FIDO2 Server Operations
Attestation (Registration)
Attestation Options
Description
Endpoint to initiate a registration operation.
Endpoint
| POST | /attestation/options |
JSON Parameters
| Type | Required/Optional |
| ServerPublicKeyCredentialCreationOptionsRequest | required |
Response
| Type | Required/Optional |
| ServerPublicKeyCredentialCreationOptionsResponse | required |
Example Request
POST /attestation/options
{ "username": "johndoe@example.com", "displayName": "John Doe", "authenticatorSelection": { "requireResidentKey": false, "authenticatorAttachment": "cross-platform", "userVerification": "preferred" }, "attestation": "direct" } |
Example Response
{ "status": "ok", "errorMessage": "", "rp": { "name": "Example Corporation" }, "user": { "id": "S3932ee3C0JtMIQ", "name": "johndoe@example.com", "displayName": "John Doe" }, "challenge": "uhUjPNlZuhNdsLPkkE5Fv-lUN", "pubKeyCredParams": [ { "type": "public-key", "alg": -7 } ], "timeout": 10000, "excludeCredentials": [ { "type": "public-key", "id": "opQf1maupUKJIQp" } ], "authenticatorSelection": { "requireResidentKey": false, "authenticatorAttachment": "cross-platform", "userVerification": "preferred" }, "attestation": "direct" } |
Attestation Result
Description
Endpoint to complete a registration operation.
Endpoint
| POST | /attestation/result |
JSON Parameters
| Type | Required/Optional |
| ServerPublicKeyCredential | required |
ServerPublicKeyCredential’s “response” field must be a ServerAuthenticatorAttestationResponse.
Response
| Type | Required/Optional |
| ServerResponse | required |
Example Request
POST /attestation/result
{ "id": "LFdoCFJTyB82ZzSJUHc-c72yraRc_1E8su39xXAWgWl6itMKqmDvruha6ywA", "rawId": "LFdoCFJTyB82ZzSJUHc-c72yraRc_1mPvGX8ToE8su39xX26JcAWgWl6itMKqmDvruha6ywA", "response": { "clientDataJSON": "eyJjaGFsbGVuZ2UiOiJOeHlab32Iiwib3JpZ2luIjoiL2xvY2FsaG9zdDozMDAwIiwidHlwZSI6IndlYmF1dGhuLmNyZWF0ZSJ9", "attestationObject": "o2NmbXRoZmlkby11MmZnYXR0U3RtdKJjc2lnWEcwRQIgVzzvX3Nyp_g9j9f2B-tPWy6puW01aZHI8RXjwqfDjtQCIQDLsdniGPO9iKr7tdgVV-FnBYhvzlZLG3u28rVt10YXfGN4NWOBWQJOMIICSjCCATKgAwIBAgIEVxb3wDANBgkqhkiG9w0BAQsFADAuMSwwKgYDVQQDEyNZdWJpY28gVTJpYqG4A579f3YAjfrPbgj404xJns0mqx5wkpxKlnoBKqo1rqSUmonencd4xanO_PHEfxU0iZif615X5lc87qDHZdjQQAAAAAAAAAAAAAAAAAAAAAAAAAAAEAsV2gIUlPIHzZnNIlQdz5zvbKtpFz_WY-8ZfxOgTyy7f3Ffbolyp3fUtSQo5LfoUgBaBaXqK0wqqYO-u6FrrLApQECAyYgASFYIPr9-YH8DuBsOnaI3KJa0a39hyxh9LDtHErNvfQSyxQsIlgg4rAuQQ5uy4VXGFbkiAt0uwgJJodp-DymkoBcrGsLtkI" }, "type": "public-key" } |
Example Response
{ "status": "ok", "errorMessage": "" } |
Assertion (Authentication)
Assertion Options
Description
Endpoint to initiate an authentication operation.
Endpoint
| POST | /assertion/options |
JSON Parameters
| Type | Required/Optional |
| ServerPublicKeyCredentialGetOptionsRequest | required |
Response
| Type | Required/Optional |
| ServerPublicKeyCredentialGetOptionsResponse | required |
Example Request
POST /assertion/options
{ "username": "johndoe@example.com", "userVerification": "required" } |
Example Response
{ "status": "ok", "errorMessage": "", "challenge": "6283u0svQHStwkJCaLKx", "timeout": 20000, "rpId": "https://example.com", "allowCredentials": [ { "id": "m7xlAuwcj4m", "type": "public-key" } ], "userVerification": "required" } |
Assertion Result
Description
Endpoint to complete an authentication operation.
Endpoint
| POST | /assertion/result |
JSON Parameters
| Type | Required/Optional |
| ServerPublicKeyCredential | required |
ServerPublicKeyCredential’s “response” field must be a ServerAuthenticatorAssertionResponse.
Response
| Type | Required/Optional |
| ServerResponse | required |
Example Request
POST /assertion/result
{ "id":"LFdoCFJTyB82ZzSJUHc-c72yraRc_1mPvGX8ToE8su3l6itMKqmDvruha6ywA", "rawId":"LFdoCFJTyB82Z2yraRc_1mPvGX8ToE8su39xX26FIAWgWl6itMKqmDvruha6ywA", "response": { "authenticatorData":"SZYN5YgOjGLHmVzzuoMdl2MBAAAAAA", "signature":"MEYC9DQIhANiYig9newAJZYTzG1i5lwP-YQk9uXFnnDaHnr2yCKXL", "userHandle":"", "clientDataJSON":"eyJjaGFsbGVuZImhhc2hB2Iiwib3JpZ2luIjoiaHR0cDovL2xvY2FsaG9zdDozMDAwIiwidHlwZSI6IndlYmF1dGhuLmdldCJ9" }, "type":"public-key" } |
Example Response
{ "status": "ok", "errorMessage": "" } |
WebAuthn Operations
Create Credential (Registration)
Description
API to perform user registration.
Javascript API
| navigator.credentials.create() |
Parameters
| Type | Required/Optional |
| CredentialCreationOptions | required |
Response
| Type | Required/Optional |
| PublicKeyCredential | required |
PublicKeyCredential’s “response” will be a AuthenticatorAttestationResponse.
Example Request
navigator.credentials.create({ publicKey: { challenge: new Uint8Array([21,31,105, ...]), rp: { name: "ACME Corporation" }, user: { id: Uint8Array.from(window.atob("MIIBkZMwggE4oAMCAQgGTMII="), c=>c.charCodeAt(0)), name: "alex.p.mueller@example.com", displayName: "Alex P. Müller", icon: "https://pics.example.com/00/p/aBjjjpqPb.png" }, pubKeyCredParams: [ { type: "public-key", alg: -7 }, { type: "public-key", alg: -257 } ], timeout: 60000, excludeCredentials: [], extensions: { "loc": true } } }); |
Example Response
{ rawId: “QXLsNzPhaR2aRI_-ze8IK6ru_An8gIAaZ2RMFNLNTxLd6TbMJELtEBNbR3pghe3A”, id: Int8Array([65, 114, -20, 55, 49, ...], response: { attestationObject: Int8Array[-93, 99, 102, 109, ...], clientDataJson: Int8Array[123, 34, 99, 104, 97, ....] }, type: “public-key” } |
Get Credential (Authentication)
Description
API to perform user authentication.
Javascript API
| navigator.credentials.get() |
Parameters
| Type | Required/Optional |
| CredentialRequestOptions | required |
Response
| Type | Required/Optional |
| PublicKeyCredential | required |
PublicKeyCredential’s “response” will be a AuthenticatorAssertionResponse.
Example Request
navigator.credentials.get({ publicKey: { challenge: new Uint8Array([4,101,15, ...]), timeout: 60000, allowCredentials: [ { type: “public-key”, id: new Uint8Array([183, 148, 245, …]) } ], } }); |
Example Response
{ rawId: “_08FiVZ0EZqUUfZTf1F7R18I9xXSml3TAOIpsWw-SAt-g1lc8FCYVR_hgtWC”, id: Int8Array([170, 197, 31, ...], response: { authenticatorData: Int8Array[66, 107, 61, ...], signature: Int8Array[91, 183, 120, ...], userHandle: Int8Array[97, 75, 20, ...], clientDataJson: Int8Array[191, 4, 22, ...] }, type: “public-key” } |
Models reference
AttestationConveyancePreference
| Type | Required/Optional | Values |
| enum | required | none indirect |
AuthenticationExtensionsClientInputs
| Type | Required/Optional | Name |
| string | optional | appId |
| string | optional | txAuthSimple |
| TxAuthGenericArg | optional | txAuthGeneric |
| AuthenticatorSelectionList | optional | authnSel |
| boolean | optional | exts |
| boolean | optional | uvi |
| boolean | optional | loc |
| boolean | optional | uvm |
AuthenticationExtensionsClientOutputs
| Type | Required/Optional | Name |
| boolean | optional | appId |
| string | optional | txAuthSimple |
| byte[] | optional | txAuthGeneric |
| boolean | optional | authnSel |
| AuthenticationExtensionsSupported | optional | exts |
| byte[] | optional | uvi |
| Coordinates | optional | loc |
| UvmEntries | optional | uvm |
AuthenticationExtensionsSupported
| Typedef |
| string[] |
AuthenticatorAssertionResponse
| Type | Required/Optional | Name |
| BufferSource | required | clientDataJSON |
| BufferSource | required | authenticatorData |
| BufferSource | required | signature |
| BufferSource | required | userHandle |
AuthenticatorAttachment
| Type | Required/Optional | Values |
| enum | required | platform cross-platform |
AuthenticatorAttestationResponse
| Type | Required/Optional | Name |
| BufferSource | required | clientDataJSON |
| BufferSource | required | attestationObject |
AuthenticatorSelectionCriteria
| Type | Required/Optional | Name |
| AuthenticatorAttachment | optional | authenticatorAttachment |
| boolean | optional | requireResidentKey |
| UserVerificationRequirement | optional | userVerification |
AuthenticatorSelectionList
| Typedef |
| string[] |
AuthenticatorTransport
| Type | Required/Optional | Values |
| enum | required | usb nfc ble internal |
Coordinates
| Type | Required/Optional | Name |
| double | optional | latitude |
| double | optional | longitude |
| double | optional | altitude |
| double | optional | accuracy |
| double | optional | altitudeAccuracy |
| double | optional | heading |
| double | optional | speed |
COSEAlgorithmIdentifier
| Type | Required/Optional | Values |
| enum | required | -257 (RS256) -37 (PS256) -7 (ES256) |
CredentialCreationOptions
| Type | Required/Optional | Name |
| PublicKeyCredentialCreationOptions | required | publicKey |
CredentialRequestOption
| Type | Required/Optional | Name |
| PublicKeyCredentialRequestOptions | required | publicKey |
PublicKeyCredential
| Type | Required/Optional | Name |
| string | required | id |
| string | required | type |
| BufferSource | required | rawId |
| AuthenticatorResponse* | required | response |
| AuthenticationExtensionsClientOutputs | optional | getClientExtensionResults |
*Either a AuthenticatorAssertionResponse or a AuthenticatorAttestationResponse
PublicKeyCredentialCreationOptions
| Type | Required/Optional | Name |
| PublicKeyCredentialRpEntity | required | rp |
| PublicKeyCredentialUserEntity | required | user |
| BufferSource | required | challenge |
| PublicKeyCredentialParameters[] | required | pubKeyCredParams |
| long | optional | timeout |
| PublicKeyCredentialDescriptor[] | optional | excludeCredentials |
| AuthenticatorSelectionCriteria | optional | authenticatorSelection |
| AttestationConveyancePreference | optional | attestation |
| AuthenticationExtensionsClientInputs | optional | extensions |
PublicKeyCredentialDescriptor
| Type | Required/Optional | Name |
| PublicKeyCredentialType | required | type |
| BufferSource | required | id |
| AuthenticatorTransport[] | optional | transports |
PublicKeyCredentialParameters
| Type | Required/Optional | Name |
| PublicKeyCredentialType | required | type |
| COSEAlgorithmIdentifier | required | alg |
PublicKeyCredentialRequestOptions
| Type | Required/Optional | Name |
| BufferSource | required | challenge |
| long | optional | timeout |
| string | optional | rpId |
| PublicKeyCredentialDescriptor[] | optional | allowCredentials |
| UserVerificationRequirement | optional | userVerification |
| AuthenticationExtensionsClientInputs[] | optional | extensions |
PublicKeyCredentialRpEntity
| Type | Required/Optional | Name |
| string | required | name |
| string | optional | icon |
| string | optional | id |
PublicKeyCredentialType
| Type | Required/Optional | Values |
| enum | required | public-key |
PublicKeyCredentialUserEntity
| Type | Required/Optional | Name |
| string | required | name |
| string | optional | icon |
| BufferSource | required | id |
| string | required | displayName |
ServerAuthenticatorAssertionResponse
| Type | Required/Optional | Name |
| string | required | clientDataJSON |
| string | required | authenticatorData |
| string | required | signature |
| string | required | userHandle |
ServerAuthenticatorAttestationResponse
| Type | Required/Optional | Name |
| string | required | clientDataJSON |
| string | required | attestationObject |
ServerPublicKeyCredential
| Type | Required/Optional | Name |
| string | required | id |
| string | required | type |
| string | required | rawId |
| ServerAuthenticatorResponse* | required | response |
| AuthenticationExtensionsClientOutputs | optional | getClientExtensionResults |
ServerPublicKeyCredentialCreationOptionsRequest
| Type | Required/Optional | Name |
| string | required | username |
| string | required | displayName |
| AuthenticatorSelectionCriteria | optional | authenticatorSelection |
| AttestationConveyancePreference | optional | attestation |
ServerPublicKeyCredentialCreationOptionsResponse
| Type | Required/Optional | Name |
| Status | required | status |
| string | required | errorMessage |
| PublicKeyCredentialRpEntity | required | rp |
| ServerPublicKeyCredentialUserEntity | required | user |
| string | required | challenge |
| PublicKeyCredentialParameters[] | required | pubKeyCredParams |
| long | optional | timeout |
| ServerPublicKeyCredentialDescriptor[] | optional | excludeCredentials |
| AuthenticatorSelectionCriteria | optional | authenticatorSelection |
| AttestationConveyancePreference | optional | attestation |
| AuthenticationExtensionsClientInputs | optional | extensions |
ServerPublicKeyCredentialDescriptor
| Type | Required/Optional | Name |
| PublicKeyCredentialType | required | type |
| string | required | id |
| AuthenticatorTransport[] | optional | transports |
ServerPublicKeyCredentialGetOptionsRequest
| Type | Required/Optional | Name |
| string | required | username |
| UserVerificationRequirement | optional | userVerification |
ServerPublicKeyCredentialGetOptionsResponse
| Type | Required/Optional | Name |
| Status | required | status |
| string | required | errorMessage |
| string | required | challenge |
| long | optional | timeout |
| string | optional | rpId |
| ServerPublicKeyCredentialDescriptor[] | optional | allowCredentials |
| UserVerificationRequirement | optional | userVerification |
| AuthenticationExtensionsClientInputs[] | optional | extensions |
ServerPublicKeyCredentialUserEntity
| Type | Required/Optional | Name |
| string | required | name |
| string | optional | icon |
| string | required | id |
| string | required | displayName |
ServerResponse
| Type | Required/Optional | Name |
| Status | required | status |
| string | required | errorMessage |
Status
| Type | Required/Optional | Values |
| enum | required | ok failed |
TxAuthGenericArg
| Type | Required/Optional | Name |
| string | required | contentType |
| string | required | content |
UserVerificationRequirement
| Type | Required/Optional | Values |
| enum | required | required preferred discouraged |
UvmEntries
| Typedef |
| UvmEntry[] |
UvmEntry
| Typedef |
| long[] |