---
title: "Verify a discoverable passkey assertion"
method: POST
path: "/identity/sign_in/discoverable_passkey_assertions/{challenge}/confirmation"
tags: ["identity", "customer-session", "customer-session-public"]
---

# Verify a discoverable passkey assertion

`POST /identity/sign_in/discoverable_passkey_assertions/{challenge}/confirmation`

## Request

- Base URL: `https://api.stablesea.com` (the document declares no server; this is the origin it was published from)
- URL: `https://api.stablesea.com/identity/sign_in/discoverable_passkey_assertions/{challenge}/confirmation`
- Auth: none declared
- TypeScript: <https://skmtc.dev/stablesea/apis/stable-sea-backend/docs/identity/sign_in/discoverable_passkey_assertions/:challenge/confirmation/post.ts> (a function with typed inputs; its response is checked against the schema)

Verify a one-use UV-required assertion against the fixed business RP and current credential owner. Returns the normal business-selection token; the existing sign-in finalizer installs cookies. This does not establish password proof or a management grant.

## Path parameters

- `challenge` string, required

## Request body

- IdentityDiscoverablePasskeyConfirmation
  - `credential_response` unknown, required
  - `family_token` string, required

## Response `200`

OK

- IdentitySignInStep2Output
  - `groups` IdentitySignInStep2GroupOutput[], nullable
    - `business_eligible` boolean
    - `group_id` string
    - `individual` IdentitySignInStep2IndividualOutput
      - `email` string
      - `first_name` string
      - `id` string
      - `last_name` string
      - `status` string
    - `relationship` string
  - `migration_expires_ts` string, date-time, nullable
  - `migration_required` boolean
  - `migration_token` string
  - `session_token` string
  - `success` boolean

## Other responses

- `400`: Bad Request
- `401`: Unauthorized
- `403`: Forbidden
- `404`: Not Found
- `429`: Too Many Requests
- `default`: Error response.

## Changes

- **2026-11-05** `5fe1ed6a544a`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/stablesea/apis/stable-sea-backend/changes/identity/sign_in/discoverable_passkey_assertions/:challenge/confirmation/post.md)

---

[API](https://skmtc.dev/stablesea/apis/stable-sea-backend.md) - [All operations](https://skmtc.dev/stablesea/apis/stable-sea-backend/llms.txt) - [OpenAPI document](https://skmtc.dev/stablesea/apis/stable-sea-backend/revisions/d04b13035de1?raw)