---
title: "List passkeys"
method: GET
path: "/v2/passkeys"
tags: ["Passkeys"]
---

# List passkeys

`GET /v2/passkeys`

## Request

- Base URL: `https://api.byndid.com`
- URL: `https://api.byndid.com/v2/passkeys`
- Auth: HTTP bearer
- TypeScript: <https://skmtc.dev/beyondidentity/apis/beyond-identity-secure-workforce-api/docs/v2/passkeys/get.ts> (a function with typed inputs; its response is checked against the schema)

To list passkeys, send a GET request to `/v2/passkeys`.

The response will have up to 1000 items. The response will be empty if the
page size is not specified (i.e., the default). By default, the list is in
ascending order by `create_time`. The maximum and default page sizes are
subject to change.

When paginating, use the `skip` parameter as the offset.

When filtering, the response will only show users that satisfy this filter.
The syntax follows the SCIM grammar from
[RFC7644 Section 3.4.2.2](https:datatracker.ietf.org/doc/html/rfc7644#section-3.4.2.2).

The supported operations are:
  - pr (present)
  - eq (equals)
  - ne (not equals)
  - co (contains)
  - sw (starts with)
  - ew (ends with)
  - gt (greater than)
  - lt (less than)
  - ge (greater than or equal to)
  - le (less than or equal to)

The supported fields and their supported operations are:
  - id (eq, ne, co, sw, ew)
  - date_last_auth (pr, eq, ne, gt, lt, ge, le)
  - platform (eq, ne, co, sw, ew)
  - platform_pr (eq, ne)
  - sdk (eq, ne, co, sw, ew)
  - major (eq, ne, co, sw, ew)
  - minor (eq, ne, co, sw, ew)
  - patch (eq, ne, co, sw, ew)
  - is_jailbroken (eq, ne)
  - is_rooted (eq, ne)
  - hardware_serial_number (eq, ne, co, sw, ew)
  - serial_number (eq, ne)
  - app_version (eq, ne, co, sw, ew)
  - app_version_pr (eq, ne)
  - search (text search)
  - vul_firewall (eq, ne)
  - vul_rooted (eq, ne)
  - vul_biometric (eq, ne)
  - vul_password (eq, ne)
  - vul_tpm (eq, ne)
  - user_name (eq, ne, co, sw, ew)
  - device_name (eq, ne, co, sw, ew)
  - user_status (eq, ne, co, sw, ew)
  - hostname (eq, ne, co, sw, ew)


When sorting, use the `order_by` parameter. It's a comma-delimited list of
attributes. Currently, the following fields are supported:

  - date_last_auth
  - device_name
  - hostname
  - user_name
  - platform
  - sdk
  - major
  - minor
  - patch

The default sorting order per attribute is ascending. Therefore, if you
want descending order, append the " desc" suffix to the attribute name.

## Query parameters

- `page_size` integer
- `skip` integer
- `filter` string
- `order_by` string

## Response `200`

The response is a JSON object with `passkeys` and `total_size` keys. <br />
  - `passkeys` is set to an array of passkey objects containing standard passkey
    attributes.
  - `total_size` is set to the total number of items matched by the
    list request.
If more items are to be returned by the requested query, make another request using the `skip` query parameter.

- object: Response for ListPasskeys.
  - `passkeys` object[], required: An array of passkeys associated with the request.
    - `id` string, required: Unique ID of the passkey.
    - `user_id` string, required: ID of the user who owns the passkey.
    - `user_name` string, required: Display name/username of the passkey owner.
    - `device_info` string, required: Device model or descriptor reported by the client.
    - `date_last_auth` string, date-time, required: RFC 3339 timestamp of the last successful authentication.
    - `date_created` string, date-time, required: RFC 3339 timestamp when the passkey was created/registered.
    - `platform` string, required: Client platform (e.g., android, ios, windows, macos, linux).
    - `serial_number` string, required: Device serial number if available.
    - `hostname` string, required: Hostname of the device at registration or last auth.
    - `major_version` integer, required: Major version of the client/app/OS as reported.
    - `minor_version` integer, required: Minor version of the client/app/OS as reported.
    - `is_rooted` boolean, required: Whether the device is rooted/jailbroken.
    - `vulnerabilities` object, required: Key-value map of vulnerability identifiers to details/versions.
    - `app_version` string, required: Application version string.
  - `total_size` integer, required: The total number of passkeys associated with the request.

## Other responses

- `401`: Unauthorized
- `403`: Forbidden
- `404`: The resource was not found.
- `500`: Internal Server Error

---

[API](https://skmtc.dev/beyondidentity/apis/beyond-identity-secure-workforce-api.md) - [All operations](https://skmtc.dev/beyondidentity/apis/beyond-identity-secure-workforce-api/llms.txt) - [OpenAPI document](https://skmtc.dev/beyondidentity/apis/beyond-identity-secure-workforce-api/revisions/562e14b2e4ba?raw)