POST/api/user/mfa/webauthn/optionsAuthenticated

Start a passkey enrollment

Creates a pending passkey factor for the caller and returns the WebAuthn registration options (PublicKeyCredentialCreationOptionsJSON) for navigator.credentials.create(); already enrolled passkeys are excluded so the authenticator will not register a duplicate. Confirm the enrollment with POST /api/user/mfa/webauthn/verify-enrollment; the challenge expires after a short time. Abandoned enrollments are swept first. Any request body is ignored. Rate limited per user and client IP.

operationId post_api_user_mfa_webauthn_optionsMulti-factor authentication

Authentication & permissionsAuthenticated

Any authenticated user

Accepted credentials
Who may call
Any authenticated user

Responses

application/json
MfaWebauthnEnrollOptionsA pending passkey enrollment: the PublicKeyCredentialCreationOptionsJSON to hand to navigator.credentials.create() verbatim, plus the factor_id to confirm the enrollment with.
PropertyTypeDescription
factor_id*string (uuid)
options*object
JSONExample
"factor_id""123e4567-e89b-12d3-a456-426614174000"
"options"

Example request

bashcurl
curl -X POST 'https://auth.schemavaults.com/api/user/mfa/webauthn/options' \
  -b 'refresh_token_<auth_server_app_id>=<value>'
POST /api/user/mfa/webauthn/options | SchemaVaults Auth API