Begin Passkey Enrollment
First of two calls that add a passkey. Answers the WebAuthn creation options for navigator.credentials.create and an enrollmentToken; send both the token and the created credential to POST /v1/users/{id}/passkeys/finish within 5 minutes.
SELF-SERVICE ONLY: {id} must be the caller’s own user id, and the call carries the caller’s own token.
One passkey per account. Needs a sign-in of the last few minutes (PASSKEY_RECENT_AUTH_SEC, 600 seconds by default). The response carries Cache-Control: no-store.
Failures:
403 IDE-1070— the sign-in is not recent enough; sign in again.404 IDE-0013—{id}is not the caller.409 IDE-1073— the organization does not offer passkey sign-in.409 IDE-1071— the account already has a passkey.503 IDE-0066— the identity provider is unavailable (unreachable, too slow to answer, or failing). Nothing about the request was wrong; retry it later.
Authorizations
JWT bearer token issued by the identity provider.
Path Parameters
Caller's own User ID.
"00000000-0000-0000-0000-000000000000"
Response
OK
Names this enrollment. Send it back to POST /v1/users/{id}/passkeys/finish within 5 minutes; it works once.
"Zm9vYmFyLWVucm9sbG1lbnQtdG9rZW4tZXhhbXBsZQ"
The WebAuthn creation options (publicKey) to pass to navigator.credentials.create, exactly as the identity provider wrote them.

