Xeonr Developer Docs
API SpecificationPRIVATEAccounts

Complete Passkey Registration

POST
/xeonr.auth.private.v1.AccountService/PasskeyRegisterFinish

Verifies the attestation and stores the passkey for the authenticated user. Requires a recent login (step-up).

Required scopes: auth:account:edit

Authorization

BearerAuth
AuthorizationBearer <token>

JWT access token for internal API access. Requires 'private' scope for most endpoints, 'admin' scope for administrative operations.

In: header

Header Parameters

Connect-Protocol-Version*number

Define the version of the Connect protocol

Value in1
Connect-Timeout-Ms?number

Define the timeout, in ms

Request Body

application/json

credentialJson?string

The navigator.credentials.create() attestation, serialized as JSON.

Length1 <= length
sessionId?string

The session id from PasskeyRegisterBeginResponse.

Length1 <= length <= 255
displayName?string|null

Optional user-chosen label for the passkey.

Lengthlength <= 128
[key: string]?never

Response Body

application/json

application/json

curl -X POST "https://auth.xeonr.io/xeonr.auth.private.v1.AccountService/PasskeyRegisterFinish" \  -H "Connect-Protocol-Version: 1" \  -H "Content-Type: application/json" \  -d '{}'
{
  "credential": {
    "id": "string",
    "displayName": "string",
    "createdAt": "2023-01-15T01:30:15.01Z",
    "lastUsedAt": "2023-01-15T01:30:15.01Z"
  }
}
{
  "code": "not_found",
  "message": "string",
  "details": [
    {
      "type": "string",
      "value": "string",
      "debug": {}
    }
  ]
}

Begin Passkey Registration POST

Starts a WebAuthn registration: returns PublicKeyCredentialCreationOptions (resident-key required) plus a session id. Requires a recent login (step-up), like enabling 2FA. **Required scopes:** `auth:account:edit`

Regenerate MFA Recovery Codes POST

Generates a fresh set of one-time recovery codes, invalidating the old set. Requires a current TOTP or recovery code to prove possession of the second factor. **Required scopes:** `auth:account:edit`