---
title: "Issue a passkey registration grant"
method: POST
path: "/api/v1/subjects/{subject_id}/passkeys/registration-grants"
tags: ["canonical"]
---

# Issue a passkey registration grant

`POST /api/v1/subjects/{subject_id}/passkeys/registration-grants`

## Request

- Base URL: `https://app.graypass.org` (the document declares no server; this is the origin it was published from)
- URL: `https://app.graypass.org/api/v1/subjects/{subject_id}/passkeys/registration-grants`
- Auth: HTTP bearer

Authorize one subject-bound passkey registration ceremony from your authenticated backend.

## Path parameters

- `subject_id` string, required

## Response `201`

One-time registration token and ISO 8601 expiry.

- PasskeyRegistrationGrant: Single-use backend grant permitting the intended subject to begin passkey registration.
  - `expires_at` string, required: Expiry time as an ISO 8601 timestamp. Use the capability before this time; obtain a fresh one afterward.
  - `token` string, required: Short-lived, one-time passkey-registration grant. Deliver only to the authenticated subject’s intended browser and keep out of logs.

## Other responses

- `422`: The canonical handler returns a Problem for invalid input; correct the request before retrying.

---

[API](https://skmtc.dev/graypass/apis/graypass-api.md) - [All operations](https://skmtc.dev/graypass/apis/graypass-api/llms.txt) - [OpenAPI document](https://skmtc.dev/graypass/apis/graypass-api/revisions/5f9ab64fdfdb?raw)