Begin Passkey Enrollment

First of two calls that add a passkey. Answers the WebAuthn creation options for navigator.credentials.create and an enrollmentToken; send both the token and the created credential to POST /v1/users/{id}/passkeys/finish within 5 minutes.

SELF-SERVICE ONLY: {id} must be the caller’s own user id, and the call carries the caller’s own token.

One passkey per account. Needs a sign-in of the last few minutes (PASSKEY_RECENT_AUTH_SEC, 600 seconds by default). The response carries Cache-Control: no-store.

Failures:

• 403 IDE-1070 — the sign-in is not recent enough; sign in again.
• 404 IDE-0013 — {id} is not the caller.
• 409 IDE-1073 — the organization does not offer passkey sign-in.
• 409 IDE-1071 — the account already has a passkey.
• 503 IDE-0066 — the identity provider is unavailable (unreachable, too slow to answer, or failing). Nothing about the request was wrong; retry it later.

POST /v1/users/{id}/passkeys/begin

Begin Passkey Enrollment

cURL

curl --request POST \
  --url https://identity.sandbox.lerian.net/v1/users/{id}/passkeys/begin \
  --header 'Authorization: Bearer <token>'

200

{
  "enrollmentToken": "Zm9vYmFyLWVucm9sbG1lbnQtdG9rZW4tZXhhbXBsZQ",
  "options": "<unknown>"
}

Autorizações

Authorization · string · header · obrigatório

JWT bearer token issued by the identity provider.

Parâmetros de caminho

id · string · obrigatório

Caller's own User ID.

Exemplo:

"00000000-0000-0000-0000-000000000000"

Resposta

200

application/json

OK

enrollmentToken · string · obrigatório

Names this enrollment. Send it back to POST /v1/users/{id}/passkeys/finish within 5 minutes; it works once.

Exemplo:

"Zm9vYmFyLWVucm9sbG1lbnQtdG9rZW4tZXhhbXBsZQ"

options · any · obrigatório

The WebAuthn creation options (publicKey) to pass to navigator.credentials.create, exactly as the identity provider wrote them.