---
title: "List"
method: GET
path: "/auth/passkey/credentials"
tags: ["passkey"]
---

# List

`GET /auth/passkey/credentials`

## Request

- Base URL: `https://api.instruxi.dev/api/v1/enforcer`
- URL: `https://api.instruxi.dev/api/v1/enforcer/auth/passkey/credentials`
- Auth: one of:
  - API key in header `Authorization`
  - API key in header `X-API-Key`

The caller's own registered WebAuthn/passkey credentials — every one the signed-in PERSON holds, whichever of their workspaces it was added from; never anyone else's. Each carries `aaguid` and, when known, `provider` (the password manager or device that made it), plus `backup_eligible`/`backup_state` (a synced passkey has both).

## Response `200`

OK

- InternalDeliveryHttpHandlerCredentialListResponse
  - `count` integer
  - `data` EnforcerV3InternalDomainPasskeyCredential[]
    - `aaguid` string: Authenticator is AAGUID as a UUID string ("" when the authenticator sent none or zeros), and Provider the password manager or device it names when known ("iCloud Keychain", "Google Password Manager"...). Derived on read by Describe, never stored.
    - `account_id` string
    - `attestation_type` string
    - `backup_eligible` boolean
    - `backup_state` boolean
    - `created_at` string
    - `friendly_name` string
    - `id` string
    - `last_used_at` string
    - `provider` string
    - `transports` string[]
    - `updated_at` string
  - `success` boolean

## Other responses

- `400`: Bad Request
- `401`: Unauthorized
- `409`: Conflict
- `503`: Service Unavailable

---

[API](https://skmtc.dev/instruxi/apis/enforcer-api.md) · [All operations](https://skmtc.dev/instruxi/apis/enforcer-api/llms.txt) · [OpenAPI document](https://skmtc.dev/instruxi/apis/enforcer-api/revisions/fa82bc1becc0?raw)