List user passkeys

Outcome

List sanitized stored passkey metadata for one visible user; no sign-in ceremony is proven.

These examples prove local handler behavior with real isolated SQL and explicitly simulated identity/permission dependencies.

Before you start

• Verify the intended authenticated identity and the current credential-scoped action before preparing input. Self and managed-user security operations have different authority; a credential row id does not authorize a different user.

• Use authorized identity and user/session discovery. Recovery security data and session/device identifiers must remain inside the caller-approved workflow.

Discover the target

topolo whoami --json
topolo apps --json
topolo actions get app_topolo_auth.user_passkeys.list --detail --json

Use the caller subject or an authorized managed user from discovery. Read user_passkeys.list and copy credentials[].id for that exact user; credentialId is the WebAuthn identifier. Read user_security.get separately and inspect passkeyError.

Input fields

Effects

• Reads sanitized stored passkey metadata for self or an authorized managed user; no authentication ceremony is performed.

Interpret the response

HTTP 200 raw target responses use success/message/data/timestamp; CLI/MCP may wrap or project them. Record timestamps are epoch seconds and the envelope timestamp is ISO text. These handlers prefer the access cookie when present, then Bearer. Fixture identity and target lookup are simulated; stored WebAuthn credentials are unusable and no real browser/authenticator ceremony or sign-in is proven.

credentials are sanitized stored rows ordered by createdAt descending, without pagination or continuation. count is this returned list length. id is the internal row used by deletion; credentialId is the WebAuthn identifier. friendlyName/deviceType/lastUsed can be null. Public-key material, signature counter and other raw repository fields are omitted.

An empty list means no stored passkey rows at the successful read, not that password, provider or recovery sign-in is usable. Missing target returns NOT_FOUND and repository read errors return SERVER_ERROR; foreign-user authority denial returns AUTH_ERROR even for an authenticated caller.

Worked examples

These are complete raw target-handler responses, not CLI/gateway envelopes or live authorization proof. Replace synthetic identifiers using authorized discovery. Save only the reviewed input as payload.json; inspect validation and plan before executing. --confirm assumes the intended operation is approved. Storage read-back and actual sign-in outcomes require separate verification. Deleting a stored passkey does not clear the physical authenticator or existing Auth sessions. An alternate sign-in method and notification delivery require separate verification. Cookies and Bearer tokens must identify the intended principal consistently.

Passkeys are sanitized and ordered newest first

Input · payload.json:

{
  "userId": "usr_self"
}

CLI:

topolo actions validate app_topolo_auth.user_passkeys.list --data @payload.json --json
topolo actions plan app_topolo_auth.user_passkeys.list --data @payload.json --json
topolo actions call app_topolo_auth.user_passkeys.list --data @payload.json --json

MCP call after validation and plan review:

{
  "tool": "topolo_read_action",
  "arguments": {
    "actionId": "app_topolo_auth.user_passkeys.list",
    "input": {
      "userId": "usr_self"
    }
  }
}

Captured local handler response · HTTP 200:

{
  "success": true,
  "message": "Passkey credentials retrieved successfully",
  "data": {
    "credentials": [
      {
        "id": "passkey_second",
        "credentialId": "unusable-webauthn-id-passkey_second",
        "friendlyName": null,
        "deviceType": "unknown",
        "createdAt": 2,
        "lastUsed": null
      },
      {
        "id": "passkey_first",
        "credentialId": "unusable-webauthn-id-passkey_first",
        "friendlyName": "Fixture laptop",
        "deviceType": "unknown",
        "createdAt": 1,
        "lastUsed": null
      }
    ],
    "count": 2
  },
  "timestamp": "2026-10-02T00:00:00.000Z"
}

Organization admin reads the selected managed user credentials

Input · payload.json:

{
  "userId": "usr_managed"
}

CLI:

topolo actions validate app_topolo_auth.user_passkeys.list --data @payload.json --json
topolo actions plan app_topolo_auth.user_passkeys.list --data @payload.json --json
topolo actions call app_topolo_auth.user_passkeys.list --data @payload.json --json

MCP call after validation and plan review:

{
  "tool": "topolo_read_action",
  "arguments": {
    "actionId": "app_topolo_auth.user_passkeys.list",
    "input": {
      "userId": "usr_managed"
    }
  }
}

Captured local handler response · HTTP 200:

{
  "success": true,
  "message": "Passkey credentials retrieved successfully",
  "data": {
    "credentials": [
      {
        "id": "passkey_managed",
        "credentialId": "unusable-webauthn-id-passkey_managed",
        "friendlyName": null,
        "deviceType": "unknown",
        "createdAt": 1,
        "lastUsed": null
      }
    ],
    "count": 1
  },
  "timestamp": "2026-10-02T00:00:00.000Z"
}

Read after deletion retains the other credential

Input · payload.json:

{
  "userId": "usr_self"
}

CLI:

topolo actions validate app_topolo_auth.user_passkeys.list --data @payload.json --json
topolo actions plan app_topolo_auth.user_passkeys.list --data @payload.json --json
topolo actions call app_topolo_auth.user_passkeys.list --data @payload.json --json

MCP call after validation and plan review:

{
  "tool": "topolo_read_action",
  "arguments": {
    "actionId": "app_topolo_auth.user_passkeys.list",
    "input": {
      "userId": "usr_self"
    }
  }
}

Captured local handler response · HTTP 200:

{
  "success": true,
  "message": "Passkey credentials retrieved successfully",
  "data": {
    "credentials": [
      {
        "id": "passkey_second",
        "credentialId": "unusable-webauthn-id-passkey_second",
        "friendlyName": null,
        "deviceType": "unknown",
        "createdAt": 2,
        "lastUsed": null
      }
    ],
    "count": 1
  },
  "timestamp": "2026-10-02T00:00:00.000Z"
}

No remaining passkey row does not prove another sign-in route is available

Input · payload.json:

{
  "userId": "usr_managed"
}

CLI:

topolo actions validate app_topolo_auth.user_passkeys.list --data @payload.json --json
topolo actions plan app_topolo_auth.user_passkeys.list --data @payload.json --json
topolo actions call app_topolo_auth.user_passkeys.list --data @payload.json --json

MCP call after validation and plan review:

{
  "tool": "topolo_read_action",
  "arguments": {
    "actionId": "app_topolo_auth.user_passkeys.list",
    "input": {
      "userId": "usr_managed"
    }
  }
}

Captured local handler response · HTTP 200:

{
  "success": true,
  "message": "Passkey credentials retrieved successfully",
  "data": {
    "credentials": [],
    "count": 0
  },
  "timestamp": "2026-10-02T00:00:00.000Z"
}

Verify the result

• Require count to equal credentials length and retain each internal id with the exact selected user. Keep credentialId separate from the deletion row id.

• Verify another approved working sign-in method before reviewing any credential removal. A list or security presence flag cannot prove that alternate route is usable.

Errors and recovery

Foreign organization credential discovery is refused

Captured local refusal · HTTP 401:

{
  "input": {
    "userId": "usr_foreign"
  },
  "response": {
    "success": false,
    "error": {
      "message": "Access denied: You can only view your own passkeys",
      "code": "AUTH_ERROR",
      "details": null,
      "timestamp": "2026-10-02T00:00:00.000Z"
    }
  }
}

Missing passkey user is not an empty credential list

Captured local refusal · HTTP 404:

{
  "input": {
    "userId": "usr_missing"
  },
  "response": {
    "success": false,
    "error": {
      "message": "User not found",
      "code": "NOT_FOUND",
      "details": null,
      "timestamp": "2026-10-02T00:00:00.000Z"
    }
  }
}

Anonymous credential list is refused

Captured local refusal · HTTP 401:

{
  "input": {
    "userId": "usr_self"
  },
  "response": {
    "success": false,
    "error": {
      "message": "Access token required",
      "code": "AUTH_ERROR",
      "details": null,
      "timestamp": "2026-10-02T00:00:00.000Z"
    }
  }
}

Credential SQL list failure is a server error

Captured local refusal · HTTP 500:

{
  "input": {
    "userId": "usr_self"
  },
  "response": {
    "success": false,
    "error": {
      "message": "Isolated passkey list SQL failure",
      "code": "SERVER_ERROR",
      "details": null,
      "timestamp": "2026-10-02T00:00:00.000Z"
    }
  }
}

Published recovery guidance

• AUTH_ERROR (HTTP 401): Verify the intended identity and cookie/Bearer transport, exact target-user authority and credential ownership. Authenticated authority/ownership denial also uses 401; do not infer OAuth expiry or switch contexts automatically.

• NOT_FOUND (HTTP 404): Refresh authorized user/credential discovery. Missing target or already-deleted credential is not a new successful deletion; do not substitute a WebAuthn credentialId for the internal row id.

• SERVER_ERROR (HTTP 500): Preserve the original error, verify approved authentication and rediscover current credential/security state before reviewing any retry. Do not treat storage failure or passkeyError as proof of zero credentials.

Recovery boundaries

Read-only. Preserve credential metadata inside the intended user security workflow and refresh after a separately approved registration/removal.

Discovery and evidence

This record belongs to app_topolo_auth. Local tests prove real canonical security/passkey SQL, target-user authority and credential ownership with simulated tokens and identity lookup. Stored WebAuthn credentials are unusable and notifications are unconfigured. They do not prove live permissions, authenticator ceremony, successful alternate sign-in, delivered notification, deployment or production completion.