---
title: "Complete passkey update"
method: POST
path: "/users/@me/mfa/webauthn/migration"
tags: ["Users"]
---

# Complete passkey update

`POST /users/@me/mfa/webauthn/migration`

Register the replacement passkey under the name of the pending one. The old passkey stops appearing in lists and is removed together with its replacement.

## Request body

- PasskeyMigrationCompleteRequest
  - `response` WebAuthnRegistrationResponse, required
    - `id` string, required
    - `rawId` string, required
    - `type` 'public-key', required
    - `authenticatorAttachment` 'cross-platform' | 'platform'
    - `clientExtensionResults` object, required
      - `appid` boolean
      - `credProps` object
        - `rk` boolean
      - `hmacCreateSecret` boolean
    - `response` object, required
      - `clientDataJSON` string, required
      - `attestationObject` string, required
      - `authenticatorData` string
      - `transports` string[]
      - `publicKeyAlgorithm` integer
      - `publicKey` string
  - `challenge` string, required — The challenge from registration options

## Response `204`

No Content

## Other responses

- `400` — Bad Request - The request was malformed or contained invalid data
- `401` — Unauthorized - Authentication is required or the token is invalid
- `403` — Forbidden - You do not have permission to perform this action
- `429` — Too Many Requests - You are being rate limited
- `500` — Internal Server Error - An unexpected error occurred

## Changes

> 21 revisions in range; 2 not diffed.

- **2026-09-26** `3d3fd6ec1785` — 1 info
  - endpoint added

[Change history](https://skmtc.dev/fluxer/apis/fluxer-api/changes/users/@me/mfa/webauthn/migration/post.md)

---

[API](https://skmtc.dev/fluxer/apis/fluxer-api.md) · [All operations](https://skmtc.dev/fluxer/apis/fluxer-api/llms.txt) · [OpenAPI document](https://skmtc.dev/fluxer/apis/fluxer-api/revisions/3d3fd6ec1785?raw)