---
title: "Enroll Webauthn Complete"
method: POST
path: "/auth/mfa/enroll/webauthn/complete"
tags: ["Auth"]
---

# Enroll Webauthn Complete

`POST /auth/mfa/enroll/webauthn/complete`

## Request

- Base URL: `http://localhost:8000`
- URL: `http://localhost:8000/auth/mfa/enroll/webauthn/complete`
- Auth: HTTP bearer

Verify the WebAuthn attestation and activate the method.

## Headers

- `API-Version` '1'

## Request body

- WebAuthnEnrolCompleteRequest: POST body for /auth/mfa/enroll/webauthn/complete. ``credential`` is the JSON object the browser produced during the WebAuthn ceremony — opaque to the server schema; the WebAuthn library validates its shape.
  - `method_id` integer, required
  - `credential` object, required

## Response `200`

Successful Response

- WebAuthnEnrolCompleteResponse: Body returned by /auth/mfa/enroll/webauthn/complete. Mirrors :class:`TotpVerifyResponse` — fresh access token to lift a recovery-locked session, plus first-method-only recovery codes.
  - `method_id` integer, required
  - `access_token` string, required
  - `recovery_codes` string[], nullable

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/totalparks/apis/total-parks-public-api.md) · [All operations](https://skmtc.dev/totalparks/apis/total-parks-public-api/llms.txt) · [OpenAPI document](https://skmtc.dev/totalparks/apis/total-parks-public-api/revisions/dcb4c822e2c6?raw)