---
title: "Complete Authentication"
method: POST
path: "/auth/mfa/webauthn/authenticate/verify"
tags: ["auth"]
---

# Complete Authentication

`POST /auth/mfa/webauthn/authenticate/verify`

## Request

- Base URL: `https://platform.tracecat.com/api`
- URL: `https://platform.tracecat.com/api/auth/mfa/webauthn/authenticate/verify`
- Auth: none declared

Verify a security key. Satisfies both the sign-in challenge and step-up.

## Request body

- WebAuthnAuthenticationVerify
  - `credential` object, required: PublicKeyCredential.toJSON() output from navigator.credentials.get().

## Response `200`

Successful Response

- MfaStatusRead
  - `state` 'not_required' | 'verified' | 'challenge_required' | 'enrollment_required', required
  - `has_credentials` boolean, required
  - `required_by_policy` boolean, required
  - `webauthn_available` boolean, required
  - `webauthn_unavailable_reason` string, nullable
  - `recovery_codes_remaining` integer, required
  - `step_up_expires_at` string, date-time, nullable: When the current step-up verification stops satisfying checks.

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/tracecat/apis/tracecat-api.md) - [All operations](https://skmtc.dev/tracecat/apis/tracecat-api/llms.txt) - [OpenAPI document](https://skmtc.dev/tracecat/apis/tracecat-api/revisions/2efdda25045f?raw)