Users

Delete

Deletes one of the authenticated user's own passkeys. The request body carries a WebAuthn assertion from the passkey being deleted, so possession of the credential is proven before it is removed: mint a deletion challenge for it first, run the ceremony with that passkey, and send the result here. Deleting the user's last passkey is allowed — their other step-up factors remain. Requires a user session.

delete/users/me/passkeys/{id}

Request body

authenticator_datastring required

The authenticatorData from the WebAuthn assertion, base64url-encoded.

client_data_jsonstring required

The clientDataJSON from the WebAuthn assertion, base64url-encoded.

signaturestring required

The signature from the WebAuthn assertion, base64url-encoded.

Example request

{
  "authenticator_data": "YXV0aGVudGljYXRvci1kYXRh",
  "client_data_json": "Y2xpZW50LWRhdGE",
  "signature": "c2lnbmF0dXJl"
}

Response

passkey deleted

deletedboolean required

Always true: the passkey was removed.

idstring required

The ID of the deleted passkey.

Example response

{
  "deleted": true,
  "id": "wcred_xxxxxxxxxxxxxx"
}

Changes

Changed in 2 of the 74 revisions of this API.5

    • ○

      added the optional property / to the response with the status

      response-optional-property-added

    • ○

      added the optional property / to the response with the status

      response-optional-property-added

    • ○

      added the optional property / to the response with the status

      response-optional-property-added

    • ○

      added the optional property / to the response with the status

      response-optional-property-added

    This revision also has 9 changes that name no endpoint, such as unreferenced schemas being removed. See the revision's changelog

    • ○

      endpoint added

      endpoint-added

    This revision also has 4 changes that name no endpoint, such as unreferenced schemas being removed. See the revision's changelog

Of the 74 revisions, 1 has no diff computed.