---
title: "Gets enrollment FIDO sign options."
method: POST
path: "/baas/v1/open/itp/payment-initiation/{itp_enrollment_id}/fido-sign-options"
tags: ["Enrollment Payment Initiation"]
---

# Gets enrollment FIDO sign options.

`POST /baas/v1/open/itp/payment-initiation/{itp_enrollment_id}/fido-sign-options`

## Request

- Base URL: `https://sandbox.openfinance.celcoin.dev`
- URL: `https://sandbox.openfinance.celcoin.dev/baas/v1/open/itp/payment-initiation/{itp_enrollment_id}/fido-sign-options`
- Auth: OAuth 2
  - Client credentials
  - Token URL: `http://localhost:8080/auth/realms/master/protocol/openid-connect/token` scopes: `journey`, `app`

Method for getting enrollment FIDO sign options.

## Path parameters

- `itp_enrollment_id` string, required

## Request body

- EnrollmentV2FidoSignOptionsRequest
  - `journeySessionId` string: ID is the unique identifier of journey
  - `paymentInitiationId` string: Unique identifier of the payment initiation for which FIDO2 authentication is requested. Required when using API scope to link the authentication to a specific payment operation.
  - `data` EnrollmentV2FidoSignOptionsRequestData, required
    - `rp` string, required: Unique Relying Party identifier, which corresponds to the CN value of the payment initiator's transport certificate. This must match the RP ID used during credential registration to ensure proper authentication scope and security validation.
    - `platform` 'ANDROID' | 'BROWSER' | 'CROSS_PLATFORM' | 'IOS', required: Indicates the platform on which the user is using the FIDO2 credential. This field allows the FIDO server to include platform-specific extensions and optimize authentication parameters. Values: ANDROID (Android devices), BROWSER (web browsers), CROSS_PLATFORM (external authenticators like USB keys), IOS (iOS devices).

## Response `200`

Object containing the necessary information for signing with a FIDO2 credential.

- EnrollmentV2FidoSignOptions
  - `challenge` string, required: Random byte sequence generated by the FIDO2 server for this authentication request. Must be the value in base64url format without padding. This challenge is cryptographically unique for each authentication attempt and must be signed by the user's private key to prove possession of the credential.
  - `allowCredentials` EnrollmentV2FidoSignOptionsAllowCredentials[]: List of FIDO2 credentials allowed for this authentication. Contains the specific credentials that were previously registered for this user and can be used for this authentication attempt. If empty or not provided, any credential associated with the user account can be used.
    - `id` string, required: Unique FIDO2 credential identifier in base64url format. Must match the credential ID that was returned during registration and is stored in the authenticator device.
    - `type` string, required: WebAuthn credential type. For FIDO2 credentials, this is always 'public-key'.
  - `timeout` integer: Timeout in milliseconds for completing the FIDO2 authentication. Specifies how long the user has to complete the authentication process before the challenge expires. Common values range from 30000 (30 seconds) to 300000 (5 minutes).
  - `userVerification` string: Level of user verification required for this FIDO2 authentication. Values: 'required' (user verification must occur), 'preferred' (user verification is preferred but not required), 'discouraged' (user verification should not occur). User verification typically involves biometrics, PIN, or other local authentication methods on the device.
  - `rpId` string: Relying Party identifier for FIDO2 authentication origin validation. Must match the domain or identifier used during credential registration. This ensures that credentials can only be used for the intended service and prevents unauthorized cross-origin usage.

## Other responses

- `401`: Authentication is required to access this resource. The client must provide valid credentials.
- `403`: The server understood the request but refuses to authorize it. Access is permanently forbidden and tied to the application logic.
- `409`: The request conflicts with the current state of the resource on the server.
- `422`: The request contains invalid or malformed data that cannot be processed.
- `500`: An unexpected error occurred on the server while processing the request.
- `default`: Unexpected error.

---

[API](https://skmtc.dev/celcoin/apis/api-para-transa-es.md) - [All operations](https://skmtc.dev/celcoin/apis/api-para-transa-es/llms.txt) - [OpenAPI document](https://skmtc.dev/celcoin/apis/api-para-transa-es/revisions/85dd6188a37b?raw)