FIDO 2

FIDO2 Server Operations

Attestation (Registration)

Attestation Options

Description

Endpoint to initiate a registration operation.

Endpoint

POST	/attestation/options

JSON Parameters

Type	Required/Optional
ServerPublicKeyCredentialCreationOptionsRequest	required

Response

Type	Required/Optional
ServerPublicKeyCredentialCreationOptionsResponse	required

Example Request

POST /attestation/options

{

  "username": "[e-mail]",

  "displayName": "John Doe",

  "authenticatorSelection": {

    "requireResidentKey": false,

    "authenticatorAttachment": "cross-platform",

    "userVerification": "preferred"

  },

  "attestation": "direct"

}

Example Response

{

  "status": "ok",

  "errorMessage": "",

  "rp": {

    "name": "Example Corporation"

  },

  "user": {

    "id": "S3932ee3C0JtMIQ",

    "name": "[e-mail]",

    "displayName": "John Doe"

  },

  "challenge": "uhUjPNlZuhNdsLPkkE5Fv-lUN",

  "pubKeyCredParams": [

    {

      "type": "public-key",

      "alg": -7

    }

  ],

  "timeout": 10000,

  "excludeCredentials": [

    {

      "type": "public-key",

      "id": "opQf1maupUKJIQp"

    }

  ],

  "authenticatorSelection": {

    "requireResidentKey": false,

    "authenticatorAttachment": "cross-platform",

    "userVerification": "preferred"

  },

  "attestation": "direct"

}

Attestation Result

Description

Endpoint to complete a registration operation.

Endpoint

POST	/attestation/result

JSON Parameters

Type	Required/Optional
ServerPublicKeyCredential	required

ServerPublicKeyCredential’s “response” field must be a ServerAuthenticatorAttestationResponse.

Response

Type	Required/Optional
ServerResponse	required

Example Request

POST /attestation/result

{

  "id": "LFdoCFJTyB82ZzSJUHc-c72yraRc_1E8su39xXAWgWl6itMKqmDvruha6ywA",

  "rawId": "LFdoCFJTyB82ZzSJUHc-c72yraRc_1mPvGX8ToE8su39xX26JcAWgWl6itMKqmDvruha6ywA",

  "response": {

    "clientDataJSON": "eyJjaGFsbGVuZ2UiOiJOeHlab32Iiwib3JpZ2luIjoiL2xvY2FsaG9zdDozMDAwIiwidHlwZSI6IndlYmF1dGhuLmNyZWF0ZSJ9",

    "attestationObject": "o2NmbXRoZmlkby11MmZnYXR0U3RtdKJjc2lnWEcwRQIgVzzvX3Nyp_g9j9f2B-tPWy6puW01aZHI8RXjwqfDjtQCIQDLsdniGPO9iKr7tdgVV-FnBYhvzlZLG3u28rVt10YXfGN4NWOBWQJOMIICSjCCATKgAwIBAgIEVxb3wDANBgkqhkiG9w0BAQsFADAuMSwwKgYDVQQDEyNZdWJpY28gVTJpYqG4A579f3YAjfrPbgj404xJns0mqx5wkpxKlnoBKqo1rqSUmonencd4xanO_PHEfxU0iZif615X5lc87qDHZdjQQAAAAAAAAAAAAAAAAAAAAAAAAAAAEAsV2gIUlPIHzZnNIlQdz5zvbKtpFz_WY-8ZfxOgTyy7f3Ffbolyp3fUtSQo5LfoUgBaBaXqK0wqqYO-u6FrrLApQECAyYgASFYIPr9-YH8DuBsOnaI3KJa0a39hyxh9LDtHErNvfQSyxQsIlgg4rAuQQ5uy4VXGFbkiAt0uwgJJodp-DymkoBcrGsLtkI"

  },

  "type": "public-key"

}

Example Response

{

  "status": "ok",

  "errorMessage": ""

}

Assertion (Authentication)

Assertion Options

Description

Endpoint to initiate an authentication operation.

Endpoint

POST	/assertion/options

JSON Parameters

Type	Required/Optional
ServerPublicKeyCredentialGetOptionsRequest	required

Response

Type	Required/Optional
ServerPublicKeyCredentialGetOptionsResponse	required

Example Request

POST /assertion/options

{

  "username": "[e-mail]",

  "userVerification": "required"

}

Example Response

{

  "status": "ok",

  "errorMessage": "",

  "challenge": "6283u0svQHStwkJCaLKx",

  "timeout": 20000,

  "rpId": "https://example.com",

  "allowCredentials": [

    {

      "id": "m7xlAuwcj4m",

      "type": "public-key"

    }

  ],

  "userVerification": "required"

}

Assertion Result

Description

Endpoint to complete an authentication operation.

Endpoint

POST	/assertion/result

JSON Parameters

Type	Required/Optional
ServerPublicKeyCredential	required

ServerPublicKeyCredential’s “response” field must be a ServerAuthenticatorAssertionResponse.
 

Response

Type	Required/Optional
ServerResponse	required

Example Request

POST /assertion/result

{

  "id":"LFdoCFJTyB82ZzSJUHc-c72yraRc_1mPvGX8ToE8su3l6itMKqmDvruha6ywA", "rawId":"LFdoCFJTyB82Z2yraRc_1mPvGX8ToE8su39xX26FIAWgWl6itMKqmDvruha6ywA",

  "response": {

    "authenticatorData":"SZYN5YgOjGLHmVzzuoMdl2MBAAAAAA",

    "signature":"MEYC9DQIhANiYig9newAJZYTzG1i5lwP-YQk9uXFnnDaHnr2yCKXL",

    "userHandle":"",

    "clientDataJSON":"eyJjaGFsbGVuZImhhc2hB2Iiwib3JpZ2luIjoiaHR0cDovL2xvY2FsaG9zdDozMDAwIiwidHlwZSI6IndlYmF1dGhuLmdldCJ9"

  },

  "type":"public-key"

}

Example Response

{

  "status": "ok",

  "errorMessage": ""

}

WebAuthn Operations

Create Credential (Registration)

Description

API to perform user registration.

Javascript API

navigator.credentials.create()

Parameters

Type	Required/Optional
CredentialCreationOptions	required

 

Response

Type	Required/Optional
PublicKeyCredential	required

PublicKeyCredential’s “response” will be a AuthenticatorAttestationResponse.

Example Request

navigator.credentials.create({

  publicKey: {

    challenge: new Uint8Array([21,31,105, ...]),

    rp: {

      name: "ACME Corporation"

    },

    user: {

      id: Uint8Array.from(window.atob("MIIBkZMwggE4oAMCAQgGTMII="), c=>c.charCodeAt(0)),

      name: "[e-mail]",

      displayName: "Alex P. Müller",

      icon: "https://pics.example.com/00/p/aBjjjpqPb.png"

    },

    pubKeyCredParams: [

      {

        type: "public-key",

        alg: -7

      },

      {

        type: "public-key",

         alg: -257

      }

    ],

    timeout: 60000,

    excludeCredentials: [],

    extensions: {

      "loc": true

    }

  }

});

Example Response

{

  rawId: “QXLsNzPhaR2aRI_-ze8IK6ru_An8gIAaZ2RMFNLNTxLd6TbMJELtEBNbR3pghe3A”,

  id: Int8Array([65, 114, -20, 55, 49, ...],

  response: {

    attestationObject: Int8Array[-93, 99, 102, 109, ...],

    clientDataJson: Int8Array[123, 34, 99, 104, 97, ....]

  },

  type: “public-key”

}

Get Credential (Authentication)

Description

API to perform user authentication.
 

Javascript API

navigator.credentials.get()

Parameters

Type	Required/Optional
CredentialRequestOptions	required

Response

Type	Required/Optional
PublicKeyCredential	required

PublicKeyCredential’s “response” will be a AuthenticatorAssertionResponse.
 

Example Request

navigator.credentials.get({

  publicKey: {

    challenge: new Uint8Array([4,101,15, ...]),

    timeout: 60000,

    allowCredentials: [

      {

        type: “public-key”,

        id: new Uint8Array([183, 148, 245, …])

      }

    ],

  }

});

Example Response

{

  rawId: “_08FiVZ0EZqUUfZTf1F7R18I9xXSml3TAOIpsWw-SAt-g1lc8FCYVR_hgtWC”,

  id: Int8Array([170, 197, 31, ...],

  response: {

    authenticatorData: Int8Array[66, 107, 61, ...],

    signature: Int8Array[91, 183, 120, ...],

    userHandle: Int8Array[97, 75, 20, ...],

    clientDataJson: Int8Array[191, 4, 22, ...]

  },

  type: “public-key”

}

Models reference

AttestationConveyancePreference

Type	Required/Optional	Values
enum	required	none indirect direct

AuthenticationExtensionsClientInputs

Type	Required/Optional	Name
string	optional	appId
string	optional	txAuthSimple
TxAuthGenericArg	optional	txAuthGeneric
AuthenticatorSelectionList	optional	authnSel
boolean	optional	exts
boolean	optional	uvi
boolean	optional	loc
boolean	optional	uvm

AuthenticationExtensionsClientOutputs

Type	Required/Optional	Name
boolean	optional	appId
string	optional	txAuthSimple
byte[]	optional	txAuthGeneric
boolean	optional	authnSel
AuthenticationExtensionsSupported	optional	exts
byte[]	optional	uvi
Coordinates	optional	loc
UvmEntries	optional	uvm

AuthenticationExtensionsSupported

Typedef

string[]

AuthenticatorAssertionResponse

Type	Required/Optional	Name
BufferSource	required	clientDataJSON
BufferSource	required	authenticatorData
BufferSource	required	signature
BufferSource	required	userHandle

AuthenticatorAttachment

Type	Required/Optional	Values
enum	required	platform cross-platform

AuthenticatorAttestationResponse

Type	Required/Optional	Name
BufferSource	required	clientDataJSON
BufferSource	required	attestationObject

AuthenticatorSelectionCriteria

Type	Required/Optional	Name
AuthenticatorAttachment	optional	authenticatorAttachment
boolean	optional	requireResidentKey
UserVerificationRequirement	optional	userVerification

AuthenticatorSelectionList

Typedef

string[]

AuthenticatorTransport

Type	Required/Optional	Values
enum	required	usb nfc ble internal

Coordinates

Type	Required/Optional	Name
double	optional	latitude
double	optional	longitude
double	optional	altitude
double	optional	accuracy
double	optional	altitudeAccuracy
double	optional	heading
double	optional	speed

COSEAlgorithmIdentifier

Type	Required/Optional	Values
enum	required	-257 (RS256) -37 (PS256) -7 (ES256)

CredentialCreationOptions

Type	Required/Optional	Name
PublicKeyCredentialCreationOptions	required	publicKey

CredentialRequestOption

Type	Required/Optional	Name
PublicKeyCredentialRequestOptions	required	publicKey

PublicKeyCredential

Type	Required/Optional	Name
string	required	id
string	required	type
BufferSource	required	rawId
AuthenticatorResponse*	required	response
AuthenticationExtensionsClientOutputs	optional	getClientExtensionResults

*Either a AuthenticatorAssertionResponse or a AuthenticatorAttestationResponse

PublicKeyCredentialCreationOptions

Type	Required/Optional	Name
PublicKeyCredentialRpEntity	required	rp
PublicKeyCredentialUserEntity	required	user
BufferSource	required	challenge
PublicKeyCredentialParameters[]	required	pubKeyCredParams
long	optional	timeout
PublicKeyCredentialDescriptor[]	optional	excludeCredentials
AuthenticatorSelectionCriteria	optional	authenticatorSelection
AttestationConveyancePreference	optional	attestation
AuthenticationExtensionsClientInputs	optional	extensions

PublicKeyCredentialDescriptor

Type	Required/Optional	Name
PublicKeyCredentialType	required	type
BufferSource	required	id
AuthenticatorTransport[]	optional	transports

PublicKeyCredentialParameters

Type	Required/Optional	Name
PublicKeyCredentialType	required	type
COSEAlgorithmIdentifier	required	alg

PublicKeyCredentialRequestOptions

Type	Required/Optional	Name
BufferSource	required	challenge
long	optional	timeout
string	optional	rpId
PublicKeyCredentialDescriptor[]	optional	allowCredentials
UserVerificationRequirement	optional	userVerification
AuthenticationExtensionsClientInputs[]	optional	extensions

PublicKeyCredentialRpEntity

Type	Required/Optional	Name
string	required	name
string	optional	icon
string	optional	id

PublicKeyCredentialType

Type	Required/Optional	Values
enum	required	public-key

PublicKeyCredentialUserEntity

Type	Required/Optional	Name
string	required	name
string	optional	icon
BufferSource	required	id
string	required	displayName

ServerAuthenticatorAssertionResponse

Type	Required/Optional	Name
string	required	clientDataJSON
string	required	authenticatorData
string	required	signature
string	required	userHandle

ServerAuthenticatorAttestationResponse

Type	Required/Optional	Name
string	required	clientDataJSON
string	required	attestationObject

ServerPublicKeyCredential

Type	Required/Optional	Name
string	required	id
string	required	type
string	required	rawId
ServerAuthenticatorResponse*	required	response
AuthenticationExtensionsClientOutputs	optional	getClientExtensionResults

ServerPublicKeyCredentialCreationOptionsRequest

Type	Required/Optional	Name
string	required	username
string	required	displayName
AuthenticatorSelectionCriteria	optional	authenticatorSelection
AttestationConveyancePreference	optional	attestation

ServerPublicKeyCredentialCreationOptionsResponse

Type	Required/Optional	Name
Status	required	status
string	required	errorMessage
PublicKeyCredentialRpEntity	required	rp
ServerPublicKeyCredentialUserEntity	required	user
string	required	challenge
PublicKeyCredentialParameters[]	required	pubKeyCredParams
long	optional	timeout
ServerPublicKeyCredentialDescriptor[]	optional	excludeCredentials
AuthenticatorSelectionCriteria	optional	authenticatorSelection
AttestationConveyancePreference	optional	attestation
AuthenticationExtensionsClientInputs	optional	extensions

ServerPublicKeyCredentialDescriptor

Type	Required/Optional	Name
PublicKeyCredentialType	required	type
string	required	id
AuthenticatorTransport[]	optional	transports

ServerPublicKeyCredentialGetOptionsRequest

Type	Required/Optional	Name
string	required	username
UserVerificationRequirement	optional	userVerification

ServerPublicKeyCredentialGetOptionsResponse

Type	Required/Optional	Name
Status	required	status
string	required	errorMessage
string	required	challenge
long	optional	timeout
string	optional	rpId
ServerPublicKeyCredentialDescriptor[]	optional	allowCredentials
UserVerificationRequirement	optional	userVerification
AuthenticationExtensionsClientInputs[]	optional	extensions

ServerPublicKeyCredentialUserEntity

Type	Required/Optional	Name
string	required	name
string	optional	icon
string	required	id
string	required	displayName

ServerResponse

Type	Required/Optional	Name
Status	required	status
string	required	errorMessage

Status

Type	Required/Optional	Values
enum	required	ok failed

TxAuthGenericArg

Type	Required/Optional	Name
string	required	contentType
string	required	content

UserVerificationRequirement

Type	Required/Optional	Values
enum	required	required preferred discouraged

UvmEntries

Typedef

UvmEntry[]

UvmEntry

Typedef

long[]