MFAService
Finish Passkey Challenge
Verify a passkey authentication response for session elevation or fresh step-up.
Request
curl --request POST \ \
--url 'https://api.testnet.polyester.com/v1/auth/mfa/challenges/mfa_11111111111111111111111111111111:finish-passkey' \
--header 'Accept: */*' \
--header 'X-API-KEY-ID: YOUR_API_KEY_ID' \
--header 'X-API-TIMESTAMP: YOUR_API_TIMESTAMP' \
--header 'X-API-SIGNATURE: YOUR_API_SIGNATURE' \
--header 'Content-Type: application/json' \
--data '{
"credential": {
"id": "credential-example",
"response": {
"clientDataJSON": "ZXhhbXBsZS1jbGllbnQtZGF0YQ"
},
"type": "public-key"
}
}'Responses
{
"accessToken": "eyJhbGciOiJFZERTQSJ9.example.signature",
"accessTokenExpiresAt": "2025-01-01T00:00:00Z",
"session": {
"authTime": "2025-01-01T00:00:00Z",
"authenticationMethods": [
"totp"
],
"sessionId": "session_01J0EXAMPLE",
"sessionLevel": "PRIMARY_AUTHENTICATED"
},
"stepUpExpiresAt": "2025-01-01T00:00:00Z",
"stepUpToken": "eyJhbGciOiJFZERTQSJ9.step-up.signature"
}Challenge identifier returned by BeginMFAChallenge.
Passkey authentication response returned by the browser or device authenticator.
Stable session identifier shared by the primary and MFA-elevated tokens.
session_01J0EXAMPLEAssurance level represented by this session response.
PRIMARY_AUTHENTICATEDAuthentication methods used for this session state, such as wallet, TOTP, passkey, or recovery code. Maximum 8 unique values.
["totp"]Time when the session was authenticated or elevated.
2025-01-01T00:00:00ZMFA-elevated session token returned after every successful challenge.
eyJhbGciOiJFZERTQSJ9.example.signatureTime when access_token expires.
2025-01-01T00:00:00ZFresh step-up token returned for fresh step-up challenges. Empty for session-elevation challenges.
eyJhbGciOiJFZERTQSJ9.step-up.signatureTime when step_up_token expires. Empty when no step_up_token is returned.
2025-01-01T00:00:00Z| Key | Status | Error | When |
|---|---|---|---|
| unauthenticated | 401 | Unauthenticated | Authentication required. |
| permission-denied | 403 | Permission Denied | Permission denied. |
| invalid-argument | 400 | Invalid Argument | Invalid argument. |
| not-found | 404 | Not Found | Not found. |
| unavailable | 503 | Unavailable | Service unavailable. |