object` _(required)_
  - `code` `string` _(required)_
  - `message` `string` _(required)_
  - `issues` `unknown[]`

#### `404`: Default Response

Body (`application/json`):

- `error` `object` _(required)_
  - `code` `string` _(required)_
  - `message` `string` _(required)_
  - `issues` `unknown[]`

### Example request

```bash
curl /api/admin/webauthn/users/string
```

```ts
fetch('/api/admin/webauthn/users/string')
```

## DELETE /admin/webauthn/users/{userId}

`DELETE /admin/webauthn/users/{userId}`

Reset all passkeys for a user (admin only)

### Path parameters

- `userId` `string` _(required)_

### Responses

#### `200`: Default Response

Body (`application/json`):

- `deletedCount` `number` _(required)_

#### `401`: Default Response

#### `403`: Default Response

Body (`application/json`):

- `error` `object` _(required)_
  - `code` `string` _(required)_
  - `message` `string` _(required)_
  - `issues` `unknown[]`

#### `404`: Default Response

Body (`application/json`):

- `error` `object` _(required)_
  - `code` `string` _(required)_
  - `message` `string` _(required)_
  - `issues` `unknown[]`

### Example request

```bash
curl /api/admin/webauthn/users/string \
  --request DELETE
```

```ts
fetch('/api/admin/webauthn/users/string', {
  method: 'DELETE'
})
```

## DELETE /admin/webauthn/users/{userId}/{credentialId}

`DELETE /admin/webauthn/users/{userId}/{credentialId}`

Delete a specific passkey for a user (admin only)

### Path parameters

- `userId` `string` _(required)_
- `credentialId` `string` _(required)_

### Responses

#### `204`: Default Response

#### `401`: Default Response

#### `403`: Default Response

Body (`application/json`):

- `error` `object` _(required)_
  - `code` `string` _(required)_
  - `message` `string` _(required)_
  - `issues` `unknown[]`

#### `404`: Default Response

Body (`application/json`):

- `error` `object` _(required)_
  - `code` `string` _(required)_
  - `message` `string` _(required)_
  - `issues` `unknown[]`

### Example request

```bash
curl /api/admin/webauthn/users/string/string \
  --request DELETE
```

```ts
fetch('/api/admin/webauthn/users/string/string', {
  method: 'DELETE'
})
```

## POST /webauthn/register/begin

`POST /webauthn/register/begin`

Begin passkey registration for the authenticated user

### Responses

#### `200`: Default Response

Body (`application/json`):

- `challenge` `string` _(required)_
- `rp` `object` _(required)_
  - `name` `string` _(required)_
  - `id` `string`
- `user` `object` _(required)_
  - `id` `string` _(required)_
  - `name` `string` _(required)_
  - `displayName` `string` _(required)_
- `pubKeyCredParams` `object[]` _(required)_
  - `type` `string` _(required)_
  - `alg` `number` _(required)_
- `timeout` `number`
- `excludeCredentials` `object[]`
  - `id` `string` _(required)_
  - `type` `string` _(required)_
  - `transports` `string[]`
- `authenticatorSelection` `object`
  - `authenticatorAttachment` `string`
  - `residentKey` `string`
  - `requireResidentKey` `boolean`
  - `userVerification` `string`
- `attestation` `string`
- `extensions` `object`

#### `400`: Default Response

Body (`application/json`):

- `error` `object` _(required)_
  - `code` `string` _(required)_
  - `message` `string` _(required)_
  - `issues` `unknown[]`

#### `401`: Default Response

#### `403`: Default Response

Body (`application/json`):

- `error` `object` _(required)_
  - `code` `string` _(required)_
  - `message` `string` _(required)_
  - `issues` `unknown[]`

#### `429`: Default Response

Body (`application/json`):

- `error` `object` _(required)_
  - `code` `string` _(required)_
  - `message` `string` _(required)_
  - `issues` `unknown[]`

### Example request

```bash
curl /api/webauthn/register/begin \
  --request POST
```

```ts
fetch('/api/webauthn/register/begin', {
  method: 'POST'
})
```

## POST /webauthn/register/finish

`POST /webauthn/register/finish`

Complete passkey registration for the authenticated user

### Request body (required) (`application/json`)

- `response` `object` _(required)_
  - `id` `string` _(required)_
  - `rawId` `string` _(required)_
  - `response` `object` _(required)_
    - `clientDataJSON` `string <base64url>` _(required)_
    - `attestationObject` `string` _(required)_
    - `authenticatorData` `string`
    - `transports` `string[]`
    - `publicKeyAlgorithm` `number`
    - `publicKey` `string`
  - `authenticatorAttachment` `string`
  - `clientExtensionResults` `object` _(required)_
  - `type` `string` _(required)_
  - `deviceName` `string`
- `deviceName` `string`

### Responses

#### `200`: Default Response

Body (`application/json`):

- `id` `string` _(required)_
- `credentialId` `string` _(required)_
- `deviceName` `string | null` _(required)_
- `lastUsedAt` `string <date-time>` _(required)_
- `createdAt` `string <date-time>` _(required)_

#### `400`: Default Response

Body (`application/json`):

- `error` `object` _(required)_
  - `code` `string` _(required)_
  - `message` `string` _(required)_
  - `issues` `unknown[]`

#### `401`: Default Response

Body (`application/json`):

- `error` `object` _(required)_
  - `code` `string` _(required)_
  - `message` `string` _(required)_
  - `issues` `unknown[]`

#### `403`: Default Response

Body (`application/json`):

- `error` `object` _(required)_
  - `code` `string` _(required)_
  - `message` `string` _(required)_
  - `issues` `unknown[]`

### Example request

```bash
curl /api/webauthn/register/finish \
  --request POST \
  --header 'Content-Type: application/json' \
  --data '{
  "response": {
    "id": "string",
    "rawId": "string",
    "response": {
      "clientDataJSON": "string",
      "attestationObject": "string",
      "authenticatorData": "string",
      "transports": [
        "ble"
      ],
      "publicKeyAlgorithm": 0,
      "publicKey": "string"
    },
    "authenticatorAttachment": "platform",
    "clientExtensionResults": {},
    "type": "public-key",
    "deviceName": "string"
  },
  "deviceName": "string"
}'
```

```ts
fetch('/api/webauthn/register/finish', {
  method: 'POST',
  headers: {
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({
    response: {
      id: 'string',
      rawId: 'string',
      response: {
        clientDataJSON: 'string',
        attestationObject: 'string',
        authenticatorData: 'string',
        transports: ['ble'],
        publicKeyAlgorithm: 0,
        publicKey: 'string'
      },
      authenticatorAttachment: 'platform',
      clientExtensionResults: {},
      type: 'public-key',
      deviceName: 'string'
    },
    deviceName: 'string'
  })
})
```

## GET /webauthn/credentials

`GET /webauthn/credentials`

List all passkeys for the authenticated user

### Responses

#### `200`: Default Response

Body (`application/json`):

- `id` `string` _(required)_
- `credentialId` `string` _(required)_
- `deviceName` `string | null` _(required)_
- `lastUsedAt` `string <date-time>` _(required)_
- `createdAt` `string <date-time>` _(required)_

#### `401`: Default Response

Body (`application/json`):

- `error` `object` _(required)_
  - `code` `string` _(required)_
  - `message` `string` _(required)_
  - `issues` `unknown[]`

### Example request

```bash
curl /api/webauthn/credentials
```

```ts
fetch('/api/webauthn/credentials')
```

## PUT /webauthn/credentials/{id}

`PUT /webauthn/credentials/{id}`

Update a passkey

### Path parameters

- `id` `string` _(required)_

### Request body (required) (`application/json`)

- `deviceName` `string` _(required)_

### Responses

#### `200`: Default Response

Body (`application/json`):

- `id` `string` _(required)_
- `credentialId` `string` _(required)_
- `deviceName` `string | null` _(required)_
- `lastUsedAt` `string <date-time>` _(required)_
- `createdAt` `string <date-time>` _(required)_

#### `401`: Default Response

Body (`application/json`):

- `error` `object` _(required)_
  - `code` `string` _(required)_
  - `message` `string` _(required)_
  - `issues` `unknown[]`

#### `403`: Default Response

Body (`application/json`):

- `error` `object` _(required)_
  - `code` `string` _(required)_
  - `message` `string` _(required)_
  - `issues` `unknown[]`

#### `404`: Default Response

Body (`application/json`):

- `error` `object` _(required)_
  - `code` `string` _(required)_
  - `message` `string` _(required)_
  - `issues` `unknown[]`

### Example request

```bash
curl /api/webauthn/credentials/string \
  --request PUT \
  --header 'Content-Type: application/json' \
  --data '{
  "deviceName": "string"
}'
```

```ts
fetch('/api/webauthn/credentials/string', {
  method: 'PUT',
  headers: {
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({
    deviceName: 'string'
  })
})
```

## DELETE /webauthn/credentials/{id}

`DELETE /webauthn/credentials/{id}`

Delete a passkey (blocked if it is the last passkey of an MFA-required account)

### Path parameters

- `id` `string` _(required)_

### Responses

#### `204`: Default Response

#### `401`: Default Response

Body (`application/json`):

- `error` `object` _(required)_
  - `code` `string` _(required)_
  - `message` `string` _(required)_
  - `issues` `unknown[]`

#### `403`: Default Response

Body (`application/json`):

- `error` `object` _(required)_
  - `code` `string` _(required)_
  - `message` `string` _(required)_
  - `issues` `unknown[]`

#### `404`: Default Response

Body (`application/json`):

- `error` `object` _(required)_
  - `code` `string` _(required)_
  - `message` `string` _(required)_
  - `issues` `unknown[]`

### Example request

```bash
curl /api/webauthn/credentials/string \
  --request DELETE
```

```ts
fetch('/api/webauthn/credentials/string', {
  method: 'DELETE'
})
```

## POST /webauthn/step-up/begin

`POST /webauthn/step-up/begin`

Begin a WebAuthn step-up ceremony for the given action

### Request body (required) (`application/json`)

- `action` `string` _(required)_

### Responses

#### `200`: Default Response

Body (`application/json`):

- `rpId` `string` _(required)_
- `challenge` `string` _(required)_
- `allowCredentials` `object[]` _(required)_
  - `id` `string` _(required)_
  - `type` `string` _(required)_
  - `transports` `string[]`

#### `400`: Default Response

Body (`application/json`):

- `error` `object` _(required)_
  - `code` `string` _(required)_
  - `message` `string` _(required)_
  - `issues` `unknown[]`

#### `401`: Default Response

Body (`application/json`):

- `error` `object` _(required)_
  - `code` `string` _(required)_
  - `message` `string` _(required)_
  - `issues` `unknown[]`

#### `429`: Default Response

Body (`application/json`):

- `error` `object` _(required)_
  - `code` `string` _(required)_
  - `message` `string` _(required)_
  - `issues` `unknown[]`

### Example request

```bash
curl /api/webauthn/step-up/begin \
  --request POST \
  --header 'Content-Type: application/json' \
  --data '{
  "action": "string"
}'
```

```ts
fetch('/api/webauthn/step-up/begin', {
  method: 'POST',
  headers: {
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({
    action: 'string'
  })
})
```

## POST /webauthn/step-up/finish

`POST /webauthn/step-up/finish`

Complete a WebAuthn step-up ceremony and receive a single-use proof token

### Request body (required) (`application/json`)

- `action` `string` _(required)_
- `assertion` `object` _(required)_
  - `id` `string` _(required)_
  - `rawId` `string` _(required)_
  - `response` `object` _(required)_
    - `clientDataJSON` `string <base64url>` _(required)_
    - `authenticatorData` `string` _(required)_
    - `signature` `string` _(required)_
    - `userHandle` `string`
  - `authenticatorAttachment` `string`
  - `clientExtensionResults` `object` _(required)_
  - `type` `string` _(required)_

### Responses

#### `200`: Default Response

Body (`application/json`):

- `proof` `string` _(required)_
- `expiresAt` `string <date-time>` _(required)_

#### `400`: Default Response

Body (`application/json`):

- `error` `object` _(required)_
  - `code` `string` _(required)_
  - `message` `string` _(required)_
  - `issues` `unknown[]`

#### `401`: Default Response

Body (`application/json`):

- `error` `object` _(required)_
  - `code` `string` _(required)_
  - `message` `string` _(required)_
  - `issues` `unknown[]`

### Example request

```bash
curl /api/webauthn/step-up/finish \
  --request POST \
  --header 'Content-Type: application/json' \
  --data '{
  "action": "string",
  "assertion": {
    "id": "string",
    "rawId": "string",
    "response": {
      "clientDataJSON": "string",
      "authenticatorData": "string",
      "signature": "string",
      "userHandle": "string"
    },
    "authenticatorAttachment": "platform",
    "clientExtensionResults": {},
    "type": "public-key"
  }
}'
```

```ts
fetch('/api/webauthn/step-up/finish', {
  method: 'POST',
  headers: {
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({
    action: 'string',
    assertion: {
      id: 'string',
      rawId: 'string',
      response: {
        clientDataJSON: 'string',
        authenticatorData: 'string',
        signature: 'string',
        userHandle: 'string'
      },
      authenticatorAttachment: 'platform',
      clientExtensionResults: {},
      type: 'public-key'
    }
  })
})
```