Passkeys

2 endpoints

Passwordless WebAuthn sign-in with device biometrics.

passkeys.read

passkeys.write

List and revoke WebAuthn passkey credentials for directory users.

Authenticate with your organization API key. Include subOrgId as a query parameter or in the request body when using an org-wide key. Sub-org-scoped keys automatically target their sub-organization.

GET

/v1/webauthn/credentials

List passkey credentials for a user. Requires passkeys.read.

Query Parameters

Param	Type	Required	Description
subOrgId	string	No	Sub-organization ID. Required for org-wide keys on write operations; optional on list when the key is scoped to one sub-org.
userId	string	Yes	Directory user ID

Response — 200

{ "credentials": [ /* passkey records */ ] }

DELETE

/v1/webauthn/credentials/{credentialId}

Revoke a passkey credential. Requires passkeys.write.

Query Parameters

Param	Type	Required	Description
subOrgId	string	No	Sub-organization ID. Required for org-wide keys on write operations; optional on list when the key is scoped to one sub-org.

Response — 200

{ "success": true }