Complete passkey registration

Claim one exact-user challenge and verify/store public attestation; failures may consume the challenge before storage.

Outcome

Claim one exact-user challenge and verify/store public attestation; failures may consume the challenge before storage.

These examples prove local handler behavior with real isolated WebAuthn/core-session SQL and explicitly synthetic identity/key dependencies.

Before you start

Verify pinned identity, the published users:write action permission and exact target management authority. Cookie identity precedes Bearer identity; a handler-local self success is not proof of live gateway permission.
Use the intended private browser/authenticator registration ceremony for these exact returned options. CLI/MCP can obtain and submit public ceremony JSON but cannot manufacture human presence or user verification. Never copy a synthetic fixture credential into a real enrollment.
Retain the exact target, options and challengeId across begin/complete. Each challenge expires after 300 seconds and verification consumes it before crypto/storage; a failed or unknown completion requires reading current passkeys before separately approving a fresh ceremony.

Discover the target

topolo whoami --json
topolo apps --json
topolo actions get app_topolo_auth.user_passkeys.registration.complete --detail --json

Resolve the exact authorized user, read user_passkeys.list for that target, and inspect the returned registration options/challengeId. Keep internal stored credential ids separate from public WebAuthn credential ids. Use the intended user/browser authenticator response for those exact options.

Input fields

Field	Required	Meaning
`userId`	Yes	Existing exact user from authorized Auth discovery. The handler allows self sub/userId or target-organization management authority; the published action permission and gateway authorization still apply. Cookie identity precedes Bearer identity. Begin and complete must retain this same target.
`credential`	Yes	Complete public WebAuthn RegistrationResponseJSON produced by the intended browser/authenticator for these exact returned options. It contains id/rawId, type public-key, response.clientDataJSON and response.attestationObject, with clientExtensionResults. Never fabricate a live authenticator response or send a private key. Server verification uses the saved challenge, origin and RP, not caller claims.
`challengeId`	Yes	Opaque record id returned by registration.begin, distinct from options.challenge. It is bound to the exact user and registration ceremony, expires after 300 seconds and can be consumed once. Wrong attestation or later storage failure burns the claim. Releasing a local secret reference does not cancel this server record.
`friendlyName`	No	Optional nonempty label for the stored credential. If omitted the server derives a label from the user agent/device type. It is metadata, not proof of the actual device or a globally unique credential identifier.

Effects

Claims one exact-user registration challenge before cryptographic verification and credential storage; later failure may leave it consumed.
Stores only verified WebAuthn material and returns actual target/internal credential identifiers; notification and audit are nonfatal.

Interpret the response

Consumes the exact-user registration challenge before verifying the public attestation against its saved challenge/origin/RP. A malformed/wrong-origin response or later credential storage failure consumes that challenge; a corrected response cannot reuse it. Expired, missing, already-used or another-user challenge is refused. Read current credentials before separately approving a fresh ceremony after an unknown outcome.

Successful data identifies the actual target userId and internal stored credential row id, friendly name, device type and epoch-second createdAt. The internal id is used by passkey deletion; the public WebAuthn credential id is available through user_passkeys.list. Public key material and the signature counter are not returned by this acknowledgment. Existing credentials remain.

Storage uses the cryptographically verified credential/public key and global credential-id uniqueness. A duplicate can fail after challenge claim. Audit and lifecycle notifications are nonfatal. A successful registration acknowledgment does not prove subsequent passkey sign-in, notification delivery, physical device ownership or recovery availability; verify the normal approved sign-in journey independently.

Worked examples

These complete raw target-handler responses use real isolated WebAuthn cryptographic verification and canonical SQL with synthetic identities and locally constructed public authenticator responses. No private key is captured. These expired fixture challenges and public credentials authorize no live enrollment. CLI/MCP payloads show the declared shape and require current discovery, an approved human browser ceremony and review of the exact unchanged plan. Local handler proof does not establish gateway parity or browser sign-in.

Verify public synthetic attestation against the stored challenge and persist one credential

Input · payload.json:

{
  "userId": "usr_self",
  "challengeId": "uTRFgK_-KQavbhU3vOu0wlOepw2TSSfk",
  "credential": {
    "id": "I0Qi9pd8I3nIfAnQ776ObQ",
    "rawId": "I0Qi9pd8I3nIfAnQ776ObQ",
    "type": "public-key",
    "clientExtensionResults": {},
    "response": {
      "clientDataJSON": "eyJ0eXBlIjoid2ViYXV0aG4uY3JlYXRlIiwiY2hhbGxlbmdlIjoiY0FvLVlBdzN6Z0ZsSnp0NDl3dzhIa0YzTmRkaW9WMmMxV3RxdmpZejI4OCIsIm9yaWdpbiI6Imh0dHBzOi8vYXV0aC50b3BvbG8uYXBwIiwiY3Jvc3NPcmlnaW4iOmZhbHNlfQ",
      "attestationObject": "o2NmbXRkbm9uZWdhdHRTdG10oGhhdXRoRGF0YViUNZ1rFPMbBoSAEgMdU2K0cVHdZp7ngkxlSKNXjcKBXYtFAAAAAAAAAAAAAAAAAAAAAAAAAAAAECNEIvaXfCN5yHwJ0O--jm2lAQIDJiABIVggPEA6d7_Cb3CbV_SocaXqSX-ezjXwHOVXkoYxVHkkdRoiWCAqBk-Cqn0tpHoAI7bKPZWduLDn3E6qatUS-lNGCfkhBg"
    }
  },
  "friendlyName": "Fixture laptop"
}

CLI:

topolo actions validate app_topolo_auth.user_passkeys.registration.complete --data @payload.json --json
topolo actions plan app_topolo_auth.user_passkeys.registration.complete --data @payload.json --confirm --json
topolo actions call app_topolo_auth.user_passkeys.registration.complete --data @payload.json --confirm --json

MCP call after validation and plan review:

{
  "tool": "topolo_call_action",
  "arguments": {
    "actionId": "app_topolo_auth.user_passkeys.registration.complete",
    "input": {
      "userId": "usr_self",
      "challengeId": "uTRFgK_-KQavbhU3vOu0wlOepw2TSSfk",
      "credential": {
        "id": "I0Qi9pd8I3nIfAnQ776ObQ",
        "rawId": "I0Qi9pd8I3nIfAnQ776ObQ",
        "type": "public-key",
        "clientExtensionResults": {},
        "response": {
          "clientDataJSON": "eyJ0eXBlIjoid2ViYXV0aG4uY3JlYXRlIiwiY2hhbGxlbmdlIjoiY0FvLVlBdzN6Z0ZsSnp0NDl3dzhIa0YzTmRkaW9WMmMxV3RxdmpZejI4OCIsIm9yaWdpbiI6Imh0dHBzOi8vYXV0aC50b3BvbG8uYXBwIiwiY3Jvc3NPcmlnaW4iOmZhbHNlfQ",
          "attestationObject": "o2NmbXRkbm9uZWdhdHRTdG10oGhhdXRoRGF0YViUNZ1rFPMbBoSAEgMdU2K0cVHdZp7ngkxlSKNXjcKBXYtFAAAAAAAAAAAAAAAAAAAAAAAAAAAAECNEIvaXfCN5yHwJ0O--jm2lAQIDJiABIVggPEA6d7_Cb3CbV_SocaXqSX-ezjXwHOVXkoYxVHkkdRoiWCAqBk-Cqn0tpHoAI7bKPZWduLDn3E6qatUS-lNGCfkhBg"
        }
      },
      "friendlyName": "Fixture laptop"
    },
    "confirm": true
  }
}

Captured local handler response · HTTP 200:

{
  "success": true,
  "message": "Passkey registered successfully",
  "data": {
    "userId": "usr_self",
    "credential": {
      "id": "mzpmSGNFWmTu_liq",
      "friendlyName": "Fixture laptop",
      "deviceType": "singleDevice",
      "createdAt": 1790899200
    }
  },
  "timestamp": "2026-10-02T00:00:00.000Z"
}

Fresh ceremony succeeds after earlier failure without restoring the old challenge

Input · payload.json:

{
  "userId": "usr_self",
  "challengeId": "8FMCdM5-s8D8O-25thPsh2lfLqpdZ2zD",
  "credential": {
    "id": "bUcNocjgIM07rpWn6N5i5g",
    "rawId": "bUcNocjgIM07rpWn6N5i5g",
    "type": "public-key",
    "clientExtensionResults": {},
    "response": {
      "clientDataJSON": "eyJ0eXBlIjoid2ViYXV0aG4uY3JlYXRlIiwiY2hhbGxlbmdlIjoick9PcmttMDhxWHlLUzVCX1hISUZjMTB1Y19CTWM5bTVBT2w3UlpfUW1pQSIsIm9yaWdpbiI6Imh0dHBzOi8vYXV0aC50b3BvbG8uYXBwIiwiY3Jvc3NPcmlnaW4iOmZhbHNlfQ",
      "attestationObject": "o2NmbXRkbm9uZWdhdHRTdG10oGhhdXRoRGF0YViUNZ1rFPMbBoSAEgMdU2K0cVHdZp7ngkxlSKNXjcKBXYtFAAAAAAAAAAAAAAAAAAAAAAAAAAAAEG1HDaHI4CDNO66Vp-jeYualAQIDJiABIVggoKOfhXwF00gNQP641_sFwCr75oFtyc7bPg3LTDlGEqAiWCCAXhyTvS8iky9zzRGxQ6FPncIyZ8qErmZFzr8fIodpUQ"
    }
  }
}

CLI:

topolo actions validate app_topolo_auth.user_passkeys.registration.complete --data @payload.json --json
topolo actions plan app_topolo_auth.user_passkeys.registration.complete --data @payload.json --confirm --json
topolo actions call app_topolo_auth.user_passkeys.registration.complete --data @payload.json --confirm --json

MCP call after validation and plan review:

{
  "tool": "topolo_call_action",
  "arguments": {
    "actionId": "app_topolo_auth.user_passkeys.registration.complete",
    "input": {
      "userId": "usr_self",
      "challengeId": "8FMCdM5-s8D8O-25thPsh2lfLqpdZ2zD",
      "credential": {
        "id": "bUcNocjgIM07rpWn6N5i5g",
        "rawId": "bUcNocjgIM07rpWn6N5i5g",
        "type": "public-key",
        "clientExtensionResults": {},
        "response": {
          "clientDataJSON": "eyJ0eXBlIjoid2ViYXV0aG4uY3JlYXRlIiwiY2hhbGxlbmdlIjoick9PcmttMDhxWHlLUzVCX1hISUZjMTB1Y19CTWM5bTVBT2w3UlpfUW1pQSIsIm9yaWdpbiI6Imh0dHBzOi8vYXV0aC50b3BvbG8uYXBwIiwiY3Jvc3NPcmlnaW4iOmZhbHNlfQ",
          "attestationObject": "o2NmbXRkbm9uZWdhdHRTdG10oGhhdXRoRGF0YViUNZ1rFPMbBoSAEgMdU2K0cVHdZp7ngkxlSKNXjcKBXYtFAAAAAAAAAAAAAAAAAAAAAAAAAAAAEG1HDaHI4CDNO66Vp-jeYualAQIDJiABIVggoKOfhXwF00gNQP641_sFwCr75oFtyc7bPg3LTDlGEqAiWCCAXhyTvS8iky9zzRGxQ6FPncIyZ8qErmZFzr8fIodpUQ"
        }
      }
    },
    "confirm": true
  }
}

Captured local handler response · HTTP 200:

{
  "success": true,
  "message": "Passkey registered successfully",
  "data": {
    "userId": "usr_self",
    "credential": {
      "id": "ML98-KqQTd73Wlu_",
      "friendlyName": "Mac Passkey",
      "deviceType": "singleDevice",
      "createdAt": 1790899200
    }
  },
  "timestamp": "2026-10-02T00:00:00.000Z"
}

Administrator stores the exact managed-user passkey with the saved staging origin

Input · payload.json:

{
  "userId": "usr_managed",
  "challengeId": "BJ3bZu_GroeXq4CXCw-gAfvE2s5s0GP_",
  "credential": {
    "id": "DcuBv3n3Y9z-wkTTKLmVcA",
    "rawId": "DcuBv3n3Y9z-wkTTKLmVcA",
    "type": "public-key",
    "clientExtensionResults": {},
    "response": {
      "clientDataJSON": "eyJ0eXBlIjoid2ViYXV0aG4uY3JlYXRlIiwiY2hhbGxlbmdlIjoiaWtnVUdScDlicmpUd3UwTFR0YlEzNEFOU1hMVVBFNDNKOU1OcW9BY0R2WSIsIm9yaWdpbiI6Imh0dHBzOi8vYXV0aC5zdGcudG9wb2xvLnVzIiwiY3Jvc3NPcmlnaW4iOmZhbHNlfQ",
      "attestationObject": "o2NmbXRkbm9uZWdhdHRTdG10oGhhdXRoRGF0YViUD0FnmEHU_IY8jQeS_oMnFzdUI9lkPX1VbPLI-Tg4iCRFAAAAAAAAAAAAAAAAAAAAAAAAAAAAEA3Lgb9592Pc_sJE0yi5lXClAQIDJiABIVggIdmfjdl_JwYdrzj0_cJMIhJ5GFObt6KSSERKVxdp2BUiWCBrhJnzXUto1xyDa1bEzceNyIqYucs2CQHTJTJF_d2CpA"
    }
  }
}

CLI:

topolo actions validate app_topolo_auth.user_passkeys.registration.complete --data @payload.json --json
topolo actions plan app_topolo_auth.user_passkeys.registration.complete --data @payload.json --confirm --json
topolo actions call app_topolo_auth.user_passkeys.registration.complete --data @payload.json --confirm --json

MCP call after validation and plan review:

{
  "tool": "topolo_call_action",
  "arguments": {
    "actionId": "app_topolo_auth.user_passkeys.registration.complete",
    "input": {
      "userId": "usr_managed",
      "challengeId": "BJ3bZu_GroeXq4CXCw-gAfvE2s5s0GP_",
      "credential": {
        "id": "DcuBv3n3Y9z-wkTTKLmVcA",
        "rawId": "DcuBv3n3Y9z-wkTTKLmVcA",
        "type": "public-key",
        "clientExtensionResults": {},
        "response": {
          "clientDataJSON": "eyJ0eXBlIjoid2ViYXV0aG4uY3JlYXRlIiwiY2hhbGxlbmdlIjoiaWtnVUdScDlicmpUd3UwTFR0YlEzNEFOU1hMVVBFNDNKOU1OcW9BY0R2WSIsIm9yaWdpbiI6Imh0dHBzOi8vYXV0aC5zdGcudG9wb2xvLnVzIiwiY3Jvc3NPcmlnaW4iOmZhbHNlfQ",
          "attestationObject": "o2NmbXRkbm9uZWdhdHRTdG10oGhhdXRoRGF0YViUD0FnmEHU_IY8jQeS_oMnFzdUI9lkPX1VbPLI-Tg4iCRFAAAAAAAAAAAAAAAAAAAAAAAAAAAAEA3Lgb9592Pc_sJE0yi5lXClAQIDJiABIVggIdmfjdl_JwYdrzj0_cJMIhJ5GFObt6KSSERKVxdp2BUiWCBrhJnzXUto1xyDa1bEzceNyIqYucs2CQHTJTJF_d2CpA"
        }
      }
    },
    "confirm": true
  }
}

Captured local handler response · HTTP 200:

{
  "success": true,
  "message": "Passkey registered successfully",
  "data": {
    "userId": "usr_managed",
    "credential": {
      "id": "0FitZ4i2qID19X6x",
      "friendlyName": "Mac Passkey",
      "deviceType": "singleDevice",
      "createdAt": 1790899200
    }
  },
  "timestamp": "2026-10-02T00:00:00.000Z"
}

Development attestation verifies against the saved development relying party

Input · payload.json:

{
  "userId": "usr_self",
  "challengeId": "WlmA_B2xJEvC3xnFslPcaPbyymW6Dh-W",
  "credential": {
    "id": "GJCXipj4BwBJ9d1Lo92Qvg",
    "rawId": "GJCXipj4BwBJ9d1Lo92Qvg",
    "type": "public-key",
    "clientExtensionResults": {},
    "response": {
      "clientDataJSON": "eyJ0eXBlIjoid2ViYXV0aG4uY3JlYXRlIiwiY2hhbGxlbmdlIjoiNFBuQURfOFQ5WkhzbkFhcEpJc3IwcUVjUXZscHZtZElyUjFDamtKbjNwYyIsIm9yaWdpbiI6Imh0dHBzOi8vYXV0aC50b3BvbG8uZGV2IiwiY3Jvc3NPcmlnaW4iOmZhbHNlfQ",
      "attestationObject": "o2NmbXRkbm9uZWdhdHRTdG10oGhhdXRoRGF0YViUGkbTWsL1KQTw7lOsY3iMZSGRg26X40BbvZGF7vZUfz9FAAAAAAAAAAAAAAAAAAAAAAAAAAAAEBiQl4qY-AcASfXdS6PdkL6lAQIDJiABIVggAV6eQ3MXjtmfEslTDaZV1WiONL0-dlhjBVGG9FlHOSQiWCBKMk9JYjcp5JjeukjuA8bnA_32xRssno7yY8kt4mbyaA"
    }
  }
}

CLI:

topolo actions validate app_topolo_auth.user_passkeys.registration.complete --data @payload.json --json
topolo actions plan app_topolo_auth.user_passkeys.registration.complete --data @payload.json --confirm --json
topolo actions call app_topolo_auth.user_passkeys.registration.complete --data @payload.json --confirm --json

MCP call after validation and plan review:

{
  "tool": "topolo_call_action",
  "arguments": {
    "actionId": "app_topolo_auth.user_passkeys.registration.complete",
    "input": {
      "userId": "usr_self",
      "challengeId": "WlmA_B2xJEvC3xnFslPcaPbyymW6Dh-W",
      "credential": {
        "id": "GJCXipj4BwBJ9d1Lo92Qvg",
        "rawId": "GJCXipj4BwBJ9d1Lo92Qvg",
        "type": "public-key",
        "clientExtensionResults": {},
        "response": {
          "clientDataJSON": "eyJ0eXBlIjoid2ViYXV0aG4uY3JlYXRlIiwiY2hhbGxlbmdlIjoiNFBuQURfOFQ5WkhzbkFhcEpJc3IwcUVjUXZscHZtZElyUjFDamtKbjNwYyIsIm9yaWdpbiI6Imh0dHBzOi8vYXV0aC50b3BvbG8uZGV2IiwiY3Jvc3NPcmlnaW4iOmZhbHNlfQ",
          "attestationObject": "o2NmbXRkbm9uZWdhdHRTdG10oGhhdXRoRGF0YViUGkbTWsL1KQTw7lOsY3iMZSGRg26X40BbvZGF7vZUfz9FAAAAAAAAAAAAAAAAAAAAAAAAAAAAEBiQl4qY-AcASfXdS6PdkL6lAQIDJiABIVggAV6eQ3MXjtmfEslTDaZV1WiONL0-dlhjBVGG9FlHOSQiWCBKMk9JYjcp5JjeukjuA8bnA_32xRssno7yY8kt4mbyaA"
        }
      }
    },
    "confirm": true
  }
}

Captured local handler response · HTTP 200:

{
  "success": true,
  "message": "Passkey registered successfully",
  "data": {
    "userId": "usr_self",
    "credential": {
      "id": "kX5ROMpYJWLK6u8e",
      "friendlyName": "Mac Passkey",
      "deviceType": "singleDevice",
      "createdAt": 1790899200
    }
  },
  "timestamp": "2026-10-02T00:00:00.000Z"
}

Verify the result

Require the acknowledged userId to match the reviewed target. Read user_passkeys.list for that same user and match credential.id to the returned internal id while retaining unrelated credentials.
Separately verify the intended passkey can establish a session through the normal browser/authenticator sign-in, and that an approved alternate recovery route works. Verify notifications independently.

Errors and recovery

A completed challenge cannot register again

Captured local refusal · HTTP 400:

{
  "input": {
    "userId": "usr_self",
    "challengeId": "uTRFgK_-KQavbhU3vOu0wlOepw2TSSfk",
    "credential": {
      "id": "I0Qi9pd8I3nIfAnQ776ObQ",
      "rawId": "I0Qi9pd8I3nIfAnQ776ObQ",
      "type": "public-key",
      "clientExtensionResults": {},
      "response": {
        "clientDataJSON": "eyJ0eXBlIjoid2ViYXV0aG4uY3JlYXRlIiwiY2hhbGxlbmdlIjoiY0FvLVlBdzN6Z0ZsSnp0NDl3dzhIa0YzTmRkaW9WMmMxV3RxdmpZejI4OCIsIm9yaWdpbiI6Imh0dHBzOi8vYXV0aC50b3BvbG8uYXBwIiwiY3Jvc3NPcmlnaW4iOmZhbHNlfQ",
        "attestationObject": "o2NmbXRkbm9uZWdhdHRTdG10oGhhdXRoRGF0YViUNZ1rFPMbBoSAEgMdU2K0cVHdZp7ngkxlSKNXjcKBXYtFAAAAAAAAAAAAAAAAAAAAAAAAAAAAECNEIvaXfCN5yHwJ0O--jm2lAQIDJiABIVggPEA6d7_Cb3CbV_SocaXqSX-ezjXwHOVXkoYxVHkkdRoiWCAqBk-Cqn0tpHoAI7bKPZWduLDn3E6qatUS-lNGCfkhBg"
      }
    },
    "friendlyName": "Fixture laptop"
  },
  "response": {
    "success": false,
    "error": {
      "message": "Invalid, expired, or already used WebAuthn challenge",
      "code": "VALIDATION_ERROR",
      "details": {
        "challengeId": true
      },
      "timestamp": "2026-10-02T00:00:00.000Z"
    }
  }
}

Global credential-id uniqueness refuses a verified duplicate after challenge claim

Captured local refusal · HTTP 500:

{
  "input": {
    "userId": "usr_self",
    "challengeId": "5EmzNkopT9wEz-k_R9XsK27nXEohD4fz",
    "credential": {
      "id": "I0Qi9pd8I3nIfAnQ776ObQ",
      "rawId": "I0Qi9pd8I3nIfAnQ776ObQ",
      "type": "public-key",
      "clientExtensionResults": {},
      "response": {
        "clientDataJSON": "eyJ0eXBlIjoid2ViYXV0aG4uY3JlYXRlIiwiY2hhbGxlbmdlIjoiZzk3VTVaU2tGQ3ZzYy1ib3JCMzBpVE5LTjF6NERSa3FxSHdpdkx5anZrZyIsIm9yaWdpbiI6Imh0dHBzOi8vYXV0aC50b3BvbG8uYXBwIiwiY3Jvc3NPcmlnaW4iOmZhbHNlfQ",
        "attestationObject": "o2NmbXRkbm9uZWdhdHRTdG10oGhhdXRoRGF0YViUNZ1rFPMbBoSAEgMdU2K0cVHdZp7ngkxlSKNXjcKBXYtFAAAAAAAAAAAAAAAAAAAAAAAAAAAAECNEIvaXfCN5yHwJ0O--jm2lAQIDJiABIVggiOpEAB_U-8yuraxZIKKF-Cp0JNdtyQhnZhaZosg54Y0iWCAF8ilu6wJEbKy90gJi6QV17W6SfZ1fq80MD1SRgs23NA"
      }
    }
  },
  "response": {
    "success": false,
    "error": {
      "message": "UNIQUE constraint failed: user_webauthn_credentials.credential_id",
      "code": "SERVER_ERROR",
      "details": null,
      "timestamp": "2026-10-02T00:00:00.000Z"
    }
  }
}

Duplicate storage failure still consumes the challenge

Captured local refusal · HTTP 400:

{
  "input": {
    "userId": "usr_self",
    "challengeId": "5EmzNkopT9wEz-k_R9XsK27nXEohD4fz",
    "credential": {
      "id": "I0Qi9pd8I3nIfAnQ776ObQ",
      "rawId": "I0Qi9pd8I3nIfAnQ776ObQ",
      "type": "public-key",
      "clientExtensionResults": {},
      "response": {
        "clientDataJSON": "eyJ0eXBlIjoid2ViYXV0aG4uY3JlYXRlIiwiY2hhbGxlbmdlIjoiZzk3VTVaU2tGQ3ZzYy1ib3JCMzBpVE5LTjF6NERSa3FxSHdpdkx5anZrZyIsIm9yaWdpbiI6Imh0dHBzOi8vYXV0aC50b3BvbG8uYXBwIiwiY3Jvc3NPcmlnaW4iOmZhbHNlfQ",
        "attestationObject": "o2NmbXRkbm9uZWdhdHRTdG10oGhhdXRoRGF0YViUNZ1rFPMbBoSAEgMdU2K0cVHdZp7ngkxlSKNXjcKBXYtFAAAAAAAAAAAAAAAAAAAAAAAAAAAAECNEIvaXfCN5yHwJ0O--jm2lAQIDJiABIVggiOpEAB_U-8yuraxZIKKF-Cp0JNdtyQhnZhaZosg54Y0iWCAF8ilu6wJEbKy90gJi6QV17W6SfZ1fq80MD1SRgs23NA"
      }
    }
  },
  "response": {
    "success": false,
    "error": {
      "message": "Invalid, expired, or already used WebAuthn challenge",
      "code": "VALIDATION_ERROR",
      "details": {
        "challengeId": true
      },
      "timestamp": "2026-10-02T00:00:00.000Z"
    }
  }
}

Authorized manager cannot claim another target user challenge

Captured local refusal · HTTP 400:

{
  "input": {
    "userId": "usr_managed",
    "challengeId": "KjuhzDYv_iZQ8AmiAW7pZdi37-knqVZp",
    "credential": {
      "id": "I0Qi9pd8I3nIfAnQ776ObQ",
      "rawId": "I0Qi9pd8I3nIfAnQ776ObQ",
      "type": "public-key",
      "clientExtensionResults": {},
      "response": {
        "clientDataJSON": "eyJ0eXBlIjoid2ViYXV0aG4uY3JlYXRlIiwiY2hhbGxlbmdlIjoiY0FvLVlBdzN6Z0ZsSnp0NDl3dzhIa0YzTmRkaW9WMmMxV3RxdmpZejI4OCIsIm9yaWdpbiI6Imh0dHBzOi8vYXV0aC50b3BvbG8uYXBwIiwiY3Jvc3NPcmlnaW4iOmZhbHNlfQ",
        "attestationObject": "o2NmbXRkbm9uZWdhdHRTdG10oGhhdXRoRGF0YViUNZ1rFPMbBoSAEgMdU2K0cVHdZp7ngkxlSKNXjcKBXYtFAAAAAAAAAAAAAAAAAAAAAAAAAAAAECNEIvaXfCN5yHwJ0O--jm2lAQIDJiABIVggPEA6d7_Cb3CbV_SocaXqSX-ezjXwHOVXkoYxVHkkdRoiWCAqBk-Cqn0tpHoAI7bKPZWduLDn3E6qatUS-lNGCfkhBg"
      }
    }
  },
  "response": {
    "success": false,
    "error": {
      "message": "Invalid, expired, or already used WebAuthn challenge",
      "code": "VALIDATION_ERROR",
      "details": {
        "challengeId": true
      },
      "timestamp": "2026-10-02T00:00:00.000Z"
    }
  }
}

Invalid attestation origin consumes its one-use challenge

Captured local refusal · HTTP 400:

{
  "input": {
    "userId": "usr_self",
    "challengeId": "KjuhzDYv_iZQ8AmiAW7pZdi37-knqVZp",
    "credential": {
      "id": "Bo-tBajm7lvwXX16db_b8g",
      "rawId": "Bo-tBajm7lvwXX16db_b8g",
      "type": "public-key",
      "clientExtensionResults": {},
      "response": {
        "clientDataJSON": "eyJ0eXBlIjoid2ViYXV0aG4uY3JlYXRlIiwiY2hhbGxlbmdlIjoiLXpmV1dXZ2lpV0E1TkxoWURpRzVuZFhrcXBReHNCcUpkY3dmTlhBTlpyYyIsIm9yaWdpbiI6Imh0dHBzOi8vYXV0aC50b3BvbG8uYXBwIiwiY3Jvc3NPcmlnaW4iOmZhbHNlfQ",
        "attestationObject": "o2NmbXRkbm9uZWdhdHRTdG10oGhhdXRoRGF0YViUNZ1rFPMbBoSAEgMdU2K0cVHdZp7ngkxlSKNXjcKBXYtFAAAAAAAAAAAAAAAAAAAAAAAAAAAAEAaPrQWo5u5b8F19enW_2_KlAQIDJiABIVggPWZZHfMNVCbKpjvrHl_YnMejT2NG0HRIxcPlvOodD8oiWCAVaKlRjle1sjqBSRndjLoNCV1Zk4uzyWQkKU4_XpbXSQ"
      }
    }
  },
  "response": {
    "success": false,
    "error": {
      "message": "Unexpected registration response origin \"https://foreign.invalid\", expected \"https://auth.topolo.app\"",
      "code": "VALIDATION_ERROR",
      "details": {
        "credential": true
      },
      "timestamp": "2026-10-02T00:00:00.000Z"
    }
  }
}

Corrected attestation cannot reuse the consumed challenge

Captured local refusal · HTTP 400:

{
  "input": {
    "userId": "usr_self",
    "challengeId": "KjuhzDYv_iZQ8AmiAW7pZdi37-knqVZp",
    "credential": {
      "id": "Bo-tBajm7lvwXX16db_b8g",
      "rawId": "Bo-tBajm7lvwXX16db_b8g",
      "type": "public-key",
      "clientExtensionResults": {},
      "response": {
        "clientDataJSON": "eyJ0eXBlIjoid2ViYXV0aG4uY3JlYXRlIiwiY2hhbGxlbmdlIjoiLXpmV1dXZ2lpV0E1TkxoWURpRzVuZFhrcXBReHNCcUpkY3dmTlhBTlpyYyIsIm9yaWdpbiI6Imh0dHBzOi8vYXV0aC50b3BvbG8uYXBwIiwiY3Jvc3NPcmlnaW4iOmZhbHNlfQ",
        "attestationObject": "o2NmbXRkbm9uZWdhdHRTdG10oGhhdXRoRGF0YViUNZ1rFPMbBoSAEgMdU2K0cVHdZp7ngkxlSKNXjcKBXYtFAAAAAAAAAAAAAAAAAAAAAAAAAAAAEAaPrQWo5u5b8F19enW_2_KlAQIDJiABIVggPWZZHfMNVCbKpjvrHl_YnMejT2NG0HRIxcPlvOodD8oiWCAVaKlRjle1sjqBSRndjLoNCV1Zk4uzyWQkKU4_XpbXSQ"
      }
    }
  },
  "response": {
    "success": false,
    "error": {
      "message": "Invalid, expired, or already used WebAuthn challenge",
      "code": "VALIDATION_ERROR",
      "details": {
        "challengeId": true
      },
      "timestamp": "2026-10-02T00:00:00.000Z"
    }
  }
}

Foreign target authority is refused before registration SQL

Captured local refusal · HTTP 401:

{
  "input": {
    "userId": "usr_foreign",
    "challengeId": "uTRFgK_-KQavbhU3vOu0wlOepw2TSSfk",
    "credential": {
      "id": "I0Qi9pd8I3nIfAnQ776ObQ",
      "rawId": "I0Qi9pd8I3nIfAnQ776ObQ",
      "type": "public-key",
      "clientExtensionResults": {},
      "response": {
        "clientDataJSON": "eyJ0eXBlIjoid2ViYXV0aG4uY3JlYXRlIiwiY2hhbGxlbmdlIjoiY0FvLVlBdzN6Z0ZsSnp0NDl3dzhIa0YzTmRkaW9WMmMxV3RxdmpZejI4OCIsIm9yaWdpbiI6Imh0dHBzOi8vYXV0aC50b3BvbG8uYXBwIiwiY3Jvc3NPcmlnaW4iOmZhbHNlfQ",
        "attestationObject": "o2NmbXRkbm9uZWdhdHRTdG10oGhhdXRoRGF0YViUNZ1rFPMbBoSAEgMdU2K0cVHdZp7ngkxlSKNXjcKBXYtFAAAAAAAAAAAAAAAAAAAAAAAAAAAAECNEIvaXfCN5yHwJ0O--jm2lAQIDJiABIVggPEA6d7_Cb3CbV_SocaXqSX-ezjXwHOVXkoYxVHkkdRoiWCAqBk-Cqn0tpHoAI7bKPZWduLDn3E6qatUS-lNGCfkhBg"
      }
    },
    "friendlyName": "Fixture laptop"
  },
  "response": {
    "success": false,
    "error": {
      "message": "Access denied: You can only verify passkeys for yourself",
      "code": "AUTH_ERROR",
      "details": null,
      "timestamp": "2026-10-02T00:00:00.000Z"
    }
  }
}

Missing target is not provisioned

Captured local refusal · HTTP 404:

{
  "input": {
    "userId": "usr_missing",
    "challengeId": "uTRFgK_-KQavbhU3vOu0wlOepw2TSSfk",
    "credential": {
      "id": "I0Qi9pd8I3nIfAnQ776ObQ",
      "rawId": "I0Qi9pd8I3nIfAnQ776ObQ",
      "type": "public-key",
      "clientExtensionResults": {},
      "response": {
        "clientDataJSON": "eyJ0eXBlIjoid2ViYXV0aG4uY3JlYXRlIiwiY2hhbGxlbmdlIjoiY0FvLVlBdzN6Z0ZsSnp0NDl3dzhIa0YzTmRkaW9WMmMxV3RxdmpZejI4OCIsIm9yaWdpbiI6Imh0dHBzOi8vYXV0aC50b3BvbG8uYXBwIiwiY3Jvc3NPcmlnaW4iOmZhbHNlfQ",
        "attestationObject": "o2NmbXRkbm9uZWdhdHRTdG10oGhhdXRoRGF0YViUNZ1rFPMbBoSAEgMdU2K0cVHdZp7ngkxlSKNXjcKBXYtFAAAAAAAAAAAAAAAAAAAAAAAAAAAAECNEIvaXfCN5yHwJ0O--jm2lAQIDJiABIVggPEA6d7_Cb3CbV_SocaXqSX-ezjXwHOVXkoYxVHkkdRoiWCAqBk-Cqn0tpHoAI7bKPZWduLDn3E6qatUS-lNGCfkhBg"
      }
    },
    "friendlyName": "Fixture laptop"
  },
  "response": {
    "success": false,
    "error": {
      "message": "User not found",
      "code": "NOT_FOUND",
      "details": null,
      "timestamp": "2026-10-02T00:00:00.000Z"
    }
  }
}

Anonymous registration is refused

Captured local refusal · HTTP 401:

{
  "input": {
    "userId": "usr_self",
    "challengeId": "uTRFgK_-KQavbhU3vOu0wlOepw2TSSfk",
    "credential": {
      "id": "I0Qi9pd8I3nIfAnQ776ObQ",
      "rawId": "I0Qi9pd8I3nIfAnQ776ObQ",
      "type": "public-key",
      "clientExtensionResults": {},
      "response": {
        "clientDataJSON": "eyJ0eXBlIjoid2ViYXV0aG4uY3JlYXRlIiwiY2hhbGxlbmdlIjoiY0FvLVlBdzN6Z0ZsSnp0NDl3dzhIa0YzTmRkaW9WMmMxV3RxdmpZejI4OCIsIm9yaWdpbiI6Imh0dHBzOi8vYXV0aC50b3BvbG8uYXBwIiwiY3Jvc3NPcmlnaW4iOmZhbHNlfQ",
        "attestationObject": "o2NmbXRkbm9uZWdhdHRTdG10oGhhdXRoRGF0YViUNZ1rFPMbBoSAEgMdU2K0cVHdZp7ngkxlSKNXjcKBXYtFAAAAAAAAAAAAAAAAAAAAAAAAAAAAECNEIvaXfCN5yHwJ0O--jm2lAQIDJiABIVggPEA6d7_Cb3CbV_SocaXqSX-ezjXwHOVXkoYxVHkkdRoiWCAqBk-Cqn0tpHoAI7bKPZWduLDn3E6qatUS-lNGCfkhBg"
      }
    },
    "friendlyName": "Fixture laptop"
  },
  "response": {
    "success": false,
    "error": {
      "message": "Access token required",
      "code": "AUTH_ERROR",
      "details": null,
      "timestamp": "2026-10-02T00:00:00.000Z"
    }
  }
}

Missing challenge is refused

Captured local refusal · HTTP 400:

{
  "input": {
    "userId": "usr_self",
    "challengeId": "missing-fixture-challenge",
    "credential": {
      "id": "I0Qi9pd8I3nIfAnQ776ObQ",
      "rawId": "I0Qi9pd8I3nIfAnQ776ObQ",
      "type": "public-key",
      "clientExtensionResults": {},
      "response": {
        "clientDataJSON": "eyJ0eXBlIjoid2ViYXV0aG4uY3JlYXRlIiwiY2hhbGxlbmdlIjoiY0FvLVlBdzN6Z0ZsSnp0NDl3dzhIa0YzTmRkaW9WMmMxV3RxdmpZejI4OCIsIm9yaWdpbiI6Imh0dHBzOi8vYXV0aC50b3BvbG8uYXBwIiwiY3Jvc3NPcmlnaW4iOmZhbHNlfQ",
        "attestationObject": "o2NmbXRkbm9uZWdhdHRTdG10oGhhdXRoRGF0YViUNZ1rFPMbBoSAEgMdU2K0cVHdZp7ngkxlSKNXjcKBXYtFAAAAAAAAAAAAAAAAAAAAAAAAAAAAECNEIvaXfCN5yHwJ0O--jm2lAQIDJiABIVggPEA6d7_Cb3CbV_SocaXqSX-ezjXwHOVXkoYxVHkkdRoiWCAqBk-Cqn0tpHoAI7bKPZWduLDn3E6qatUS-lNGCfkhBg"
      }
    }
  },
  "response": {
    "success": false,
    "error": {
      "message": "Invalid, expired, or already used WebAuthn challenge",
      "code": "VALIDATION_ERROR",
      "details": {
        "challengeId": true
      },
      "timestamp": "2026-10-02T00:00:00.000Z"
    }
  }
}

Expired challenge is refused without accepting client-provided challenge data

Captured local refusal · HTTP 400:

{
  "input": {
    "userId": "usr_self",
    "challengeId": "hQQ0GtUQmASGyqUdBqzB3ma0sHxUGrlT",
    "credential": {
      "id": "I0Qi9pd8I3nIfAnQ776ObQ",
      "rawId": "I0Qi9pd8I3nIfAnQ776ObQ",
      "type": "public-key",
      "clientExtensionResults": {},
      "response": {
        "clientDataJSON": "eyJ0eXBlIjoid2ViYXV0aG4uY3JlYXRlIiwiY2hhbGxlbmdlIjoiY0FvLVlBdzN6Z0ZsSnp0NDl3dzhIa0YzTmRkaW9WMmMxV3RxdmpZejI4OCIsIm9yaWdpbiI6Imh0dHBzOi8vYXV0aC50b3BvbG8uYXBwIiwiY3Jvc3NPcmlnaW4iOmZhbHNlfQ",
        "attestationObject": "o2NmbXRkbm9uZWdhdHRTdG10oGhhdXRoRGF0YViUNZ1rFPMbBoSAEgMdU2K0cVHdZp7ngkxlSKNXjcKBXYtFAAAAAAAAAAAAAAAAAAAAAAAAAAAAECNEIvaXfCN5yHwJ0O--jm2lAQIDJiABIVggPEA6d7_Cb3CbV_SocaXqSX-ezjXwHOVXkoYxVHkkdRoiWCAqBk-Cqn0tpHoAI7bKPZWduLDn3E6qatUS-lNGCfkhBg"
      }
    }
  },
  "response": {
    "success": false,
    "error": {
      "message": "Invalid, expired, or already used WebAuthn challenge",
      "code": "VALIDATION_ERROR",
      "details": {
        "challengeId": true
      },
      "timestamp": "2026-10-02T00:00:00.000Z"
    }
  }
}

Storage failure follows challenge claim and requires read-back before fresh enrollment

Captured local refusal · HTTP 500:

{
  "input": {
    "userId": "usr_self",
    "challengeId": "4Ygu1Bc-2856JRb4diNhv17W7C8a5tcS",
    "credential": {
      "id": "evI79NwdQkwrUo3_UmEwFQ",
      "rawId": "evI79NwdQkwrUo3_UmEwFQ",
      "type": "public-key",
      "clientExtensionResults": {},
      "response": {
        "clientDataJSON": "eyJ0eXBlIjoid2ViYXV0aG4uY3JlYXRlIiwiY2hhbGxlbmdlIjoiX0padnZDNEFjZ1hYOVVfNWx2RE56YjZZMzR6ZXUwenU2MWFpSWtEbUlWRSIsIm9yaWdpbiI6Imh0dHBzOi8vYXV0aC50b3BvbG8uYXBwIiwiY3Jvc3NPcmlnaW4iOmZhbHNlfQ",
        "attestationObject": "o2NmbXRkbm9uZWdhdHRTdG10oGhhdXRoRGF0YViUNZ1rFPMbBoSAEgMdU2K0cVHdZp7ngkxlSKNXjcKBXYtFAAAAAAAAAAAAAAAAAAAAAAAAAAAAEHryO_TcHUJMK1KN_1JhMBWlAQIDJiABIVggPmBB-UTm10zUbCtgj9FDJzgx-7XixV39AzPYlZ-79h4iWCDpE3iFy1dbKx7Y3IxxFaabsh9mtvGhHohEIvCgd3w0tw"
      }
    }
  },
  "response": {
    "success": false,
    "error": {
      "message": "Isolated credential SQL failure",
      "code": "SERVER_ERROR",
      "details": null,
      "timestamp": "2026-10-02T00:00:00.000Z"
    }
  }
}

Retry after storage failure cannot reuse the claimed challenge

Captured local refusal · HTTP 400:

{
  "input": {
    "userId": "usr_self",
    "challengeId": "4Ygu1Bc-2856JRb4diNhv17W7C8a5tcS",
    "credential": {
      "id": "evI79NwdQkwrUo3_UmEwFQ",
      "rawId": "evI79NwdQkwrUo3_UmEwFQ",
      "type": "public-key",
      "clientExtensionResults": {},
      "response": {
        "clientDataJSON": "eyJ0eXBlIjoid2ViYXV0aG4uY3JlYXRlIiwiY2hhbGxlbmdlIjoiX0padnZDNEFjZ1hYOVVfNWx2RE56YjZZMzR6ZXUwenU2MWFpSWtEbUlWRSIsIm9yaWdpbiI6Imh0dHBzOi8vYXV0aC50b3BvbG8uYXBwIiwiY3Jvc3NPcmlnaW4iOmZhbHNlfQ",
        "attestationObject": "o2NmbXRkbm9uZWdhdHRTdG10oGhhdXRoRGF0YViUNZ1rFPMbBoSAEgMdU2K0cVHdZp7ngkxlSKNXjcKBXYtFAAAAAAAAAAAAAAAAAAAAAAAAAAAAEHryO_TcHUJMK1KN_1JhMBWlAQIDJiABIVggPmBB-UTm10zUbCtgj9FDJzgx-7XixV39AzPYlZ-79h4iWCDpE3iFy1dbKx7Y3IxxFaabsh9mtvGhHohEIvCgd3w0tw"
      }
    }
  },
  "response": {
    "success": false,
    "error": {
      "message": "Invalid, expired, or already used WebAuthn challenge",
      "code": "VALIDATION_ERROR",
      "details": {
        "challengeId": true
      },
      "timestamp": "2026-10-02T00:00:00.000Z"
    }
  }
}

Published recovery guidance

state_conflict (HTTP 409): Read the current resource state, reconcile the intended change, and retry only if still valid.
AUTH_ERROR (HTTP 401): Verify pinned identity, cookie/Bearer consistency, the published permission and exact target authority. Respect an authenticated target denial; do not infer OAuth expiry or switch identities automatically.
NOT_FOUND (HTTP 404): Resolve an existing authorized target. Registration does not provision missing users.
VALIDATION_ERROR (HTTP 400): Read current passkey state. Do not reuse a consumed/expired challenge or fabricate a credential. Begin a separately reviewed fresh browser ceremony after failed attestation; retain its same target, options and challengeId.
SERVER_ERROR (HTTP 500): Preserve the sanitized error/request id and read current credentials before reviewing a retry. A storage failure can follow challenge consumption; unsupported RP hosts are refused. No copied public-key row or guessed endpoint repairs a failed ceremony.

Recovery boundaries

After an unknown outcome list exact-user credentials before fresh enrollment. If a successful new registration must be undone, separately review deletion of its actual internal row id with an alternate working sign-in route. Deletion does not erase the physical authenticator entry, revoke existing sessions or restore a consumed challenge.

Discovery and evidence

This record belongs to app_topolo_auth. Captures exercise real controller target authority, SimpleWebAuthn options and CBOR/COSE attestation verification, global credential-id uniqueness and exact-user one-use Session SQL in separate isolated databases. Identity lookup and authenticator response construction are synthetic; failure injection is explicit and lifecycle notification is unconfigured. No live user, device, credential, notification or OAuth state was changed. Stored local credentials and cryptographic verification do not prove browser enrollment, normal sign-in, live CLI/MCP gateway permission, recipient delivery or production completion.