---
title: "Prepare fresh passkey action verification"
method: POST
path: "/identity/passkey_step_ups"
tags: ["identity", "customer-session"]
---

# Prepare fresh passkey action verification

`POST /identity/passkey_step_ups`

## Request

- Base URL: `https://api.stablesea.com` (the document declares no server; this is the origin it was published from)
- URL: `https://api.stablesea.com/identity/passkey_step_ups`
- Auth: none declared

## Request body

- PasskeysActionInput
  - `action` 'api_key_create' | 'api_key_rotate' | 'api_key_revoke' | 'password_change', required
  - `environment` 'live'
  - `name` string
  - `scopes` string[]: At most 64 scope values, each at most 64 UTF-8 bytes. Native API-key scope validation still applies to the protected mutation.
  - `target` string

## Response `200`

OK

- PasskeysCeremonyOutput
  - `ceremony_token` string
  - `verification_token` string
  - `verified` boolean
  - `webauthn_options` unknown

## Other responses

- `400`: Bad Request
- `401`: Unauthorized
- `403`: Forbidden
- `404`: Not Found
- `429`: Too Many Requests
- `default`: Error response.

## Changes

- **2026-11-03** `6f5456d6453c`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/stablesea/apis/stable-sea-backend/changes/identity/passkey_step_ups/post.md)

---

[API](https://skmtc.dev/stablesea/apis/stable-sea-backend.md) - [All operations](https://skmtc.dev/stablesea/apis/stable-sea-backend/llms.txt) - [OpenAPI document](https://skmtc.dev/stablesea/apis/stable-sea-backend/revisions/6f5456d6453c?raw)