---
title: "Register Finish"
method: POST
path: "/auth/passkey/register/finish"
tags: ["passkey"]
---

# Register Finish

`POST /auth/passkey/register/finish`

## Request

- Base URL: `https://api.instruxi.dev/api/v1/enforcer`
- URL: `https://api.instruxi.dev/api/v1/enforcer/auth/passkey/register/finish`
- Auth: one of:
  - API key in header `Authorization`
  - API key in header `X-API-Key`

Completes the ceremony started by beginPasskeyRegistration: verifies the attestation response against the handle issued there and stores the credential under friendly_name. A stale, reused, or mismatched handle fails with the same 400 passkey_failed as a malformed attestation — the ceremony does not distinguish client bugs from a forged response in its error body.

## Request body

- InternalDeliveryHttpHandlerRegisterFinishReq
  - `credential` integer[]: raw WebAuthn attestation response
  - `friendly_name` string
  - `handle` string

## Response `200`

OK

- InternalDeliveryHttpHandlerCredentialResponse
  - `data` EnforcerV3InternalDomainPasskeyCredential
    - `aaguid` string: Authenticator is AAGUID as a UUID string ("" when the authenticator sent none or zeros), and Provider the password manager or device it names when known ("iCloud Keychain", "Google Password Manager"...). Derived on read by Describe, never stored.
    - `account_id` string
    - `attestation_type` string
    - `backup_eligible` boolean
    - `backup_state` boolean
    - `created_at` string
    - `friendly_name` string
    - `id` string
    - `last_used_at` string
    - `provider` string
    - `transports` string[]
    - `updated_at` string
  - `success` boolean

## Other responses

- `400`: Bad Request
- `401`: Unauthorized
- `409`: Conflict
- `503`: Service Unavailable

---

[API](https://skmtc.dev/instruxi/apis/enforcer-api.md) · [All operations](https://skmtc.dev/instruxi/apis/enforcer-api/llms.txt) · [OpenAPI document](https://skmtc.dev/instruxi/apis/enforcer-api/revisions/fa82bc1becc0?raw)