1Kosmos · FIDO2 / WebAuthn
WebAuthn API
FIDO2 / WebAuthn passkey registration and authentication.
The WebAuthn service implements FIDO2 passkey registration and authentication. Register authenticators, run assertion ceremonies, link and de-register passkeys, and read authenticator vendor metadata — standards-based, phishing-resistant login.
21 endpoints
across 11 resource groups.
ECDSA-signed
every request is signed with your key pair.
JSON over HTTPS
predictable REST, conventional status codes.
OpenAPI 3.0
Reference
Base URL
All WebAuthn endpoints are relative to your environment host. Examples on this page use the 1Kosmos pilot environment — swap in your production root when you go live.
Pilot
/webauthn
Content type
Requests and responses use application/json.
GET/webauthn/healthz
curl -X GET '/webauthn/healthz' \ -H 'privateKey: YOUR_PRIVATE_KEY' \ -H 'publicKey: YOUR_PUBLIC_KEY' \ -H 'licensekey: YOUR_LICENSE_KEY'
Security
Authentication
WebAuthn uses ECDSA key-pair authentication. Each request carries your credentials as
HTTP headers; verification-grade calls additionally sign the request body. Retrieve the system signing
key from /publickeys.
Credentials
privateKeyAuthentication headerheader
publicKeyAuthentication headerheader
licensekeyAuthentication headerheader
GET/webauthn/healthz
cURL
Node.js
Python
curl -X GET '/webauthn/healthz' \ -H 'privateKey: YOUR_PRIVATE_KEY' \ -H 'publicKey: YOUR_PUBLIC_KEY' \ -H 'licensekey: YOUR_LICENSE_KEY'
const res = await fetch("/webauthn/healthz", {
method: "GET",
headers: {
"privateKey": "YOUR_PRIVATE_KEY",
"publicKey": "YOUR_PUBLIC_KEY",
"licensekey": "YOUR_LICENSE_KEY"
}
});
const data = await res.json();import requests
res = requests.get(
"/webauthn/healthz",
headers={
"privateKey": "YOUR_PRIVATE_KEY",
"publicKey": "YOUR_PUBLIC_KEY",
"licensekey": "YOUR_LICENSE_KEY"
}
)
print(res.json())Reference
Errors
WebAuthn uses conventional HTTP status codes: 2xx success, 4xx a problem
with the request, 5xx a service-side error.
| Status | Meaning | Description |
|---|---|---|
| 200 / 204 | OK | The request succeeded. |
| 400 | Bad Request | Validation failed. |
| 401 | Unauthorized | Missing or invalid credentials. |
| 403 | Forbidden | Authenticated, but not permitted. |
| 404 | Not Found | The resource does not exist. |
| 500 | Server Error | Something went wrong on our side. |
4XXerror response
{
"statusCode": 400,
"error": "Bad Request",
"message": "Validation error"
}WebAuthn
Web Auth N Linking and De-Registration
Web Auth N Linking and De-Registration endpoints.
GET/link/community/{communityId}/user/{userId}/status
/link/community/{communityId}/user/{userId}/status
Path parameters
| Name | Type | Description |
|---|---|---|
| communityIdrequired | string | — |
| userIdrequired | string | — |
GET/webauthn/link/community/{communityId}/user/{userId}/status
cURL
Node.js
Python
curl -X GET '/webauthn/link/community/<communityId>/user/<userId>/status' \ -H 'licensekey: YOUR_LICENSE_KEY' \ -H 'publicKey: YOUR_PUBLIC_KEY' \ -H 'privateKey: YOUR_PRIVATE_KEY'
const res = await fetch("/webauthn/link/community/<communityId>/user/<userId>/status", {
method: "GET",
headers: {
"licensekey": "YOUR_LICENSE_KEY",
"publicKey": "YOUR_PUBLIC_KEY",
"privateKey": "YOUR_PRIVATE_KEY"
}
});
const data = await res.json();import requests
res = requests.get(
"/webauthn/link/community/<communityId>/user/<userId>/status",
headers={
"licensekey": "YOUR_LICENSE_KEY",
"publicKey": "YOUR_PUBLIC_KEY",
"privateKey": "YOUR_PRIVATE_KEY"
}
)
print(res.json())RESPONSE
400
200
Bad Request
OK
// no response body
{
"status": "string",
"errorMessage": "string"
}PUT/link/community/{communityId}/did/{did}/user/{userId}/fidokey/{fidoKeyHash}
/link/community/{communityId}/did/{did}/user/{userId}/fidokey/{fidoKeyHash}
Path parameters
| Name | Type | Description |
|---|---|---|
| communityIdrequired | string | — |
| didrequired | string | — |
| userIdrequired | string | — |
| fidoKeyHashrequired | string | — |
PUT/webauthn/link/community/{communityId}/did/{did}/user/{userId}/fidokey/{fidoKeyHash}
cURL
Node.js
Python
curl -X PUT '/webauthn/link/community/<communityId>/did/<did>/user/<userId>/fidokey/<fidoKeyHash>' \ -H 'licensekey: YOUR_LICENSE_KEY' \ -H 'publicKey: YOUR_PUBLIC_KEY' \ -H 'privateKey: YOUR_PRIVATE_KEY'
const res = await fetch("/webauthn/link/community/<communityId>/did/<did>/user/<userId>/fidokey/<fidoKeyHash>", {
method: "PUT",
headers: {
"licensekey": "YOUR_LICENSE_KEY",
"publicKey": "YOUR_PUBLIC_KEY",
"privateKey": "YOUR_PRIVATE_KEY"
}
});
const data = await res.json();import requests
res = requests.put(
"/webauthn/link/community/<communityId>/did/<did>/user/<userId>/fidokey/<fidoKeyHash>",
headers={
"licensekey": "YOUR_LICENSE_KEY",
"publicKey": "YOUR_PUBLIC_KEY",
"privateKey": "YOUR_PRIVATE_KEY"
}
)
print(res.json())RESPONSE
400
200
Bad Request
OK
// no response body
{
"status": "string",
"errorMessage": "string"
}DELETE/unregister/community/{communityId}/did_or_fidokey/{identifier}
/unregister/community/{communityId}/did_or_fidokey/{identifier}
Path parameters
| Name | Type | Description |
|---|---|---|
| communityIdrequired | string | — |
| identifierrequired | string | — |
DELETE/webauthn/unregister/community/{communityId}/did_or_fidokey/{identifier}
cURL
Node.js
Python
curl -X DELETE '/webauthn/unregister/community/<communityId>/did_or_fidokey/<identifier>' \ -H 'licensekey: YOUR_LICENSE_KEY' \ -H 'publicKey: YOUR_PUBLIC_KEY' \ -H 'privateKey: YOUR_PRIVATE_KEY'
const res = await fetch("/webauthn/unregister/community/<communityId>/did_or_fidokey/<identifier>", {
method: "DELETE",
headers: {
"licensekey": "YOUR_LICENSE_KEY",
"publicKey": "YOUR_PUBLIC_KEY",
"privateKey": "YOUR_PRIVATE_KEY"
}
});
const data = await res.json();import requests
res = requests.delete(
"/webauthn/unregister/community/<communityId>/did_or_fidokey/<identifier>",
headers={
"licensekey": "YOUR_LICENSE_KEY",
"publicKey": "YOUR_PUBLIC_KEY",
"privateKey": "YOUR_PRIVATE_KEY"
}
)
print(res.json())RESPONSE
400
200
Bad Request
OK
// no response body
{}DELETE/unregister/community/{communityId}/user/{userId}/did_or_fidokey/{identifier}
/unregister/community/{communityId}/user/{userId}/did_or_fidokey/{identifier}
Path parameters
| Name | Type | Description |
|---|---|---|
| communityIdrequired | string | — |
| userIdrequired | string | — |
| identifierrequired | string | — |
DELETE/webauthn/unregister/community/{communityId}/user/{userId}/did_or_fidokey/{identifier}
cURL
Node.js
Python
curl -X DELETE '/webauthn/unregister/community/<communityId>/user/<userId>/did_or_fidokey/<identifier>' \ -H 'licensekey: YOUR_LICENSE_KEY' \ -H 'publicKey: YOUR_PUBLIC_KEY' \ -H 'privateKey: YOUR_PRIVATE_KEY'
const res = await fetch("/webauthn/unregister/community/<communityId>/user/<userId>/did_or_fidokey/<identifier>", {
method: "DELETE",
headers: {
"licensekey": "YOUR_LICENSE_KEY",
"publicKey": "YOUR_PUBLIC_KEY",
"privateKey": "YOUR_PRIVATE_KEY"
}
});
const data = await res.json();import requests
res = requests.delete(
"/webauthn/unregister/community/<communityId>/user/<userId>/did_or_fidokey/<identifier>",
headers={
"licensekey": "YOUR_LICENSE_KEY",
"publicKey": "YOUR_PUBLIC_KEY",
"privateKey": "YOUR_PRIVATE_KEY"
}
)
print(res.json())RESPONSE
400
200
Bad Request
OK
// no response body
{}WebAuthn
Vendor Meta Data
Vendor Meta Data endpoints.
POST/vendormetadata/{communityId}/fetch
Fetch vendor metadata records that match communityId (Note: load all records matching special communityId 'any' need system or service license)
Path parameters
| Name | Type | Description |
|---|---|---|
| communityIdrequired | string | — |
Headers
| Name | Type | Description |
|---|---|---|
| licensekeyrequired | string | — |
Request body
If aaguids is not given or empty, the fetch all records.
| Field | Type | Description |
|---|---|---|
| aaguids | array<string> | — |
POST/webauthn/vendormetadata/{communityId}/fetch
cURL
Node.js
Python
curl -X POST '/webauthn/vendormetadata/<communityId>/fetch' \
-H 'licensekey: YOUR_LICENSE_KEY' \
-H 'Content-Type: application/json' \
-d '{"aaguids": ["string"]}'const res = await fetch("/webauthn/vendormetadata/<communityId>/fetch", {
method: "POST",
headers: {
"licensekey": "YOUR_LICENSE_KEY",
"Content-Type": "application/json"
},
body: JSON.stringify({
"aaguids": [
"string"
]
})
});
const data = await res.json();import requests
res = requests.post(
"/webauthn/vendormetadata/<communityId>/fetch",
headers={
"licensekey": "YOUR_LICENSE_KEY"
},
json={
"aaguids": [
"string"
]
},
)
print(res.json())RESPONSE
400
200
Bad Request
success
// no response body
[
{
"id": "string",
"aaguid": "string",
"communityId": "string",
"metadata": "string",
"name": "string",
"disabled": true,
"updatedBy": "string",
"updatedAt": "string"
}
]PUT/vendormetadata/{communityId}
Create vendor metadata record)
Path parameters
| Name | Type | Description |
|---|---|---|
| communityIdrequired | string | — |
Headers
| Name | Type | Description |
|---|---|---|
| licensekeyrequired | string | — |
Request body
Create vendor metadata record
| Field | Type | Description |
|---|---|---|
| aaguidrequired | string | — |
| metadatarequired | string | — |
| namerequired | string | — |
| disabled | boolean | — |
| updatedByrequired | string | — |
PUT/webauthn/vendormetadata/{communityId}
cURL
Node.js
Python
curl -X PUT '/webauthn/vendormetadata/<communityId>' \
-H 'licensekey: YOUR_LICENSE_KEY' \
-H 'Content-Type: application/json' \
-d '{"aaguid": "string", "metadata": "string", "name": "string", "disabled": true, "updatedBy": "string"}'const res = await fetch("/webauthn/vendormetadata/<communityId>", {
method: "PUT",
headers: {
"licensekey": "YOUR_LICENSE_KEY",
"Content-Type": "application/json"
},
body: JSON.stringify({
"aaguid": "string",
"metadata": "string",
"name": "string",
"disabled": true,
"updatedBy": "string"
})
});
const data = await res.json();import requests
res = requests.put(
"/webauthn/vendormetadata/<communityId>",
headers={
"licensekey": "YOUR_LICENSE_KEY"
},
json={
"aaguid": "string",
"metadata": "string",
"name": "string",
"disabled": true,
"updatedBy": "string"
},
)
print(res.json())RESPONSE
400
200
Bad Request
success or error
// no response body
{
"aaguid": "string",
"id": "string",
"status": "string",
"errorMessage": "string"
}PATCH/vendormetadata/{communityId}/aaguid/{aaguid}
Update vendor metadata record)
Path parameters
| Name | Type | Description |
|---|---|---|
| communityIdrequired | string | — |
| aaguidrequired | string | — |
Headers
| Name | Type | Description |
|---|---|---|
| licensekeyrequired | string | — |
Request body
Update vendor metadata record
| Field | Type | Description |
|---|---|---|
| metadata | string | — |
| name | string | — |
| disabled | boolean | — |
| updatedByrequired | string | — |
PATCH/webauthn/vendormetadata/{communityId}/aaguid/{aaguid}
cURL
Node.js
Python
curl -X PATCH '/webauthn/vendormetadata/<communityId>/aaguid/<aaguid>' \
-H 'licensekey: YOUR_LICENSE_KEY' \
-H 'Content-Type: application/json' \
-d '{"metadata": "string", "name": "string", "disabled": true, "updatedBy": "string"}'const res = await fetch("/webauthn/vendormetadata/<communityId>/aaguid/<aaguid>", {
method: "PATCH",
headers: {
"licensekey": "YOUR_LICENSE_KEY",
"Content-Type": "application/json"
},
body: JSON.stringify({
"metadata": "string",
"name": "string",
"disabled": true,
"updatedBy": "string"
})
});
const data = await res.json();import requests
res = requests.patch(
"/webauthn/vendormetadata/<communityId>/aaguid/<aaguid>",
headers={
"licensekey": "YOUR_LICENSE_KEY"
},
json={
"metadata": "string",
"name": "string",
"disabled": true,
"updatedBy": "string"
},
)
print(res.json())RESPONSE
400
200
Bad Request
success or error
// no response body
{
"status": "string",
"errorMessage": "string"
}WebAuthn
Fido Auth N Authenticator
Fido Auth N Authenticator endpoints.
POST/assertion/options
/assertion/options
Request Body
Please add ECDSA encrypted string of below json in request
{
"dns": string
"username": string
"displayName": string
"communityId": string
"tenantId": string
}
Request body
| Field | Type | Description |
|---|---|---|
| data | string | — |
POST/webauthn/assertion/options
cURL
Node.js
Python
curl -X POST '/webauthn/assertion/options' \
-H 'licensekey: YOUR_LICENSE_KEY' \
-H 'publicKey: YOUR_PUBLIC_KEY' \
-H 'privateKey: YOUR_PRIVATE_KEY' \
-H 'Content-Type: application/json' \
-d '{"data": "string"}'const res = await fetch("/webauthn/assertion/options", {
method: "POST",
headers: {
"licensekey": "YOUR_LICENSE_KEY",
"publicKey": "YOUR_PUBLIC_KEY",
"privateKey": "YOUR_PRIVATE_KEY",
"Content-Type": "application/json"
},
body: JSON.stringify({
"data": "string"
})
});
const data = await res.json();import requests
res = requests.post(
"/webauthn/assertion/options",
headers={
"licensekey": "YOUR_LICENSE_KEY",
"publicKey": "YOUR_PUBLIC_KEY",
"privateKey": "YOUR_PRIVATE_KEY"
},
json={
"data": "string"
},
)
print(res.json())RESPONSE
400
200
Bad Request
OK
// no response body
{
"challenge": "string",
"rpId": "string",
"timeout": 0,
"userVerification": "string",
"allowCredentials": [
{
"type": "string",
"transports": [
"string"
],
"id": "string"
}
],
"status": "string",
"errorMessage": "string"
}POST/assertion/result
/assertion/result
Request Body
Please add ECDSA encrypted string of below json in request
{
"rawId": string
"getClientExtensionResults": {}
"id": string
"type": string
"dns": string
"communityId": string
"tenantId": string
"response": {
"authenticatorData": {}
"signature": {}
"userHandle": {}
"clientDataJSON": {}
}
}
Request body
| Field | Type | Description |
|---|---|---|
| data | string | — |
POST/webauthn/assertion/result
cURL
Node.js
Python
curl -X POST '/webauthn/assertion/result' \
-H 'licensekey: YOUR_LICENSE_KEY' \
-H 'publicKey: YOUR_PUBLIC_KEY' \
-H 'privateKey: YOUR_PRIVATE_KEY' \
-H 'Content-Type: application/json' \
-d '{"data": "string"}'const res = await fetch("/webauthn/assertion/result", {
method: "POST",
headers: {
"licensekey": "YOUR_LICENSE_KEY",
"publicKey": "YOUR_PUBLIC_KEY",
"privateKey": "YOUR_PRIVATE_KEY",
"Content-Type": "application/json"
},
body: JSON.stringify({
"data": "string"
})
});
const data = await res.json();import requests
res = requests.post(
"/webauthn/assertion/result",
headers={
"licensekey": "YOUR_LICENSE_KEY",
"publicKey": "YOUR_PUBLIC_KEY",
"privateKey": "YOUR_PRIVATE_KEY"
},
json={
"data": "string"
},
)
print(res.json())RESPONSE
400
200
Bad Request
OK
// no response body
{
"data": {
"sub": "string"
},
"status": "string",
"signature_token": "string"
}WebAuthn
Fido Registration
Fido Registration endpoints.
POST/attestation/options
/attestation/options
Request Body
Please add ECDSA encrypted string of below json in request
{
"dns": string
"username": string
"displayName": string
"communityId": string
"tenantId": string
"attestation": string
}
Request body
| Field | Type | Description |
|---|---|---|
| data | string | — |
POST/webauthn/attestation/options
cURL
Node.js
Python
curl -X POST '/webauthn/attestation/options' \
-H 'licensekey: YOUR_LICENSE_KEY' \
-H 'publicKey: YOUR_PUBLIC_KEY' \
-H 'privateKey: YOUR_PRIVATE_KEY' \
-H 'Content-Type: application/json' \
-d '{"data": "string"}'const res = await fetch("/webauthn/attestation/options", {
method: "POST",
headers: {
"licensekey": "YOUR_LICENSE_KEY",
"publicKey": "YOUR_PUBLIC_KEY",
"privateKey": "YOUR_PRIVATE_KEY",
"Content-Type": "application/json"
},
body: JSON.stringify({
"data": "string"
})
});
const data = await res.json();import requests
res = requests.post(
"/webauthn/attestation/options",
headers={
"licensekey": "YOUR_LICENSE_KEY",
"publicKey": "YOUR_PUBLIC_KEY",
"privateKey": "YOUR_PRIVATE_KEY"
},
json={
"data": "string"
},
)
print(res.json())RESPONSE
400
200
Bad Request
OK
// no response body
{
"data": {
"rp": {
"name": "string",
"id": "string"
},
"user": {
"id": "string",
"name": "string",
"displayName": "string"
},
"attestation": "string",
"pubKeyCredParams": [
{
"type": "string",
"alg": 0
}
],
"timeout": 0,
"authenticatorSelection": {
"userVerification": "string",
"requireResidentKey": true
},
"challenge": "string",
"excludeCredentials": [
{
"type": "string",
"id": "string"
}
],
"status": "string",
"errorMessage": "string"
},
"publickey": "string"
}POST/attestation/result
/attestation/result
Request Body
Please add ECDSA encrypted string of below json in request
{
"rawId": string
"authenticatorAttachment": string
"getClientExtensionResults": {}
"id": string
"type": string
"dns": string
"communityId": string
"tenantId": string
"response": {
"getAuthenticatorData": {}
"getPublicKey": {}
"getPublicKeyAlgorithm": {}
"getTransports": {}
"clientDataJSON": string
}
}
Request body
| Field | Type | Description |
|---|---|---|
| data | string | — |
POST/webauthn/attestation/result
cURL
Node.js
Python
curl -X POST '/webauthn/attestation/result' \
-H 'licensekey: YOUR_LICENSE_KEY' \
-H 'publicKey: YOUR_PUBLIC_KEY' \
-H 'privateKey: YOUR_PRIVATE_KEY' \
-H 'Content-Type: application/json' \
-d '{"data": "string"}'const res = await fetch("/webauthn/attestation/result", {
method: "POST",
headers: {
"licensekey": "YOUR_LICENSE_KEY",
"publicKey": "YOUR_PUBLIC_KEY",
"privateKey": "YOUR_PRIVATE_KEY",
"Content-Type": "application/json"
},
body: JSON.stringify({
"data": "string"
})
});
const data = await res.json();import requests
res = requests.post(
"/webauthn/attestation/result",
headers={
"licensekey": "YOUR_LICENSE_KEY",
"publicKey": "YOUR_PUBLIC_KEY",
"privateKey": "YOUR_PRIVATE_KEY"
},
json={
"data": "string"
},
)
print(res.json())RESPONSE
400
200
201
Bad Request
OK
Created
// no response body
{
"data": {
"sub": "string"
},
"publicKey": "string"
}{}WebAuthn
U 1 Fido Auth N Authenticator
U 1 Fido Auth N Authenticator endpoints.
POST/u1/assertion/options
/u1/assertion/options
Header parameter can be passed without ecdsa encryption
Headers
| Name | Type | Description |
|---|---|---|
| licensekeyrequired | string | — |
Request body
| Field | Type | Description |
|---|---|---|
| username | string | — |
| displayName | string | — |
| dns | string | — |
| communityId | string | — |
| tenantId | string | — |
| dguid | string | — |
POST/webauthn/u1/assertion/options
cURL
Node.js
Python
curl -X POST '/webauthn/u1/assertion/options' \
-H 'licensekey: YOUR_LICENSE_KEY' \
-H 'Content-Type: application/json' \
-d '{"username": "string", "displayName": "string", "dns": "string", "communityId": "string", "tenantId": "string", "dguid": "string"}'const res = await fetch("/webauthn/u1/assertion/options", {
method: "POST",
headers: {
"licensekey": "YOUR_LICENSE_KEY",
"Content-Type": "application/json"
},
body: JSON.stringify({
"username": "string",
"displayName": "string",
"dns": "string",
"communityId": "string",
"tenantId": "string",
"dguid": "string"
})
});
const data = await res.json();import requests
res = requests.post(
"/webauthn/u1/assertion/options",
headers={
"licensekey": "YOUR_LICENSE_KEY"
},
json={
"username": "string",
"displayName": "string",
"dns": "string",
"communityId": "string",
"tenantId": "string",
"dguid": "string"
},
)
print(res.json())RESPONSE
400
200
Bad Request
OK
// no response body
{
"challenge": "string",
"rpId": "string",
"timeout": 0,
"userVerification": "string",
"allowCredentials": [
{
"type": "string",
"transports": [
"string"
],
"id": "string"
}
],
"status": "string",
"errorMessage": "string"
}POST/u1/assertion/result
/u1/assertion/result
Header parameter can be passed without ecdsa encryption
Headers
| Name | Type | Description |
|---|---|---|
| sessionInforequired | string | — |
| licensekeyrequired | string | — |
Request body
| Field | Type | Description |
|---|---|---|
| rawId | string | — |
| response | object | — |
| getClientExtensionResults | object | — |
| id | string | — |
| type | string | — |
| tenantId | string | — |
| communityId | string | — |
| dns | string | — |
POST/webauthn/u1/assertion/result
cURL
Node.js
Python
curl -X POST '/webauthn/u1/assertion/result' \
-H 'sessionInfo: <value>' \
-H 'licensekey: YOUR_LICENSE_KEY' \
-H 'Content-Type: application/json' \
-d '{"rawId": "string", "response": {"authenticatorData": "string", "signature": "string", "userHandle": "string", "clientDataJSON": "string"}, "getClientExtensionResults": {}, "id": "string", "type": "string", "tenantId": "string", "communityId": "string", "dns": "string"}'const res = await fetch("/webauthn/u1/assertion/result", {
method: "POST",
headers: {
"sessionInfo": "<value>",
"licensekey": "YOUR_LICENSE_KEY",
"Content-Type": "application/json"
},
body: JSON.stringify({
"rawId": "string",
"response": {
"authenticatorData": "string",
"signature": "string",
"userHandle": "string",
"clientDataJSON": "string"
},
"getClientExtensionResults": {},
"id": "string",
"type": "string",
"tenantId": "string",
"communityId": "string",
"dns": "string"
})
});
const data = await res.json();import requests
res = requests.post(
"/webauthn/u1/assertion/result",
headers={
"sessionInfo": "<value>",
"licensekey": "YOUR_LICENSE_KEY"
},
json={
"rawId": "string",
"response": {
"authenticatorData": "string",
"signature": "string",
"userHandle": "string",
"clientDataJSON": "string"
},
"getClientExtensionResults": {},
"id": "string",
"type": "string",
"tenantId": "string",
"communityId": "string",
"dns": "string"
},
)
print(res.json())RESPONSE
400
200
Bad Request
OK
// no response body
{
"data": {
"sub": "string"
},
"status": "string",
"signature_token": "string"
}WebAuthn
U 1 Fido Registration
U 1 Fido Registration endpoints.
POST/u1/attestation/options
/u1/attestation/options
Header parameter can be passed without ecdsa encryption
Headers
| Name | Type | Description |
|---|---|---|
| licensekeyrequired | string | — |
Request body
| Field | Type | Description |
|---|---|---|
| dns | string | — |
| username | string | — |
| displayName | string | — |
| communityId | string | — |
| tenantId | string | — |
| attestation | string | — |
POST/webauthn/u1/attestation/options
cURL
Node.js
Python
curl -X POST '/webauthn/u1/attestation/options' \
-H 'licensekey: YOUR_LICENSE_KEY' \
-H 'Content-Type: application/json' \
-d '{"dns": "string", "username": "string", "displayName": "string", "communityId": "string", "tenantId": "string", "attestation": "string"}'const res = await fetch("/webauthn/u1/attestation/options", {
method: "POST",
headers: {
"licensekey": "YOUR_LICENSE_KEY",
"Content-Type": "application/json"
},
body: JSON.stringify({
"dns": "string",
"username": "string",
"displayName": "string",
"communityId": "string",
"tenantId": "string",
"attestation": "string"
})
});
const data = await res.json();import requests
res = requests.post(
"/webauthn/u1/attestation/options",
headers={
"licensekey": "YOUR_LICENSE_KEY"
},
json={
"dns": "string",
"username": "string",
"displayName": "string",
"communityId": "string",
"tenantId": "string",
"attestation": "string"
},
)
print(res.json())RESPONSE
400
200
Bad Request
OK
// no response body
{
"data": {
"rp": {
"name": "string",
"id": "string"
},
"user": {
"id": "string",
"name": "string",
"displayName": "string"
},
"attestation": "string",
"pubKeyCredParams": [
{
"type": "string",
"alg": 0
}
],
"timeout": 0,
"authenticatorSelection": {
"userVerification": "string",
"requireResidentKey": true
},
"challenge": "string",
"excludeCredentials": [
{
"type": "string",
"id": "string"
}
],
"status": "string",
"errorMessage": "string"
},
"publickey": "string"
}POST/u1/attestation/result
/u1/attestation/result
Header parameter can be passed without ecdsa encryption
Headers
| Name | Type | Description |
|---|---|---|
| sessionInforequired | string | — |
| licensekeyrequired | string | — |
Request body
| Field | Type | Description |
|---|---|---|
| rawId | string | — |
| response | object | — |
| authenticatorAttachment | string | — |
| getClientExtensionResults | object | — |
| id | string | — |
| type | string | — |
| dns | string | — |
| communityId | string | — |
| tenantId | string | — |
POST/webauthn/u1/attestation/result
cURL
Node.js
Python
curl -X POST '/webauthn/u1/attestation/result' \
-H 'sessionInfo: <value>' \
-H 'licensekey: YOUR_LICENSE_KEY' \
-H 'Content-Type: application/json' \
-d '{"rawId": "string", "response": {"attestationObject": "string", "getAuthenticatorData": {}, "getPublicKey": {}, "getPublicKeyAlgorithm": {}, "getTransports": {}, "clientDataJSON": "string"}, "authenticatorAttachment": "string", "getClientExtensionResults": {}, "id": "string", "type": "string", "dns": "string", "communityId": "string", "tenantId": "string"}'const res = await fetch("/webauthn/u1/attestation/result", {
method: "POST",
headers: {
"sessionInfo": "<value>",
"licensekey": "YOUR_LICENSE_KEY",
"Content-Type": "application/json"
},
body: JSON.stringify({
"rawId": "string",
"response": {
"attestationObject": "string",
"getAuthenticatorData": {},
"getPublicKey": {},
"getPublicKeyAlgorithm": {},
"getTransports": {},
"clientDataJSON": "string"
},
"authenticatorAttachment": "string",
"getClientExtensionResults": {},
"id": "string",
"type": "string",
"dns": "string",
"communityId": "string",
"tenantId": "string"
})
});
const data = await res.json();import requests
res = requests.post(
"/webauthn/u1/attestation/result",
headers={
"sessionInfo": "<value>",
"licensekey": "YOUR_LICENSE_KEY"
},
json={
"rawId": "string",
"response": {
"attestationObject": "string",
"getAuthenticatorData": {},
"getPublicKey": {},
"getPublicKeyAlgorithm": {},
"getTransports": {},
"clientDataJSON": "string"
},
"authenticatorAttachment": "string",
"getClientExtensionResults": {},
"id": "string",
"type": "string",
"dns": "string",
"communityId": "string",
"tenantId": "string"
},
)
print(res.json())RESPONSE
400
200
201
Bad Request
OK
Created
// no response body
{
"data": {
"sub": "string"
},
"publicKey": "string"
}{}WebAuthn
U 1 Web Auth N Linking
U 1 Web Auth N Linking endpoints.
GET/u1/link/community/{communityId}/user/{userId}/status
/u1/link/community/{communityId}/user/{userId}/status
Path parameters
| Name | Type | Description |
|---|---|---|
| communityIdrequired | string | — |
| userIdrequired | string | — |
GET/webauthn/u1/link/community/{communityId}/user/{userId}/status
cURL
Node.js
Python
curl -X GET '/webauthn/u1/link/community/<communityId>/user/<userId>/status' \ -H 'privateKey: YOUR_PRIVATE_KEY' \ -H 'publicKey: YOUR_PUBLIC_KEY' \ -H 'licensekey: YOUR_LICENSE_KEY'
const res = await fetch("/webauthn/u1/link/community/<communityId>/user/<userId>/status", {
method: "GET",
headers: {
"privateKey": "YOUR_PRIVATE_KEY",
"publicKey": "YOUR_PUBLIC_KEY",
"licensekey": "YOUR_LICENSE_KEY"
}
});
const data = await res.json();import requests
res = requests.get(
"/webauthn/u1/link/community/<communityId>/user/<userId>/status",
headers={
"privateKey": "YOUR_PRIVATE_KEY",
"publicKey": "YOUR_PUBLIC_KEY",
"licensekey": "YOUR_LICENSE_KEY"
}
)
print(res.json())RESPONSE
400
200
Bad Request
OK
// no response body
{}PUT/u1/link/community/{communityId}/did/{did}/user/{userId}/fidokey/{fidoKeyHash}
/u1/link/community/{communityId}/did/{did}/user/{userId}/fidokey/{fidoKeyHash}
Header parameter can be passed without ecdsa encryption
Path parameters
| Name | Type | Description |
|---|---|---|
| communityIdrequired | string | — |
| didrequired | string | — |
| userIdrequired | string | — |
| fidoKeyHashrequired | string | — |
Headers
| Name | Type | Description |
|---|---|---|
| licensekeyrequired | string | — |
PUT/webauthn/u1/link/community/{communityId}/did/{did}/user/{userId}/fidokey/{fidoKeyHash}
cURL
Node.js
Python
curl -X PUT '/webauthn/u1/link/community/<communityId>/did/<did>/user/<userId>/fidokey/<fidoKeyHash>' \ -H 'licensekey: YOUR_LICENSE_KEY'
const res = await fetch("/webauthn/u1/link/community/<communityId>/did/<did>/user/<userId>/fidokey/<fidoKeyHash>", {
method: "PUT",
headers: {
"licensekey": "YOUR_LICENSE_KEY"
}
});
const data = await res.json();import requests
res = requests.put(
"/webauthn/u1/link/community/<communityId>/did/<did>/user/<userId>/fidokey/<fidoKeyHash>",
headers={
"licensekey": "YOUR_LICENSE_KEY"
}
)
print(res.json())RESPONSE
400
200
Bad Request
OK
// no response body
{
"status": "string",
"errorMessage": "string"
}WebAuthn
Environment
Environment endpoints.
GET/environment
Fetch Environment
Headers
| Name | Type | Description |
|---|---|---|
| licensekey | string | — |
GET/webauthn/environment
cURL
Node.js
Python
curl -X GET '/webauthn/environment' \ -H 'licensekey: YOUR_LICENSE_KEY'
const res = await fetch("/webauthn/environment", {
method: "GET",
headers: {
"licensekey": "YOUR_LICENSE_KEY"
}
});
const data = await res.json();import requests
res = requests.get(
"/webauthn/environment",
headers={
"licensekey": "YOUR_LICENSE_KEY"
}
)
print(res.json())RESPONSE
400
200
Bad Request
success
// no response body
{
"sessionMaxAgeMinute": 0,
"appSessionIdleTimeout": 0,
"instanceType": "string",
"allowed_time_span": 0,
"samlNotOrAfterSkewMinutes": 0,
"jwtExpirationInMs": 0,
"wxMaxBuffer": 0,
"ec_curve_name": "string",
"env": {
"direct": {},
"application": {},
"system": {},
"os": {}
}
}WebAuthn
Healthz
Healthz endpoints.
GET/healthz
This is Health endpoint
GET/webauthn/healthz
cURL
Node.js
Python
curl -X GET '/webauthn/healthz' \ -H 'privateKey: YOUR_PRIVATE_KEY' \ -H 'publicKey: YOUR_PUBLIC_KEY' \ -H 'licensekey: YOUR_LICENSE_KEY'
const res = await fetch("/webauthn/healthz", {
method: "GET",
headers: {
"privateKey": "YOUR_PRIVATE_KEY",
"publicKey": "YOUR_PUBLIC_KEY",
"licensekey": "YOUR_LICENSE_KEY"
}
});
const data = await res.json();import requests
res = requests.get(
"/webauthn/healthz",
headers={
"privateKey": "YOUR_PRIVATE_KEY",
"publicKey": "YOUR_PUBLIC_KEY",
"licensekey": "YOUR_LICENSE_KEY"
}
)
print(res.json())RESPONSE
400
200
Bad Request
success
// no response body
{
"status": "string",
"code": "string",
"version": "string"
}WebAuthn
Public Key
Public Key endpoints.
GET/publickeys
/publickeys
GET/webauthn/publickeys
cURL
Node.js
Python
curl -X GET '/webauthn/publickeys' \ -H 'privateKey: YOUR_PRIVATE_KEY' \ -H 'publicKey: YOUR_PUBLIC_KEY' \ -H 'licensekey: YOUR_LICENSE_KEY'
const res = await fetch("/webauthn/publickeys", {
method: "GET",
headers: {
"privateKey": "YOUR_PRIVATE_KEY",
"publicKey": "YOUR_PUBLIC_KEY",
"licensekey": "YOUR_LICENSE_KEY"
}
});
const data = await res.json();import requests
res = requests.get(
"/webauthn/publickeys",
headers={
"privateKey": "YOUR_PRIVATE_KEY",
"publicKey": "YOUR_PUBLIC_KEY",
"licensekey": "YOUR_LICENSE_KEY"
}
)
print(res.json())RESPONSE
400
200
Bad Request
OK
// no response body
{
"publicKey": "string"
}WebAuthn
Service Directory
Service Directory endpoints.
GET/sd
Get all service directories.
Returns all service directories.
GET/webauthn/sd
cURL
Node.js
Python
curl -X GET '/webauthn/sd' \ -H 'privateKey: YOUR_PRIVATE_KEY' \ -H 'publicKey: YOUR_PUBLIC_KEY' \ -H 'licensekey: YOUR_LICENSE_KEY'
const res = await fetch("/webauthn/sd", {
method: "GET",
headers: {
"privateKey": "YOUR_PRIVATE_KEY",
"publicKey": "YOUR_PUBLIC_KEY",
"licensekey": "YOUR_LICENSE_KEY"
}
});
const data = await res.json();import requests
res = requests.get(
"/webauthn/sd",
headers={
"privateKey": "YOUR_PRIVATE_KEY",
"publicKey": "YOUR_PUBLIC_KEY",
"licensekey": "YOUR_LICENSE_KEY"
}
)
print(res.json())RESPONSE
400
200
Bad Request
OK
// no response body
{
"adminconsole": "string",
"sessions": "string",
"licenses": "string",
"global_caas": "string",
"user_management": "string",
"acr": "string",
"local_caas": "string"
}© 2026 1Kosmos · Web AuthN v1.0.0Generated from the OpenAPI spec · webauthn.json