1. Docs
  2. API Reference
  3. Begin a WebAuthn-backed step-up ceremony

Begin a WebAuthn-backed step-up ceremony

POST/v1/identity/auth/mfa/step-up/webauthn/options

Authentication

  • Bearer Token Authorization

    JWT access token

Code samples

cURLJavaScriptPythonGo
curl -X POST "https://api.canopy.dev/v1/identity/auth/mfa/step-up/webauthn/options" \
  -H "Authorization: Bearer $CANOPY_TOKEN"

Responses

200 Generates `PublicKeyCredentialRequestOptions` for the caller's enrolled WebAuthn factors plus a sealed 5-min `transit_token` carrying the cryptographic nonce. Browser passes the options to `navigator.credentials.get()`; the assertion goes back to /verify along with the transit_token.
{
  "transit_token": "string",
  "options": {}
}

application/json

  • transit_tokenstring*

    Sealed 5-min token carrying the WebAuthn nonce. Must be returned to /verify exactly.

  • optionsany object*

    `PublicKeyCredentialRequestOptions` for navigator.credentials.get(). Shape per the WebAuthn Level 2 spec.

401 Invalid or expired token
403 This token is not authorized for this endpoint (wrong principal type — e.g., admin token on identity-only endpoint, or vice versa)

Returned object

On this page

Related endpoints

GETList enrolled MFA factors for the caller
POSTBegin TOTP factor enrollment
POSTComplete TOTP factor enrollment
POSTBegin WebAuthn factor enrollment
POSTComplete WebAuthn factor enrollment
POSTProve a fresh factor to authorise a sensitive MFA mutation
POSTComplete a WebAuthn step-up ceremony
DELETERemove an enrolled MFA factor
POSTRegenerate the identity's single-use recovery codes
GETList the identity's active 'remember this device' records
DELETERevoke every trusted device for the caller
DELETERevoke a single trusted device