Skip to main content
POST
Search passkeys

Authorizations

Authorization
string
header
required

Use an Observe API key from the management console. The key selects the project and must grant the permission listed on the operation. Keep this key on your server.

Body

application/json
userIDs
string[]
required

User IDs to fetch passkeys for (format tus-<number>).

status
enum<string>[]

Optional passkey statuses to include.

Passkey status.

Available options:
created,
deleted
limit
integer
default:100

Maximum number of passkeys to return. Defaults to 100, maximum 10000.

Required range: 1 <= x <= 10000

Response

Matching passkeys.

id
string
required

Passkey ID (format tpk-<number>).

userID
string
required

User ID (format tus-<number>).

credentialID
string
required

Base64-encoded credential ID.

transports
string[]
required

Transport types.

backupState
boolean
required

Whether the passkey is backed up.

dataStatus
enum<string>
required

Passkey data status.

Available options:
full-observed,
full-patched,
partial-login,
pre-registered
status
enum<string>
required

Passkey status.

Available options:
created,
deleted
createdMs
integer<int64>
required

Creation time in milliseconds since epoch.

serialNumber
string

YubiKey hardware serial number, when available (pre-registered keys only).

type
enum<string>

Derived credential type, when classified.

Available options:
passkey,
hardware-security-key,
non-discoverable-key,
u2f-key
discoverable
boolean

Whether the credential is discoverable/resident (from credProps.rk at enrollment), when observed.

attestationFormat
string

Attestation statement format at enrollment (e.g. none, packed, fido-u2f, apple, android-key), when observed.

backupEligible
boolean

Whether the credential is backup-eligible (BE flag at enrollment), when observed.

aaguid
string

AAGUID, when available.

aaguidStatus
enum<string>

AAGUID status.

Available options:
estimate-weak,
estimate-strong,
estimate-authenticator-provided,
confirmed-weak,
confirmed-strong,
unknown
createdOnClientEnvID
string

Client environment ID where the passkey was created, when available (format tce-<number>).