---
title: "Confirm passkey deletion — step 2 of 2 (business)"
method: POST
path: "/business/passkey/delete/confirm"
tags: ["Business Enrollment"]
---

# Confirm passkey deletion — step 2 of 2 (business)

`POST /business/passkey/delete/confirm`

## Request

- Base URL: `https://www.sandbox.striga.com/api/v1`
- URL: `https://www.sandbox.striga.com/api/v1/business/passkey/delete/confirm`
- Auth: API key in header `api-key` and API key in header `Authorization`

Verifies the assertion against the challenge issued by `/business/passkey/delete` and removes the credential that challenge was bound to. The assertion must be made by that very passkey: an assertion by any other passkey, even one enrolled on the same account, is refused with `999998` before it is verified. — One challenge authorises one deletion: confirming an already-consumed challenge is rejected with `999998`; an unknown or expired `challengeId` with `999995`; an assertion that does not verify with `999998`. The attempt cap is the same as for transaction challenges. The assertion request is single-use: if the assertion was accepted but the removal failed downstream, the challenge is handed back and the deletion is started again from `/business/passkey/delete`.

## Request body

- object
  - `businessId` string, uuid, required
  - `challengeId` string, required: From `/business/passkey/delete`.
  - `ip` string, required: Client IP address, recorded with the verification event for audit purposes.
  - `origin` string, required: The origin the assertion was made at (the browser origin, or the app origin for native apps).
  - `credential` object, required: WebAuthn `PublicKeyCredential` assertion from `navigator.credentials.get()`, made by the passkey being deleted.
    - `id` string
    - `rawId` string
    - `type` string
    - `response` object
      - `clientDataJSON` string
      - `authenticatorData` string
      - `signature` string
      - `userHandle` string
    - `clientExtensionResults` object: WebAuthn client extension results.
      - `appid` string: Optional appid extension result.

## Response `200`

Passkey deleted. Returns the refreshed MFA state; removing the last passkey drops `passkey` from `enrolledMethods`.

- object
  - `deleted` boolean, required
  - `credentialId` string, required
  - `challengeId` string, required
  - `multiFactorAuth` object, required
    - `enabled` boolean, required
    - `primaryMethod` 'totp' | 'passkey' | 'sms'
    - `enrolledMethods` string[], required
    - `passkeyCount` integer, required

## Other responses

- `400`: Request was rejected. The `errorCode` field disambiguates.
- `401`: Invalid API key or HMAC signature.

---

[API](https://skmtc.dev/striga/apis/striga-strong-customer-authentication.md) - [All operations](https://skmtc.dev/striga/apis/striga-strong-customer-authentication/llms.txt) - [OpenAPI document](https://skmtc.dev/striga/apis/striga-strong-customer-authentication/revisions/6a0cf1c67072?raw)