STstriga
Enrollment

Initiate passkey deletion — step 1 of 2

Removing a strong factor is itself a sensitive action, so deletion is a two-step SCA ceremony proven with the passkey being removed. This call binds a deletion challenge to the named credentialId (the id returned by /user/passkey/list) and returns the WebAuthn assertion request for that credential alone: allowCredentials lists only the passkey being removed, and no other factor is accepted — a user who no longer holds the key goes through the liveness-gated 2FA reset. An unknown credentialId is refused with 999998. The challenge expires after 10 minutes. Nothing is deleted by this call; complete the removal with /user/passkey/delete/confirm.

post/user/passkey/delete

Request

  • Base URL
    https://www.sandbox.striga.com/api/v1
  • URL
    https://www.sandbox.striga.com/api/v1/user/passkey/delete
  • Auth
    API key in header api-key and API key in header Authorization

Request body

userIdstring required
credentialIdstring required

The id of the credential to remove, as returned by /user/passkey/list.

Response

Deletion challenge issued, with the assertion request (options, allowedOrigins, relyingPartyId) for the passkey being removed.

challengeIdstring required
dateExpiresstring date-time required
credentialIdstring required

The credential the challenge is bound to. The confirm step deletes exactly this credential.

allowedOriginsstring[] required

The origins the assertion may be made at.

relyingPartyIdstring required

Changes

No recorded changes to this operation across all 1 revision of this API.