auth

Elevate the acting session by presenting a passkey.

Changed on

Validates the opaque assertion and appends webauthn to the acting session's factor set, rotating its token (delivered on the __Host-hikyo cookie for a browser session). The original authenticated_at is preserved.

post/api/v1/auth/webauthn/step-up/finish

Request

  • Base URL: / (relative, and the document was published on a file host, not at the API’s origin)
  • URL: /api/v1/auth/webauthn/step-up/finish
  • Auth: HTTP bearer

Request body

WebauthnResponse required

Opaque WebAuthn authenticator response (attestation or assertion) as produced by the browser, passed to the relying party as raw bytes.

Response

Session elevated. The rotated token replaces the old one.

session_tokenstring

The bearer value, returned exactly once. A replayable credential: cookie attributes constrain browsers, not an attacker holding the value, which is why lifetimes are short and revocation is a delete. OMITTED for a browser-artifact session: that token is delivered ONLY on the __Host-hikyo HttpOnly cookie so injected same-origin script cannot read it. A CLI-artifact session, which has no cookie channel, still carries it here.

Changes

  • 54b2780eec85Revision changes
    • info

      added the optional property / to the response with the status

    • info

      added the optional property / to the response with the status

    • info

      added the optional property / to the response with the status

    • info

      added the optional property / to the response with the status

    • info

      added the optional property / to the response with the status

    • info

      added the optional property / to the response with the status

  • f84a1cd8a05aRevision changes
    • warning

      added the new payload_too_large enum value to the / response property for the response status

    • warning

      added the new payload_too_large enum value to the / response property for the response status

    • warning

      added the new payload_too_large enum value to the / response property for the response status

    • warning

      added the new payload_too_large enum value to the / response property for the response status

    • warning

      added the new payload_too_large enum value to the / response property for the response status

    • warning

      added the new payload_too_large enum value to the / response property for the response status

    • warning

      added the new unprocessable enum value to the / response property for the response status

    • warning

      added the new unprocessable enum value to the / response property for the response status

    • warning

      added the new unprocessable enum value to the / response property for the response status

    • warning

      added the new unprocessable enum value to the / response property for the response status

    • warning

      added the new unprocessable enum value to the / response property for the response status

    • warning

      added the new unprocessable enum value to the / response property for the response status