GET/api/user/mfa/webauthnAuthenticated

List my passkeys

Lists the caller's verified passkeys (WebAuthn credentials) with their label and usage timestamps. Pending enrollments are not listed. The payload is returned raw, without a success envelope.

operationId get_api_user_mfa_webauthnMulti-factor authentication

Authentication & permissionsAuthenticated

Any authenticated user

Accepted credentials: Auth server session (refresh token cookie)cookie "refresh_token_<auth_server_app_id>"
Access token (cookie)cookie "access_token_<auth_server_app_id>"
Access token (Bearer)Authorization: Bearer <JWT>
Who may call: Any authenticated user

Responses

application/json

MfaWebauthnCredentialListThe caller's verified passkeys. Pending (unconfirmed) enrollments are not listed.

Property	Type	Description
credentials*	object[]
factor_id*	string (uuid)
label*	string \| null \| null
created_at*	integer	exclusiveMinimum: 0
last_used_at*	integer \| null \| null	exclusiveMinimum: 0

JSONExample

"credentials"

"factor_id""123e4567-e89b-12d3-a456-426614174000"

"label""string"

"created_at"1

"last_used_at"1

Example request

bashcurl

curl -X GET 'https://auth.schemavaults.com/api/user/mfa/webauthn' \
  -b 'refresh_token_<auth_server_app_id>=<value>'

Authentication & permissionsAuthenticated

Responses

200The caller's passkeys

401No valid session cookie, access token cookie or bearer access token was presented, or the token was revoked

403The account is disabled, or the credential is valid but not allowed to perform this operation

500Failed to load the passkeys

Example request