---
title: "Ask a connected user to touch their authenticator"
method: POST
path: "/v1/platform/connections/{connectionId}/passkeys/tx-assert/begin"
tags: ["Platform"]
---

# Ask a connected user to touch their authenticator

`POST /v1/platform/connections/{connectionId}/passkeys/tx-assert/begin`

## Request

- Base URL: `https://api.1claw.co`
- URL: `https://api.1claw.co/v1/platform/connections/{connectionId}/passkeys/tx-assert/begin`
- Auth: HTTP bearer

Begins a WebAuthn assertion bound to `tx_digest`, for the user on
this connection. The connection in the path is the addressing
that `POST /v1/auth/passkeys/tx-assert/begin` lacks: that route
resolves the *calling* principal, so with a `plt_` key it looks
up the app itself and reports no passkeys. An app never needs to
hold an email to name one of its users.

Returns 404 when the user has no passkey usable on this domain —
check `GET /v1/platform/connections/{connectionId}/passkeys`
first and only offer the step when `has_passkey` is true.

## Path parameters

- `connectionId` string, uuid, required

## Request body

- object
  - `tx_digest` string, required: SHA-256 hex of the exact text being confirmed.
  - `action` 'send' | 'swap'

## Response `200`

WebAuthn assertion ceremony options

- PasskeyAssertBeginResponse
  - `challenge` string, required
  - `rp_id` string, required
  - `timeout` integer, required
  - `user_verification` string, required
  - `allow_credentials` AllowCredential[], required
    - `id` string, required
    - `type` 'public-key', required
    - `transports` string[]

## Other responses

- `400`: Invalid request
- `403`: Insufficient permissions
- `404`: This user has no passkey registered.

---

[API](https://skmtc.dev/1claw/apis/1claw-api.md) · [All operations](https://skmtc.dev/1claw/apis/1claw-api/llms.txt) · [OpenAPI document](https://skmtc.dev/1claw/apis/1claw-api/revisions/5fa0918f3b41?raw)