POST/api/user/mfa/webauthn/authenticate-optionsAuthenticated

Start a passkey step-up verification

Issues WebAuthn authentication options (PublicKeyCredentialRequestOptionsJSON) restricted to the caller's enrolled passkeys, so a signed-in user can re-prove possession of one before a sensitive action such as DELETE /api/user/mfa/webauthn/{factor_id}. One step-up challenge is kept per user; each call replaces it. Refused when the caller has no verified passkey. Any request body is ignored. Rate limited per user and client IP.

operationId post_api_user_mfa_webauthn_authenticate_optionsMulti-factor authentication

Authentication & permissionsAuthenticated

Any authenticated user

Accepted credentials: Auth server session (refresh token cookie)cookie "refresh_token_<auth_server_app_id>"
Access token (cookie)cookie "access_token_<auth_server_app_id>"
Access token (Bearer)Authorization: Bearer <JWT>
Who may call: Any authenticated user

Responses

application/json

MfaWebauthnStepUpOptionsThe PublicKeyCredentialRequestOptionsJSON to hand to navigator.credentials.get() verbatim for a step-up passkey assertion.

Property	Type	Description
options*	object

JSONExample

"options"

Example request

bashcurl

curl -X POST 'https://auth.schemavaults.com/api/user/mfa/webauthn/authenticate-options' \
  -b 'refresh_token_<auth_server_app_id>=<value>'

Authentication & permissionsAuthenticated

Responses

200The assertion options

401No valid session cookie, access token cookie or bearer access token was presented, or the token was revoked

403The account is disabled, or the credential is valid but not allowed to perform this operation

409The caller has no enrolled passkey

429Too many step-up challenges requested

500Failed to start the passkey verification

Example request