1. Docs
  2. API Reference
  3. OAuth hosted login: verify a WebAuthn enrollment attestation

OAuth hosted login: verify a WebAuthn enrollment attestation

POST/oauth/mfa/webauthn/enroll/verify

Step 2 of hosted WebAuthn MFA enrollment: verifies the attestation and persists the factor. When this is the identity's first factor the freshly-minted recovery codes plus the OAuth-resume context are sealed and { redirect_to } points at the sealed-codes view so the codes can be shown; when a factor already exists it stamps the hosted session and mints the authorization code directly, returning { redirect_to }. Returns 400 with { error } on an invalid client or expired token. Throttled to 10 requests per minute.

Request body

application/json

enrollment_tokenstring Required
responseobject Required

The browser-produced RegistrationResponseJSON attestation.

labelstring Required

User-supplied device label.

client_idstring Required
redirect_uristring Required
response_typestring Required
scopestring Required
statestring Optional
code_challengestring Required
code_challenge_methodstring Required

Responses

200
Request
curl -X POST "https://auth.canopy-io.com/oauth/mfa/webauthn/enroll/verify" \
  -H "Content-Type: application/json" \
  -d '{
    "enrollment_token": "string",
    "response": {},
    "label": "string",
    "client_id": "string",
    "redirect_uri": "string",
    "response_type": "string",
    "scope": "string",
    "state": "string",
    "code_challenge": "string",
    "code_challenge_method": "string"
  }'
Response
HTTP/1.1 200

(empty body)
 Related endpoints Was this page helpful?

Tell us how we can improve this guide.

Canopy