passkey

El dominio passkey tiene 21 acciones. En la superficie meta se alcanzan todas a través de arcane_passkey; en la individual, cada una es una herramienta propia; en la dinámica se ejecutan con arcane_execute_action y el ID canónico.

Resumen

Acción	Título	Tipo
passkey.capabilities	Get passkey capabilities	lectura
passkey.delete	Delete my passkey	destructiva
passkey.list	List my passkeys	lectura
passkey.login_availability	Get passkey login availability	lectura
passkey.login_begin	Begin passkey login	escritura
passkey.login_finish	Finish passkey login	escritura
passkey.mfa_begin	Begin passkey MFA	escritura
passkey.mfa_disable	Disable passkey MFA	destructiva
passkey.mfa_enable	Enable passkey MFA	escritura
passkey.mfa_finish	Finish passkey MFA	escritura
passkey.mfa_status	Get passkey MFA status	lectura
passkey.mobile_login_exchange	Exchange mobile passkey login	escritura
passkey.mobile_login_finish	Finish mobile passkey login	escritura
passkey.recovery_code_use	Use an MFA recovery code	escritura
passkey.recovery_codes_regenerate	Regenerate MFA recovery codes	destructiva
passkey.registration_begin	Begin passkey registration	escritura
passkey.registration_finish	Finish passkey registration	escritura
passkey.rename	Rename my passkey	escritura
passkey.step_up_begin	Begin passkey step-up	escritura
passkey.step_up_finish	Finish passkey step-up	escritura
passkey.step_up_password	Reauthenticate with password	escritura

Acciones

passkey.capabilities

Get passkey capabilities

• Tipo: lectura
• Parámetros obligatorios: ninguno
• Meta-herramienta: arcane_passkey con "action": "capabilities"
• Herramienta individual: arcane_passkey_capabilities
• Ruta de Arcane: GET /api/auth/me/passkeys/capabilities
• ID de operación: get-passkey-capabilities
• Uso: What the caller’s own account can do with passkeys: passkeyCount, passkeyMfaEnabled, hasLocalPassword, hasOidcFallback, canEnrollWithActiveSession (true only with no passkey yet, so no step-up is needed), canDeleteLastPasskey and requiresStepUp (true once a passkey exists). Needs a logged-in session (ARCANE_USERNAME/ARCANE_PASSWORD), not an API key.
• Acciones relacionadas: passkey.list, passkey.mfa_status, passkey.registration_begin, passkey.step_up_password

passkey.delete

Delete my passkey

• Tipo: destructiva — exige confirm: true
• Parámetros obligatorios: id
• Meta-herramienta: arcane_passkey con "action": "delete"
• Herramienta individual: arcane_passkey_delete
• Ruta de Arcane: DELETE /api/auth/me/passkeys/{id}
• ID de operación: delete-my-passkey
• Uso: Permanently removes one of the caller’s passkeys (id from passkey.list). Requires stepUpToken from passkey.step_up_password or passkey.step_up_finish and a logged-in session. The last passkey cannot be deleted while passkey MFA is on (run passkey.mfa_disable first) or when the account has no password or OIDC login left. passkey.capabilities reports canDeleteLastPasskey.
• Acciones relacionadas: passkey.list, passkey.step_up_password, passkey.capabilities, passkey.mfa_disable

passkey.list

List my passkeys

• Tipo: lectura
• Parámetros obligatorios: ninguno
• Meta-herramienta: arcane_passkey con "action": "list"
• Herramienta individual: arcane_passkey_list
• Ruta de Arcane: GET /api/auth/me/passkeys
• ID de operación: list-my-passkeys
• Uso: Lists the caller’s own passkeys for this instance, oldest first: id (the id for passkey.rename and passkey.delete), name, rpId, transports, backup flags, cloneWarning, createdAt and lastUsedAt. Needs a logged-in session, not an API key. Other users’ passkeys are not visible.
• Acciones relacionadas: passkey.rename, passkey.delete, passkey.registration_begin, passkey.capabilities

passkey.login_availability

Get passkey login availability

• Tipo: lectura
• Parámetros obligatorios: ninguno
• Meta-herramienta: arcane_passkey con "action": "login_availability"
• Herramienta individual: arcane_passkey_login_availability
• Ruta de Arcane: GET /api/auth/passkey/login/availability
• ID de operación: get-passkey-login-availability
• Desde: Arcane v2.10.2
• Uso: Public check (no credentials) whether any passkey is registered on this Arcane instance’s WebAuthn domain, i.e. whether a passkey login can work at all. It does not say which user. It is also false (not an error) when Arcane’s APP_URL is invalid, in which case every other passkey action fails with 500 ‘passkey service is unavailable’.
• Acciones relacionadas: passkey.login_begin

passkey.login_begin

Begin passkey login

Begin a discoverable WebAuthn passkey login ceremony

• Tipo: escritura
• Parámetros obligatorios: ninguno
• Meta-herramienta: arcane_passkey con "action": "login_begin"
• Herramienta individual: arcane_passkey_login_begin
• Ruta de Arcane: POST /api/auth/passkey/login/begin
• ID de operación: begin-passkey-login
• Uso: Starts a username-less (discoverable) passkey login. Needs no credentials. Returns ceremonyId and WebAuthn assertion options (valid 5 minutes, single use) for an authenticator to answer. Send the result to passkey.login_finish, or to passkey.mobile_login_finish for the mobile-app flow. For password login use auth.login. Like the other public passkey login and MFA routes it is rate-limited to 5 calls per minute per client IP (429 ‘rate limit exceeded’).
• Acciones relacionadas: passkey.login_finish, passkey.mobile_login_finish, passkey.login_availability, auth.login

passkey.login_finish

Finish passkey login

Validate a discoverable WebAuthn assertion and create a session

• Tipo: escritura
• Parámetros obligatorios: credential
• Meta-herramienta: arcane_passkey con "action": "login_finish"
• Herramienta individual: arcane_passkey_login_finish
• Ruta de Arcane: POST /api/auth/passkey/login/finish
• ID de operación: finish-passkey-login
• Uso: Completes a passkey login: ceremonyId from passkey.login_begin and credential, the authenticator’s WebAuthn assertion as a JSON object. Returns status authenticated with token, refreshToken and the matched user. The tokens are only returned, this server keeps its own credentials.
• Acciones relacionadas: passkey.login_begin, auth.refresh

passkey.mfa_begin

Begin passkey MFA

Begin a WebAuthn assertion for a pending MFA transaction

• Tipo: escritura
• Parámetros obligatorios: transactionId
• Meta-herramienta: arcane_passkey con "action": "mfa_begin"
• Herramienta individual: arcane_passkey_mfa_begin
• Ruta de Arcane: POST /api/auth/mfa/passkey/begin
• ID de operación: begin-passkey-mfa
• Uso: Second step of a login that answered status mfa_required (auth.login): auth.login already returns mfa.options, so call this only for a fresh challenge: pass mfa.transactionId to get new WebAuthn assertion options, which invalidates the earlier options of that transaction. Answer them with the user’s passkey and call passkey.mfa_finish, or use passkey.recovery_code_use instead. Needs no credentials. The transaction expires 5 minutes after the login.
• Acciones relacionadas: auth.login, passkey.mfa_finish, passkey.recovery_code_use

passkey.mfa_disable

Disable passkey MFA

• Tipo: destructiva — exige confirm: true
• Parámetros obligatorios: ninguno
• Meta-herramienta: arcane_passkey con "action": "mfa_disable"
• Herramienta individual: arcane_passkey_mfa_disable
• Ruta de Arcane: POST /api/auth/me/mfa/disable
• ID de operación: disable-passkey-mfa
• Uso: Turns off passkey MFA for the caller, deletes all their recovery codes and revokes every other session of the account (this one stays). Requires stepUpToken from passkey.step_up_password or passkey.step_up_finish and a logged-in session. Fails when MFA is not on.
• Acciones relacionadas: passkey.step_up_password, passkey.mfa_status, passkey.mfa_enable

passkey.mfa_enable

Enable passkey MFA

• Tipo: escritura
• Parámetros obligatorios: ninguno
• Meta-herramienta: arcane_passkey con "action": "mfa_enable"
• Herramienta individual: arcane_passkey_mfa_enable
• Ruta de Arcane: POST /api/auth/me/mfa/enable
• ID de operación: enable-passkey-mfa
• Uso: Turns on passkey MFA for the caller: afterwards a password (or OIDC) login returns status mfa_required and must be completed with a passkey or recovery code. Needs at least one registered passkey, a logged-in session and stepUpToken from passkey.step_up_password or passkey.step_up_finish. Returns 10 recovery codes shown only this once, so store them. Do not enable it on the account this server logs in with (ARCANE_USERNAME): its next fresh login would stop at mfa_required and fail.
• Acciones relacionadas: passkey.step_up_password, passkey.registration_begin, passkey.mfa_status, passkey.recovery_codes_regenerate

passkey.mfa_finish

Finish passkey MFA

Validate a WebAuthn MFA assertion and create the authenticated session

• Tipo: escritura
• Parámetros obligatorios: credential, transactionId
• Meta-herramienta: arcane_passkey con "action": "mfa_finish"
• Herramienta individual: arcane_passkey_mfa_finish
• Ruta de Arcane: POST /api/auth/mfa/passkey/finish
• ID de operación: finish-passkey-mfa
• Uso: Completes an mfa_required login: transactionId from auth.login (mfa.transactionId) and credential, the passkey’s WebAuthn assertion to the latest options (mfa.options from auth.login, or from passkey.mfa_begin if it was called). Returns status authenticated with token, refreshToken and user. The tokens are only returned, this server keeps its own credentials.
• Acciones relacionadas: passkey.mfa_begin, passkey.recovery_code_use, auth.login, auth.refresh

passkey.mfa_status

Get passkey MFA status

• Tipo: lectura
• Parámetros obligatorios: ninguno
• Meta-herramienta: arcane_passkey con "action": "mfa_status"
• Herramienta individual: arcane_passkey_mfa_status
• Ruta de Arcane: GET /api/auth/me/mfa
• ID de operación: get-passkey-mfa-status
• Uso: Whether passkey MFA is on for the caller’s own account, with passkeyCount and recoveryCodesRemaining (unused recovery codes). Needs a logged-in session, not an API key.
• Acciones relacionadas: passkey.mfa_enable, passkey.mfa_disable, passkey.recovery_codes_regenerate, passkey.capabilities

passkey.mobile_login_exchange

Exchange mobile passkey login

Consume a verifier-bound mobile passkey transaction and create a session

• Tipo: escritura
• Parámetros obligatorios: codeVerifier, transactionId
• Meta-herramienta: arcane_passkey con "action": "mobile_login_exchange"
• Herramienta individual: arcane_passkey_mobile_login_exchange
• Ruta de Arcane: POST /api/auth/passkey/mobile/exchange
• ID de operación: exchange-mobile-passkey-login
• Uso: App half of the mobile passkey login: transactionId from passkey.mobile_login_finish and codeVerifier, the PKCE verifier (exactly 32 random bytes, unpadded base64url, 43 characters) whose SHA-256 was sent as codeChallenge. Single use. Returns status authenticated with token, refreshToken and user (no cookie).
• Acciones relacionadas: passkey.mobile_login_finish, auth.refresh

passkey.mobile_login_finish

Finish mobile passkey login

Validate a browser assertion and create a one-time mobile exchange

• Tipo: escritura
• Parámetros obligatorios: ceremonyId, codeChallenge, credential
• Meta-herramienta: arcane_passkey con "action": "mobile_login_finish"
• Herramienta individual: arcane_passkey_mobile_login_finish
• Ruta de Arcane: POST /api/auth/passkey/mobile/finish
• ID de operación: finish-mobile-passkey-login
• Uso: Browser half of the mobile-app passkey login: ceremonyId from passkey.login_begin, credential (the WebAuthn assertion) and codeChallenge, the 43-character base64url SHA-256 of the app’s PKCE code verifier. Issues no tokens. Returns a one-time transactionId (valid 5 minutes) that the app redeems with passkey.mobile_login_exchange.
• Acciones relacionadas: passkey.login_begin, passkey.mobile_login_exchange

passkey.recovery_code_use

Use an MFA recovery code

Consume one recovery code for a pending MFA transaction

• Tipo: escritura
• Parámetros obligatorios: code, transactionId
• Meta-herramienta: arcane_passkey con "action": "recovery_code_use"
• Herramienta individual: arcane_passkey_recovery_code_use
• Ruta de Arcane: POST /api/auth/mfa/recovery
• ID de operación: use-passkey-recovery-code
• Uso: Completes an mfa_required login without the passkey: transactionId from auth.login (mfa.transactionId) and one unused recovery code (dashes and case are ignored). Each code works once. Returns status authenticated with token, refreshToken and user. Rate-limited to 5 attempts per minute per client IP (429).
• Acciones relacionadas: auth.login, passkey.mfa_begin, passkey.recovery_codes_regenerate, passkey.mfa_status

passkey.recovery_codes_regenerate

Regenerate MFA recovery codes

• Tipo: destructiva — exige confirm: true
• Parámetros obligatorios: ninguno
• Meta-herramienta: arcane_passkey con "action": "recovery_codes_regenerate"
• Herramienta individual: arcane_passkey_recovery_codes_regenerate
• Ruta de Arcane: POST /api/auth/me/mfa/recovery-codes/regenerate
• ID de operación: regenerate-passkey-recovery-codes
• Uso: Replaces all of the caller’s MFA recovery codes with 10 new ones, returned only this once. The old codes stop working. Only while passkey MFA is on. Requires stepUpToken from passkey.step_up_password or passkey.step_up_finish and a logged-in session.
• Acciones relacionadas: passkey.mfa_status, passkey.step_up_password, passkey.recovery_code_use

passkey.registration_begin

Begin passkey registration

• Tipo: escritura
• Parámetros obligatorios: ninguno
• Meta-herramienta: arcane_passkey con "action": "registration_begin"
• Herramienta individual: arcane_passkey_registration_begin
• Ruta de Arcane: POST /api/auth/me/passkeys/register/begin
• ID de operación: begin-passkey-registration
• Uso: Starts enrolling a new passkey for the caller (logged-in session only). The first passkey of an account needs no stepUpToken. Once one exists, pass stepUpToken from passkey.step_up_password or passkey.step_up_finish. Returns ceremonyId and WebAuthn creation options (valid 5 minutes) that a WebAuthn authenticator must answer. Send its credential to passkey.registration_finish.
• Acciones relacionadas: passkey.registration_finish, passkey.capabilities, passkey.step_up_password

passkey.registration_finish

Finish passkey registration

• Tipo: escritura
• Parámetros obligatorios: credential
• Meta-herramienta: arcane_passkey con "action": "registration_finish"
• Herramienta individual: arcane_passkey_registration_finish
• Ruta de Arcane: POST /api/auth/me/passkeys/register/finish
• ID de operación: finish-passkey-registration
• Uso: Completes enrolment: ceremonyId from passkey.registration_begin (single use, same session, within 5 minutes) and credential, the authenticator’s WebAuthn attestation response as a JSON object. Optional name (up to 128 characters) defaults to ‘<authenticator model> Passkey’ when the authenticator is known, else ‘New Passkey’. A credential that is already registered is refused with 409. Returns the stored passkey with its id.
• Acciones relacionadas: passkey.registration_begin, passkey.list, passkey.mfa_enable

passkey.rename

Rename my passkey

• Tipo: escritura
• Parámetros obligatorios: id, name
• Meta-herramienta: arcane_passkey con "action": "rename"
• Herramienta individual: arcane_passkey_rename
• Ruta de Arcane: PUT /api/auth/me/passkeys/{id}
• ID de operación: rename-my-passkey
• Uso: Renames one of the caller’s passkeys: id from passkey.list, name 1-128 characters. Requires stepUpToken from passkey.step_up_password or passkey.step_up_finish and a logged-in session. Returns the updated passkey summary.
• Acciones relacionadas: passkey.list, passkey.step_up_password, passkey.step_up_finish

passkey.step_up_begin

Begin passkey step-up

• Tipo: escritura
• Parámetros obligatorios: ninguno
• Meta-herramienta: arcane_passkey con "action": "step_up_begin"
• Herramienta individual: arcane_passkey_step_up_begin
• Ruta de Arcane: POST /api/auth/me/passkeys/reauth/begin
• ID de operación: begin-passkey-step-up
• Uso: Starts re-authentication with one of the caller’s passkeys, the alternative to passkey.step_up_password. Needs a logged-in session and at least one registered passkey. Returns transactionId and WebAuthn assertion options (valid 5 minutes) for an authenticator to answer, then call passkey.step_up_finish.
• Acciones relacionadas: passkey.step_up_finish, passkey.step_up_password

passkey.step_up_finish

Finish passkey step-up

• Tipo: escritura
• Parámetros obligatorios: credential, transactionId
• Meta-herramienta: arcane_passkey con "action": "step_up_finish"
• Herramienta individual: arcane_passkey_step_up_finish
• Ruta de Arcane: POST /api/auth/me/passkeys/reauth/finish
• ID de operación: finish-passkey-step-up
• Uso: Completes passkey re-authentication: transactionId from passkey.step_up_begin (same session) and credential, the authenticator’s WebAuthn assertion as a JSON object. Returns the step-up token (token, expiresAt) to pass as stepUpToken to passkey management and MFA actions. It is reusable until it expires, which is 5 minutes after passkey.step_up_begin, not after this call.
• Acciones relacionadas: passkey.step_up_begin, passkey.rename, passkey.delete, passkey.mfa_enable

passkey.step_up_password

Reauthenticate with password

• Tipo: escritura
• Parámetros obligatorios: password
• Meta-herramienta: arcane_passkey con "action": "step_up_password"
• Herramienta individual: arcane_passkey_step_up_password
• Ruta de Arcane: POST /api/auth/me/passkeys/reauth/password
• ID de operación: password-step-up
• Uso: Re-authenticates with the caller’s own password and returns a step-up token (token, expiresAt about 5 minutes ahead), reusable until it expires but bound to this session (if this server has to log in again, the token stops working and the call fails with 401 ‘fresh step-up authentication is required’, so run this again). Pass it as stepUpToken to passkey.rename, passkey.delete, passkey.registration_begin, passkey.mfa_enable, passkey.mfa_disable and passkey.recovery_codes_regenerate. Fails for accounts without a local password (use passkey.step_up_begin instead). Needs a logged-in session, not an API key.
• Acciones relacionadas: passkey.step_up_begin, passkey.mfa_enable, passkey.delete, passkey.rename