Create Registration Challenge

Starts a user registration session from the registration code received by email. It returns a challenge that will need to be signed by a passkey and used to perform the step Complete User Registration. Either orgId or tenantId needs to be specified.

This endpoint is for users previously created through Create User endpoint with registration: "Direct", and received a registration code by email.

POST /auth/registration/init

Create Registration Challenge

cURL

curl --request POST \
  --url https://api.dfns.io/auth/registration/init \
  --header 'Content-Type: application/json' \
  --data '
{
  "username": "<string>",
  "registrationCode": "<string>",
  "orgId": "or-30tnh-itmjs-s235s5ontr3r23h2",
  "tenantId": "acct-24hka-dhili-9hgvdlvr1ohpibp4"
}
'

200

{
  "user": {
    "id": "<string>",
    "displayName": "<string>",
    "name": "<string>"
  },
  "temporaryAuthenticationToken": "<string>",
  "challenge": "<string>",
  "supportedCredentialKinds": {
    "firstFactor": [
      "Fido2"
    ],
    "secondFactor": [
      "Fido2"
    ]
  },
  "authenticatorSelection": {
    "residentKey": "required",
    "requireResidentKey": true,
    "userVerification": "required",
    "authenticatorAttachment": "platform"
  },
  "attestation": "none",
  "pubKeyCredParams": [
    {
      "type": "public-key",
      "alg": 123
    }
  ],
  "excludeCredentials": [
    {
      "type": "public-key",
      "id": "cr-6uunn-bm6ja-f6rmod5kqrk5rbel"
    }
  ],
  "otpUrl": "<string>",
  "rp": {
    "id": "<string>",
    "name": "<string>"
  }
}

​

Authentication

No authentication required.

​

Required Permissions

No authentication required.

Body

application/json

username · string · required

Username/identifier of the user being registered (any unique string accepted, e.g. email).

Minimum string length: 1

registrationCode · string · required

One-time registration code sent to the user by email.

Minimum string length: 1

orgId · string

Organization id. Provide exactly one of orgId or tenantId, never both.

Required string length: 1 - 64

Pattern: ^or-[a-z0-9]{5}-[a-z0-9]{5}-[a-z0-9]{14,16}$

Example:

"or-30tnh-itmjs-s235s5ontr3r23h2"

tenantId · string

Tenant id. Provide exactly one of orgId or tenantId, never both.

Required string length: 1 - 64

Pattern: ^acct-[a-z0-9]{5}-[a-z0-9]{5}-[a-z0-9]{14,16}$

Example:

"acct-24hka-dhili-9hgvdlvr1ohpibp4"

Response

200 - application/json

Success

user · object · required

Show child attributes

temporaryAuthenticationToken · string · required

JWT used to identify the registration session when calling Complete User Registration.

challenge · string · required

Challenge to be signed by the credential being registered.

supportedCredentialKinds · object · required

Credential kinds that can be used to register the user.

Show child attributes

authenticatorSelection · object · required

Show child attributes

attestation · enum<string> · required

Identifies the information needed to verify the user's signing certificate; can be one of the following:

• none: indicates no attestation data is required
• indirect: indicates the attestation data should be given, but that it can be generated using an Anonymization CA
• direct: indicates the attestation data must be given and should be generated by the authenticator
• enterprise: indicates the attestation data should include information to uniquely identify the user's device

Available options: none, indirect, direct, enterprise

pubKeyCredParams · object[] · required

Public key credential parameters supported for the registration.

Show child attributes

excludeCredentials · object[] · required

Credentials to exclude from the registration (already registered for the user).

Show child attributes

otpUrl · string · required

URL to provision a TOTP credential, when applicable.

rp · object

Deprecated. Should not be used.

Show child attributes