Skip to main content
GET
List challenge variants

Authorizations

Authorization
string
header
required

Use an Observe API key from the management console. The key selects the project and must grant the permission listed on the operation. Keep this key on your server.

Query Parameters

subFlowType
enum<string>

Filter variants by subflow type.

Available options:
passkey-login,
passkey-enrollment
type
enum<string>

Filter variants by type (request options or response data).

Available options:
request,
response

Response

Challenge variants.

id
string
required

Challenge variant ID (format chv-<number>). The numeric part equals the raw config_variant_id surfaced as the t8 dimension of the login-subflow-passkey-v1 time series.

subFlowType
enum<string>
required

Subflow type the variant belongs to.

Available options:
passkey-login,
passkey-enrollment
type
enum<string>
required

Type of challenge variant (request options or response data).

Available options:
request,
response
data
string
required

JSON-encoded variant data. For passkey-login request variants: allowCredentialCount, timeout, userVerification, hints, authenticatorEstimates (estimated provider names behind the allowlist, e.g. icloud-keychain; absent when the login ran without an allowlist). For passkey-enrollment request variants: excludeCredentialCount, timeout, attestation, authenticatorSelection, hints. Response variants (both subflow types): userPresent, userVerified, backupEligible, backupState (authenticator data flags), signCountZero (the authenticator reported no signature counter), attachment (platform, cross-platform or other; Safari reports platform even for cross-device logins), origin, crossOrigin, topOriginPresent, extensions (names of the returned extension results). Passkey-login response variants add userHandlePresent and inAllowList (whether the used credential was in the served allowlist; absent without an allowlist). Passkey-enrollment response variants add algorithm (COSE name of the created key, e.g. ES256), residentKey (credProps.rk), prfEnabled, transports (response.transports in the reported order; unknown values become other), credProtect (the policy the authenticator applied, e.g. userVerificationRequired) and authenticatorExtensions (names of the authenticator data extension outputs: credProtect, minPinLength, credBlob, hmac-secret, uvm, other). Fields absent from the browser response are omitted.