How AI is applied across API Evangelist and APIs.io. Read my AI disclosure →
API Evangelist API Evangelist
Discovery
Learnings
Guidance
Toolbox
Alignment
API Evangelist LLC
Discovery
Learnings
Guidance
Toolbox
Alignment
API Evangelist LLC

Need help?

Contact us
FusionAuth

FusionAuth Webauthn API

The Webauthn API from FusionAuth — 8 operation(s) for webauthn.

Documentation Provider Profile APIs.io OpenAPI GitHub

FusionAuth Webauthn API is one of 37 APIs that FusionAuth publishes on the APIs.io network, described by a machine-readable OpenAPI specification.

Tagged areas include WebAuthn. The published artifact set on APIs.io includes an OpenAPI specification and API documentation.

This API exposes 10 operations across 8 paths, and defines 56 schemas. It is described by OpenAPI 3.2.0, at version 1.66.0.

Requests are made against 2 base URLs: http://localhost:9011, https://sandbox.fusionauth.io.

10 operations 8 paths 56 schemas 2 DELETE2 GET6 POST

Metadata

The identity and technical contract details declared by the specification.

Specification
OpenAPI 3.2.0
API Version
1.66.0
Base URL
https://sandbox.fusionauth.io
Authentication
API Key, HTTP Bearer
License
Apache2
Resource Areas
1

Authentication & Security 2

FusionAuth Webauthn API declares 2 security schemes for authenticating requests. An API key is passed in the header as Authorization (ApiKeyAuth). It accepts HTTP bearer tokens (JWT) (BearerAuth). By default, every request must be authenticated.

Paths & Operations 10

Across 8 paths, the API surfaces 10 operations — 2 DELETE, 2 GET, 6 POST. Each is listed below with its method, path, parameters, and response codes.

Webauthn 10
DELETE
/api/webauthn
Deletes all of the WebAuthn credentials for the given User Id.
deleteWebAuthnCredentialsForUserWithId 1 param → 200default
GET
/api/webauthn
Retrieves all WebAuthn credentials for the given user.
retrieveWebAuthnCredentialsForUserWithId 1 param → 200default
POST
/api/webauthn/assert
Complete a WebAuthn authentication ceremony by validating the signature against the previously generated challenge without logging the user in
completeWebAuthnAssertionWithId body → 200default
POST
/api/webauthn/import
Import a WebAuthn credential
importWebAuthnCredentialWithId body → 200default
POST
/api/webauthn/login
Complete a WebAuthn authentication ceremony by validating the signature against the previously generated challenge and then login the user in
completeWebAuthnLoginWithId body → 200default
POST
/api/webauthn/register/complete
Complete a WebAuthn registration ceremony by validating the client request and saving the new credential
completeWebAuthnRegistrationWithId body → 200default
POST
/api/webauthn/register/start
Start a WebAuthn registration ceremony by generating a new challenge for the user
startWebAuthnRegistrationWithId body → 200default
POST
/api/webauthn/start
Start a WebAuthn authentication ceremony by generating a new challenge for the user
startWebAuthnLoginWithId body → 200default
DELETE
/api/webauthn/{id}
Deletes the WebAuthn credential for the given Id.
deleteWebAuthnCredentialWithId 1 param → 200default
GET
/api/webauthn/{id}
Retrieves the WebAuthn credential for the given Id.
retrieveWebAuthnCredentialWithId 1 param → 200default

Schemas 56

The contract defines 56 schemas that model the data the API accepts and returns. The most detailed are User (40 properties), LoginResponse (19 properties), WebAuthnCredential (18 properties), UserRegistration (16 properties). Each schema is shown below with its type and property counts.

UserVerificationRequirement
string
Used to express whether the Relying Party requires user verification for the current operation.
WebAuthnAssertResponse
object
API response for completing WebAuthn assertion
1 property
WebAuthnRegisterCompleteResponse
object
API response for completing WebAuthn credential registration or assertion
1 property
WebAuthnStartResponse
object
API response for starting a WebAuthn authentication ceremony
1 property
Errors
object
Standard error domain object that can also be used as the response from an API call.
2 properties
WebAuthnPublicKeyAuthenticationRequest
object
Request to authenticate with WebAuthn
5 properties
User
object
The public, global view of a User. This object contains all global information about the user including birthdate, registration information preferred languages…
40 properties
ContentStatus
string
Status for content like usernames, profile attributes, etc.
WebAuthnCredentialResponse
object
WebAuthn Credential API response
2 properties
UserRegistration
object
User registration information for a single application.
16 properties
MetaData
object
3 properties
AttestationType
string
Used to indicate what type of attestation was included in the authenticator response for a given WebAuthn credential at the time it was created
GroupMember
object
A User's membership into a Group
5 properties
PublicKeyCredentialRequestOptions
object
Provides the authenticator with the data it needs to generate an assertion.
5 properties
WebAuthnAuthenticatorRegistrationResponse
object
The authenticator's response for the registration ceremony in its encoded format
2 properties
UserTwoFactorConfiguration
object
2 properties
AuthenticatorAttachment
string
Describes the authenticator attachment modality .
WebAuthnExtensionsClientOutputs
object
Contains extension output for requested extensions during a WebAuthn ceremony
1 property
WebAuthnAuthenticatorAuthenticationResponse
object
The authenticator's response for the authentication ceremony in its encoded format
4 properties
CredentialPropertiesOutput
object
Contains the output for the {@code credProps} extension
1 property
WebAuthnRegisterStartResponse
object
API response for starting a WebAuthn registration ceremony
1 property
WebAuthnCredentialImportRequest
object
API request to import an existing WebAuthn credential(s)
2 properties
WebAuthnPublicKeyRegistrationRequest
object
Request to register a new public key with WebAuthn
6 properties
CoseAlgorithmIdentifier
string
A number identifying a cryptographic algorithm. Values should be registered with the IANA COSE Algorithms registry
BreachedPasswordStatus
string
LoginResponse
object
19 properties
Locale
string
A Locale object represents a specific geographical, political, or cultural region.
ZonedDateTime
integer
The number of milliseconds since the unix epoch: January 1, 1970 00:00:00 UTC. This value is always in UTC.
DeviceInfo
object
5 properties
UserIdentity
object
11 properties
WebAuthnWorkflow
string
Identifies the WebAuthn workflow. This will affect the parameters used for credential creation and request based on the Tenant configuration.
WebAuthnRegistrationExtensionOptions
object
Options to request extensions during credential registration
1 property
WebAuthnRegisterStartRequest
object
API request to start a WebAuthn registration ceremony
5 properties
Error
object
Defines an error.
3 properties
ZoneId
string
Timezone Identifier
LocalDate
string
A date without a time-zone in the ISO-8601 calendar system, such as 2007-12-03.
PublicKeyCredentialUserEntity
object
Supply additional information about the user account when creating a new credential
3 properties
PublicKeyCredentialType
string
Defines valid credential types. This is an extension point in the WebAuthn spec. The only defined value at this time is "public-key"
PublicKeyCredentialRelyingPartyEntity
object
Supply additional information about the Relying Party when creating a new credential
2 properties
AttestationConveyancePreference
string
Used to communicate whether and how authenticator attestation should be delivered to the Relying Party
PublicKeyCredentialParameters
object
Supply information on credential type and algorithm to the authenticator .
2 properties
TOTPAlgorithm
string
LoginPreventedResponse
object
The summary of the action that is preventing login to be returned on the login response.
10 properties
AuthenticatorSelectionCriteria
object
Used by the Relying Party to specify their requirements for authenticator attributes. Fields use the deprecated "resident key" terminology to refer to client-s…
4 properties
WebAuthnCredential
object
A User's WebAuthnCredential. Contains all data required to complete WebAuthn authentication ceremonies.
18 properties
IdentityType
object
Model identity types provided by FusionAuth.
1 property
AuthenticatorConfiguration
object
3 properties
PublicKeyCredentialCreationOptions
object
Allows the Relying Party to specify desired attributes of a new credential.
9 properties
ChangePasswordReason
string
PublicKeyCredentialDescriptor
object
Contains attributes for the Relying Party to refer to an existing public key credential as an input parameter.
3 properties
WebAuthnRegisterCompleteRequest
object
Request to complete the WebAuthn registration ceremony for a new credential,.
4 properties
WebAuthnLoginRequest
object
Request to complete the WebAuthn registration ceremony
9 properties
TwoFactorMethod
object
7 properties
WebAuthnStartRequest
object
API request to start a WebAuthn authentication ceremony
7 properties
IdentityVerifiedReason
string
Models the reason that {@link UserIdentityverified} was set to true or false.
ResidentKeyRequirement
string
Describes the Relying Party's requirements for client-side discoverable credentials (formerly known as "resident keys")

Specification

The full machine-readable OpenAPI contract behind this narrative.

Source

fusionauth-webauthn-api-openapi.yml Raw ↑

Other APIs FusionAuth publishes across the network.

FusionAuth Api Key API
AE Profile APIs.io
FusionAuth Application API
AE Profile APIs.io
FusionAuth Connector API
AE Profile APIs.io
FusionAuth Consent API
AE Profile APIs.io
FusionAuth Email API
AE Profile APIs.io
FusionAuth Entity API
AE Profile APIs.io
FusionAuth Form API
AE Profile APIs.io
FusionAuth Group API
AE Profile APIs.io
FusionAuth Health API
AE Profile APIs.io
FusionAuth Identity API
AE Profile APIs.io
FusionAuth Identity Provider API
AE Profile APIs.io
FusionAuth Integration API
AE Profile APIs.io
#WebAuthn
← Back to F APIs
API Details
ID
fusionauth:fusionauth-webauthn-api
Base URL
https://sandbox.fusionauth.io
Docs
https://fusionauth.io/docs/
Provider
FusionAuth
APIs.io →  GitHub →
Explore more
All APIs Providers APIs.io Network
Work with this as data

Every API here is available over the API and to AI agents over MCP. APIs is not yet its own endpoint on the v1 API. Reach this content through network search and the tag graph, or the MCP server below.

Installs https://mcp.apievangelist.com/mcp in Claude, Cursor, VS Code and the rest — one button, every client.

MCP tools for apis
4 tools reach this content
  • search_api_evangelistSearch every content type across the network at once.
  • find_relatedThe shared-tag relevance graph — what else covers this.
  • get_tagEverything one tag labels, across all content types.
  • guide_topicPRO — a curated bundle for a topic: area, guidance, rules, papers, stories, services.
All tools & prompts
Call it yourself
curl for this page
Search the network for this 
curl "https://api.apievangelist.com/v1/search?q=fusionauth-webauthn-api&limit=10"
Everything under a tag 
curl "https://api.apievangelist.com/v1/tags/fusionauth-webauthn-api"

Discovery needs no key. Full bodies and the synthesis endpoints are Pro.

Get an API key

Free tier, no email required. Sign in with whichever identity you already have.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have. Your account

Where this information came from

This is an independent, third-party profile of FusionAuth Webauthn API, published by API Evangelist. We do not operate, host, resell, or support these APIs, and we are not affiliated with or endorsed by the company unless stated above. Everything here is built from publicly available information — the company's own site, developer portal, documentation, public repositories, and the specifications it publishes for public use. Nothing is obtained by breaching a system, defeating an access control, or using credentials.

The Kin Score and Agent Readiness rating are independently calculated assessments of a company's public API artifacts, scored against a published rubric. They are not certifications, endorsements, security assessments, or audits.

Corrections, re-scores, and removal are free — no partnership or purchase required, and you do not need to justify the request. A removed company is recorded as unrated, never scored zero for having asked. Acknowledgement within one business day; removal within two.

info@apievangelist.com · Read the full data-sourcing policy →
On a security or compliance team? Put security in the subject line and you will get a person, not a form — we will tell you exactly which public URLs this profile was built from.