Passkeys
Add, rename and remove the passkeys you sign in with.
x-api-key<token>A service key (nvs_...) in the x-api-key header. A service key belongs to one organization: an X-Org-Id header is optional and, when sent, must name that organization. This header also accepts any credential the bearer scheme does, and when a request sends both headers, this one is used.
The calling user's own passkeys, oldest first. Empty while Nuvelics staff act in your organization
application/json- response
items*array<>curl -X GET 'https://api.nuvelics.com/api/tenant/v1/me/passkeys'{ "items": [ { "id": "string", "nickname": "string", "transports": [ "string" ], "createdAt": "2019-08-24T14:15:22Z", "lastUsedAt": "2019-08-24T14:15:22Z" } ]}x-api-key<token>A service key (nvs_...) in the x-api-key header. A service key belongs to one organization: an X-Org-Id header is optional and, when sent, must name that organization. This header also accepts any credential the bearer scheme does, and when a request sends both headers, this one is used.
application/json- body
challengeToken*stringThe token the registration-options call returned
1 <= length <= 2048response*nickname?stringA label for this passkey. When omitted or blank it is named after the browser and system in the request's user agent ("Chrome on macOS"), or "Passkey" when that says nothing recognisable
length <= 64The passkey, stored and recorded as passkey.added in the active organization
application/json- response
id*stringThe passkey's own id -- what a remove request targets
^[0-7][0-9A-HJKMNP-TV-Z]{25}$nickname*stringThe passkey's label: the one the user gave or renamed it to, else the browser and system that created it ("Chrome on macOS"), else "Passkey"
transports*array<string>How the browser can reach the authenticator (internal, hybrid, usb, nfc, ble), as it reported at registration
createdAt*stringISO 8601 timestamp of when this passkey was added
date-timelastUsedAt*stringISO 8601 timestamp of the last sign-in with this passkey, or null if never
date-timecurl -X POST 'https://api.nuvelics.com/api/tenant/v1/me/passkeys' \ -H 'Content-Type: application/json' \ -d '{ "challengeToken": "string", "response": { "id": "string", "rawId": "string", "type": "public-key", "response": { "clientDataJSON": "string", "attestationObject": "string", "property1": null, "property2": null }, "clientExtensionResults": { "property1": null, "property2": null }, "property1": null, "property2": null }}'{ "id": "string", "nickname": "string", "transports": [ "string" ], "createdAt": "2019-08-24T14:15:22Z", "lastUsedAt": "2019-08-24T14:15:22Z"}x-api-key<token>A service key (nvs_...) in the x-api-key header. A service key belongs to one organization: an X-Org-Id header is optional and, when sent, must name that organization. This header also accepts any credential the bearer scheme does, and when a request sends both headers, this one is used.
WebAuthn creation options for a discoverable passkey, plus the two-minute token the registration call must hand back
application/json- response
options*challengeToken*stringSigned, two-minute token vouching for the options' challenge and the caller it was issued to. The web app keeps it in an httpOnly cookie and hands it back with the browser's response
curl -X POST 'https://api.nuvelics.com/api/tenant/v1/me/passkeys/registration-options'{ "options": { "challenge": "string", "rp": { "id": "string", "name": "string", "property1": null, "property2": null }, "user": { "id": "string", "name": "string", "displayName": "string", "property1": null, "property2": null }, "pubKeyCredParams": [ { "type": "string", "alg": 0, "property1": null, "property2": null } ], "excludeCredentials": [ { "id": "string", "type": "string", "property1": null, "property2": null } ], "property1": null, "property2": null }, "challengeToken": "string"}x-api-key<token>A service key (nvs_...) in the x-api-key header. A service key belongs to one organization: an X-Org-Id header is optional and, when sent, must name that organization. This header also accepts any credential the bearer scheme does, and when a request sends both headers, this one is used.
id*stringUUID v7, base32-encoded (26 Crockford chars)
^[0-7][0-9A-HJKMNP-TV-Z]{25}$application/json- body
nickname*stringThe passkey's new label, 1 to 64 characters after trimming
1 <= length <= 64The renamed passkey, recorded as passkey.renamed in the active organization (no event when the name is unchanged)
application/json- response
id*stringThe passkey's own id -- what a remove request targets
^[0-7][0-9A-HJKMNP-TV-Z]{25}$nickname*stringThe passkey's label: the one the user gave or renamed it to, else the browser and system that created it ("Chrome on macOS"), else "Passkey"
transports*array<string>How the browser can reach the authenticator (internal, hybrid, usb, nfc, ble), as it reported at registration
createdAt*stringISO 8601 timestamp of when this passkey was added
date-timelastUsedAt*stringISO 8601 timestamp of the last sign-in with this passkey, or null if never
date-timecurl -X PATCH 'https://api.nuvelics.com/api/tenant/v1/me/passkeys/string' \ -H 'Content-Type: application/json' \ -d '{ "nickname": "string"}'{ "id": "string", "nickname": "string", "transports": [ "string" ], "createdAt": "2019-08-24T14:15:22Z", "lastUsedAt": "2019-08-24T14:15:22Z"}x-api-key<token>A service key (nvs_...) in the x-api-key header. A service key belongs to one organization: an X-Org-Id header is optional and, when sent, must name that organization. This header also accepts any credential the bearer scheme does, and when a request sends both headers, this one is used.
id*stringUUID v7, base32-encoded (26 Crockford chars)
^[0-7][0-9A-HJKMNP-TV-Z]{25}$Removed, and recorded as passkey.removed in the active organization
curl -X DELETE 'https://api.nuvelics.com/api/tenant/v1/me/passkeys/string'