1. Docs
  2. API Reference
  3. Begin WebAuthn factor enrollment

Begin WebAuthn factor enrollment

POST/v1/identity/auth/mfa/webauthn/enroll/options

Authentication

  • Bearer Token Authorization

    JWT access token

Code samples

cURLJavaScriptPythonGo
curl -X POST "https://api.canopy.dev/v1/identity/auth/mfa/webauthn/enroll/options" \
  -H "Authorization: Bearer $CANOPY_TOKEN"

Responses

200 Generates `PublicKeyCredentialCreationOptions` for `navigator.credentials.create()` and a sealed 5-min enrollment_token carrying the WebAuthn challenge nonce. Browser passes the options to the platform authenticator; the resulting attestation goes back to /verify.
{
  "enrollment_token": "string",
  "options": {}
}

application/json

  • enrollment_tokenstring*

    Opaque short-lived (5 min) sealed token carrying the WebAuthn challenge nonce. Must be returned to /mfa/webauthn/enroll/verify exactly.

  • optionsany object*

    `PublicKeyCredentialCreationOptions` JSON to pass to `navigator.credentials.create()`. Shape per the WebAuthn Level 2 spec; key fields: `rp`, `user`, `challenge`, `pubKeyCredParams`, `excludeCredentials`, `authenticatorSelection`.

401 Invalid or expired token
403 This token is not authorized for this endpoint (wrong principal type — e.g., admin token on identity-only endpoint, or vice versa)

Returned object

On this page

Related endpoints

GETList enrolled MFA factors for the caller
POSTBegin TOTP factor enrollment
POSTComplete TOTP factor enrollment
POSTComplete WebAuthn factor enrollment
POSTProve a fresh factor to authorise a sensitive MFA mutation
POSTBegin a WebAuthn-backed step-up ceremony
POSTComplete a WebAuthn step-up ceremony
DELETERemove an enrolled MFA factor
POSTRegenerate the identity's single-use recovery codes
GETList the identity's active 'remember this device' records
DELETERevoke every trusted device for the caller
DELETERevoke a single trusted device