---
title: "Get user authenticators"
method: GET
path: "/users/{userId}/authenticators"
tags: ["challenge"]
---

# Get user authenticators

`GET /users/{userId}/authenticators`

Gets a list of the user's currently enrolled authenticators.

## Path parameters

- `userId` string, required

## Response `200`

OK

- UserAuthenticator[]
  - `userAuthenticatorId` string, required
  - `verificationMethod` 'SMS' | 'AUTHENTICATOR_APP' | 'EMAIL_MAGIC_LINK' | 'EMAIL_OTP' | 'PUSH' | 'DEVICE' | 'SECURITY_KEY' | 'PASSKEY' | 'VERIFF' | 'IPROOV' | 'PALM_BIOMETRICS_RR' | 'IDVERSE', required
  - `email` string
  - `phoneNumber` string
  - `username` string
  - `displayName` string
  - `createdAt` string, date-time, required
  - `verifiedAt` string, date-time
  - `lastVerifiedAt` string, date-time
  - `previousSmsChannel` 'DEFAULT' | 'WHATSAPP' — The channel that was last used by the user to complete an SMS challenge. Only defined if the verification method is SMS.
  - `webauthnCredential` object
    - `credentialId` string
    - `deviceId` string
    - `name` string — The name of the passkey. Defaults to `aaguidMapping.name` if available.
    - `aaguid` string
    - `aaguidMapping` object
      - `name` string — The name of the credential manager where the passkey is stored e.g. 'iCloud Keychain'.
      - `svgIconLight` string — A base64 encoded light variant SVG icon for the credential manager.
      - `svgIconDark` string — A base64 encoded dark variant SVG icon for the credential manager.
    - `credentialBackedUp` boolean
    - `credentialDeviceType` 'singleDevice' | 'multiDevice'
    - `authenticatorAttachment` 'cross-platform' | 'platform'
    - `parsedUserAgent` object
      - `ua` string
      - `browser` object
        - `name` string
        - `version` string
        - `major` string
      - `device` object
        - `model` string
        - `type` string
        - `vendor` string
      - `engine` object
        - `name` string
        - `version` string
      - `os` object
        - `name` string
        - `version` string
      - `cpu` object
        - `architecture` string
  - `deviceName` string — The name of the device (e.g. 'iPhone 16 Pro'). Only used for PUSH verification methods.

## Other responses

- `400` — Invalid Request
- `401` — Unauthorized

---

[API](https://skmtc.dev/authsignal/apis/call-connect-api.md) · [All operations](https://skmtc.dev/authsignal/apis/call-connect-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/authsignal/call-connect-api/revisions/5604d744e3ad/schema)