curl --request POST \
--url https://api.cloud.corbado.io/v1/observe/passkeyCohort \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"fromMs": 123,
"toMs": 123,
"maxGroupSize": 123
}
'import requests
url = "https://api.cloud.corbado.io/v1/observe/passkeyCohort"
payload = {
"fromMs": 123,
"toMs": 123,
"maxGroupSize": 123
}
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({fromMs: 123, toMs: 123, maxGroupSize: 123})
};
fetch('https://api.cloud.corbado.io/v1/observe/passkeyCohort', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.cloud.corbado.io/v1/observe/passkeyCohort",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'fromMs' => 123,
'toMs' => 123,
'maxGroupSize' => 123
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.cloud.corbado.io/v1/observe/passkeyCohort"
payload := strings.NewReader("{\n \"fromMs\": 123,\n \"toMs\": 123,\n \"maxGroupSize\": 123\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.cloud.corbado.io/v1/observe/passkeyCohort")
.header("Authorization", "Bearer <token>")
.header("Content-Type", "application/json")
.body("{\n \"fromMs\": 123,\n \"toMs\": 123,\n \"maxGroupSize\": 123\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.cloud.corbado.io/v1/observe/passkeyCohort")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"fromMs\": 123,\n \"toMs\": 123,\n \"maxGroupSize\": 123\n}"
response = http.request(request)
puts response.read_body[
{
"userID": "<string>",
"createdMs": 123,
"passkeys": [
{
"credentialID": "<string>",
"dataStatus": "<string>",
"transports": [
"<string>"
],
"backupState": true,
"createdMs": 123,
"type": "passkey",
"authenticatorClass": "security-key",
"aaguid": "<string>",
"aaguidStatus": "<string>"
}
],
"passkeyLogin": {
"total": 123,
"completed": 123,
"errored": 123,
"firstCompletedMs": 123
},
"passkeyEnrollment": {
"total": 123,
"completed": 123,
"errored": 123,
"firstCompletedMs": 123
},
"passkeyEnrollmentFlow": {
"complete": 123,
"skipped": 123,
"invisible": 123
},
"externalID": "<string>"
}
]{
"error": {
"message": "Validation failed",
"details": [
{
"field": "projectID",
"message": "required"
}
]
}
}List passkey behaviour for a user cohort
Returns a raw (non-aggregated) per-user list of passkey behaviour for a cohort of confirmed users defined by creation time window (fromMs/toMs) and capped at maxGroupSize. Each entry carries the user’s passkeys plus compact passkey login/enrollment outcome summaries, so the caller can categorise passkey enablement client-side. Scoped to the project of the bearer token.
Required API key permission: observe:passkeys:read.
curl --request POST \
--url https://api.cloud.corbado.io/v1/observe/passkeyCohort \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"fromMs": 123,
"toMs": 123,
"maxGroupSize": 123
}
'import requests
url = "https://api.cloud.corbado.io/v1/observe/passkeyCohort"
payload = {
"fromMs": 123,
"toMs": 123,
"maxGroupSize": 123
}
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({fromMs: 123, toMs: 123, maxGroupSize: 123})
};
fetch('https://api.cloud.corbado.io/v1/observe/passkeyCohort', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.cloud.corbado.io/v1/observe/passkeyCohort",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'fromMs' => 123,
'toMs' => 123,
'maxGroupSize' => 123
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.cloud.corbado.io/v1/observe/passkeyCohort"
payload := strings.NewReader("{\n \"fromMs\": 123,\n \"toMs\": 123,\n \"maxGroupSize\": 123\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.cloud.corbado.io/v1/observe/passkeyCohort")
.header("Authorization", "Bearer <token>")
.header("Content-Type", "application/json")
.body("{\n \"fromMs\": 123,\n \"toMs\": 123,\n \"maxGroupSize\": 123\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.cloud.corbado.io/v1/observe/passkeyCohort")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"fromMs\": 123,\n \"toMs\": 123,\n \"maxGroupSize\": 123\n}"
response = http.request(request)
puts response.read_body[
{
"userID": "<string>",
"createdMs": 123,
"passkeys": [
{
"credentialID": "<string>",
"dataStatus": "<string>",
"transports": [
"<string>"
],
"backupState": true,
"createdMs": 123,
"type": "passkey",
"authenticatorClass": "security-key",
"aaguid": "<string>",
"aaguidStatus": "<string>"
}
],
"passkeyLogin": {
"total": 123,
"completed": 123,
"errored": 123,
"firstCompletedMs": 123
},
"passkeyEnrollment": {
"total": 123,
"completed": 123,
"errored": 123,
"firstCompletedMs": 123
},
"passkeyEnrollmentFlow": {
"complete": 123,
"skipped": 123,
"invisible": 123
},
"externalID": "<string>"
}
]{
"error": {
"message": "Validation failed",
"details": [
{
"field": "projectID",
"message": "required"
}
]
}
}Authorizations
Use an Observe API key from the management console. The key selects the project and must grant the permission listed on the operation. Keep this key on your server.
Body
Cohort lower bound — users created at or after this epoch-ms timestamp
Cohort upper bound — users created strictly before this epoch-ms timestamp
Maximum number of users to return (newest first)
Optional credential-class filter, applied after the user limit. Returns matching holders and credentials from the capped user cohort; matching holders outside that cohort are omitted. Activity includes only subflows linked to those credentials; unlinked attempts and enrollment-flow summaries are excluded. Omit for the existing all-credentials user cohort.
security-key, synced-passkey, device-bound-passkey, unknown Response
Per-user passkey behaviour list for the cohort
Was this page helpful?