curl --request POST \
--url https://api.cloud.corbado.io/v1/observe/passkeySearch \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"userIDs": [
"<string>"
],
"status": [],
"limit": 100
}
'import requests
url = "https://api.cloud.corbado.io/v1/observe/passkeySearch"
payload = {
"userIDs": ["<string>"],
"status": [],
"limit": 100
}
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({userIDs: ['<string>'], status: [], limit: 100})
};
fetch('https://api.cloud.corbado.io/v1/observe/passkeySearch', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.cloud.corbado.io/v1/observe/passkeySearch",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'userIDs' => [
'<string>'
],
'status' => [
],
'limit' => 100
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.cloud.corbado.io/v1/observe/passkeySearch"
payload := strings.NewReader("{\n \"userIDs\": [\n \"<string>\"\n ],\n \"status\": [],\n \"limit\": 100\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.cloud.corbado.io/v1/observe/passkeySearch")
.header("Authorization", "Bearer <token>")
.header("Content-Type", "application/json")
.body("{\n \"userIDs\": [\n \"<string>\"\n ],\n \"status\": [],\n \"limit\": 100\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.cloud.corbado.io/v1/observe/passkeySearch")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"userIDs\": [\n \"<string>\"\n ],\n \"status\": [],\n \"limit\": 100\n}"
response = http.request(request)
puts response.read_body[
{
"id": "<string>",
"userID": "<string>",
"credentialID": "<string>",
"transports": [
"<string>"
],
"backupState": true,
"dataStatus": "full-observed",
"status": "created",
"createdMs": 123,
"serialNumber": "<string>",
"type": "passkey",
"discoverable": true,
"attestationFormat": "<string>",
"backupEligible": true,
"aaguid": "<string>",
"aaguidStatus": "estimate-weak",
"createdOnClientEnvID": "<string>"
}
]{
"error": {
"message": "Validation failed",
"details": [
{
"field": "projectID",
"message": "required"
}
]
}
}Search passkeys
Finds observed passkeys for selected Observe users.
Required API key permission: observe:passkeys:read.
curl --request POST \
--url https://api.cloud.corbado.io/v1/observe/passkeySearch \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"userIDs": [
"<string>"
],
"status": [],
"limit": 100
}
'import requests
url = "https://api.cloud.corbado.io/v1/observe/passkeySearch"
payload = {
"userIDs": ["<string>"],
"status": [],
"limit": 100
}
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({userIDs: ['<string>'], status: [], limit: 100})
};
fetch('https://api.cloud.corbado.io/v1/observe/passkeySearch', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.cloud.corbado.io/v1/observe/passkeySearch",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'userIDs' => [
'<string>'
],
'status' => [
],
'limit' => 100
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.cloud.corbado.io/v1/observe/passkeySearch"
payload := strings.NewReader("{\n \"userIDs\": [\n \"<string>\"\n ],\n \"status\": [],\n \"limit\": 100\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.cloud.corbado.io/v1/observe/passkeySearch")
.header("Authorization", "Bearer <token>")
.header("Content-Type", "application/json")
.body("{\n \"userIDs\": [\n \"<string>\"\n ],\n \"status\": [],\n \"limit\": 100\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.cloud.corbado.io/v1/observe/passkeySearch")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"userIDs\": [\n \"<string>\"\n ],\n \"status\": [],\n \"limit\": 100\n}"
response = http.request(request)
puts response.read_body[
{
"id": "<string>",
"userID": "<string>",
"credentialID": "<string>",
"transports": [
"<string>"
],
"backupState": true,
"dataStatus": "full-observed",
"status": "created",
"createdMs": 123,
"serialNumber": "<string>",
"type": "passkey",
"discoverable": true,
"attestationFormat": "<string>",
"backupEligible": true,
"aaguid": "<string>",
"aaguidStatus": "estimate-weak",
"createdOnClientEnvID": "<string>"
}
]{
"error": {
"message": "Validation failed",
"details": [
{
"field": "projectID",
"message": "required"
}
]
}
}Authorizations
Use an Observe API key from the management console. The key selects the project and must grant the permission listed on the operation. Keep this key on your server.
Body
User IDs to fetch passkeys for (format tus-<number>).
Optional passkey statuses to include.
Passkey status.
created, deleted Maximum number of passkeys to return. Defaults to 100, maximum 10000.
1 <= x <= 10000Response
Matching passkeys.
Passkey ID (format tpk-<number>).
User ID (format tus-<number>).
Base64-encoded credential ID.
Transport types.
Whether the passkey is backed up.
Passkey data status.
full-observed, full-patched, partial-login, pre-registered Passkey status.
created, deleted Creation time in milliseconds since epoch.
YubiKey hardware serial number, when available (pre-registered keys only).
Derived credential type, when classified.
passkey, hardware-security-key, non-discoverable-key, u2f-key Whether the credential is discoverable/resident (from credProps.rk at enrollment), when observed.
Attestation statement format at enrollment (e.g. none, packed, fido-u2f, apple, android-key), when observed.
Whether the credential is backup-eligible (BE flag at enrollment), when observed.
AAGUID, when available.
AAGUID status.
estimate-weak, estimate-strong, estimate-authenticator-provided, confirmed-weak, confirmed-strong, unknown Client environment ID where the passkey was created, when available (format tce-<number>).
Was this page helpful?