Table of Contents

API : Passkey Credentials

Introduction

Self-service management of the currently logged in employee's own passkeys. All three endpoints are authenticated and operate only on credentials owned by req.user._id - see webauthn for the admin-facing equivalent on someone else's account.

List

Lists the employee's own credentials across every relying party, so e.g. the portal can show “you also have a passkey for Communicator”.

URL https://api.telecomx.dk/auth/webauthn/credentials
Method GET
Header Authorization String Bearer token

Response

Property Type Description
credentials Array The employee's credentials, newest first
credentials[].\_id String
credentials[].name String User-editable label
credentials[].rpId String Relying party this credential was created for
credentials[].deviceType String singleDevice or multiDevice
credentials[].backedUp Boolean True if backed up to a cloud keychain
credentials[].createdAt Date
credentials[].lastUsedAt Date, null Null if never used to log in

Example

{
  credentials: [
    {
      _id: '66a1b2c3d4e5f6a7b8c9d0e1',
      name: 'MacBook Pro',
      rpId: 'telecomx.dk',
      deviceType: 'multiDevice',
      backedUp: true,
      createdAt: '2026-08-31T10:00:00.000Z',
      lastUsedAt: '2026-08-31T14:22:00.000Z'
    }
  ]
}

Rename

URL https://api.telecomx.dk/auth/webauthn/credentials/<credential-id>
Method PATCH
Header Authorization String Bearer token
Body JSON object
name String Required, 1-60 characters (trimmed)

Body example

{ name: 'Work laptop' }

Response

{ success: true }

Errors

Error code Message Description
404 credential Credential does not exist, or belongs to another employee

Delete

URL https://api.telecomx.dk/auth/webauthn/credentials/<credential-id>
Method DELETE
Header Authorization String Bearer token

Response

{ success: true }

Errors

Error code Message Description
404 credential Credential does not exist, or belongs to another employee
422 last_credential Refused - this is the last passkey for this credential's relying party on an account with webauthnOnly set

The “last credential” check is scoped to the relying party (rpId) of the credential being deleted, not to the employee's credentials overall. An employee with one passkey on telecomx.dk and one on a reseller portal with a different rpId can still be blocked from deleting the telecomx.dk one, even though they would still hold a passkey afterwards - it just would not work on that relying party.