POST/api/user/mfa/webauthn/verify-enrollmentAuthenticated

Confirm a passkey enrollment

Verifies the authenticator's attestation against the challenge issued by POST /api/user/mfa/webauthn/options, stores the credential and activates the pending passkey factor. The challenge is consumed whatever the outcome; an expired or missing challenge is a 410 and the enrollment must be started again. Recovery codes are minted only when this becomes the caller's first verified factor (recovery_codes_issued); a security alert e-mail is sent. Rate limited per user and client IP.

operationId post_api_user_mfa_webauthn_verify_enrollmentMulti-factor authentication

Authentication & permissionsAuthenticated

Any authenticated user

Accepted credentials
Who may call
Any authenticated user

Request body

Required — The pending factor_id, the RegistrationResponseJSON produced by navigator.credentials.create() and an optional label for the passkey.

application/json
MfaVerifyPasskeyEnrollmentRequest
PropertyTypeDescription
factor_id*string (uuid)
labelstring

minLength: 1maxLength: 64

attestation*object
id*string

minLength: 1

rawId*string

minLength: 1

response*object
authenticatorAttachmentstring
clientExtensionResultsobject
type*string

minLength: 1

JSONExample
"factor_id""123e4567-e89b-12d3-a456-426614174000"
"label""string"
"attestation"
"id""string"
"rawId""string"
"response"
"authenticatorAttachment""string"
"clientExtensionResults"
"type""string"

Responses

application/json
MfaVerifyEnrollmentResultOutcome of confirming a factor (or regenerating recovery codes). recovery_codes_issued tells whether recovery_codes carries freshly minted codes to display; when false the user's existing codes still apply and the array is empty.
PropertyTypeDescription
success*true
recovery_codes*string[]
recovery_codes_issued*boolean
JSONExample
"success"true
"recovery_codes"
"string"
"recovery_codes_issued"true

Example request

bashcurl
curl -X POST 'https://auth.schemavaults.com/api/user/mfa/webauthn/verify-enrollment' \
  -b 'refresh_token_<auth_server_app_id>=<value>' \
  -H 'Content-Type: application/json' \
  -d '{
  "factor_id": "123e4567-e89b-12d3-a456-426614174000",
  "label": "string",
  "attestation": {
    "id": "string",
    "rawId": "string",
    "response": {},
    "authenticatorAttachment": "string",
    "clientExtensionResults": {},
    "type": "string"
  }
}'