---
title: "Initiate passkey deletion — step 1 of 2 (business)"
method: POST
path: "/business/passkey/delete"
tags: ["Business Enrollment"]
---

# Initiate passkey deletion — step 1 of 2 (business)

`POST /business/passkey/delete`

## Request

- Base URL: `https://www.sandbox.striga.com/api/v1`
- URL: `https://www.sandbox.striga.com/api/v1/business/passkey/delete`
- Auth: API key in header `api-key` and API key in header `Authorization`

Removing a strong factor is itself a sensitive action, so deletion is a two-step SCA ceremony proven with the passkey being removed. This call binds a deletion challenge to the named `credentialId` (the `id` returned by `/business/passkey/list`) and returns the WebAuthn assertion request for that credential alone: `allowCredentials` lists only the passkey being removed, and no other factor is accepted — a user who no longer holds the key goes through the liveness-gated 2FA reset. An unknown `credentialId` is refused with `999998`. The challenge expires after 10 minutes. Nothing is deleted by this call; complete the removal with `/business/passkey/delete/confirm`.

## Request body

- object
  - `businessId` string, uuid, required
  - `credentialId` string, required: The `id` of the credential to remove, as returned by `/business/passkey/list`.

## Response `200`

Deletion challenge issued, with the assertion request (`options`, `allowedOrigins`, `relyingPartyId`) for the passkey being removed.

- object
  - `challengeId` string, required
  - `dateExpires` string, date-time, required
  - `credentialId` string, required: The credential the challenge is bound to. The confirm step deletes exactly this credential.
  - `options` object, required: Standard WebAuthn `PublicKeyCredentialRequestOptions` for the passkey being removed; `allowCredentials` lists only that credential. Base64url-encoded binary fields are passed through to the browser without modification.
    - `challenge` string
    - `timeout` integer
    - `rpId` string
    - `allowCredentials` object[]
      - `type` string
      - `id` string
    - `userVerification` string
  - `allowedOrigins` string[], required: The origins the assertion may be made at.
  - `relyingPartyId` string, required

## Other responses

- `400`: Request was rejected. The `errorCode` field disambiguates.
- `401`: Invalid API key or HMAC signature.

---

[API](https://skmtc.dev/striga/apis/striga-strong-customer-authentication.md) - [All operations](https://skmtc.dev/striga/apis/striga-strong-customer-authentication/llms.txt) - [OpenAPI document](https://skmtc.dev/striga/apis/striga-strong-customer-authentication/revisions/6a0cf1c67072?raw)