> For AI agents: [llms.txt](https://docs.trustedauth.com/llms.txt) provides a Markdown index of this documentation.

# Start FIDO token registration

`GET /api/web/v1/fidotokens/challenge/{id}`

Start FIDO token registration for the specified user. Caller requires the FIDOTOKENS:ADD permission.

## Parameters

| Name | In | Required | Type | Description |
| --- | --- | --- | --- | --- |
| id | path | Yes | string | The UUID of the user for which the fido token is to be created. |

## Responses

### 200

Successful

#### application/json

Schema

```json
{
  "type": "object",
  "properties": {
    "attestation": {
      "type": "string",
      "description": "Attestation preference for passkey/FIDO2 registration. Determines how much information about the authenticator (security key/passkey) is shared during registration. NONE: No authenticator details shared (recommended for privacy). INDIRECT: Basic information shared in a privacy-preserving way (balanced approach). DIRECT: Full authenticator details shared (use when you need to verify specific device models).",
      "enum": [
        "NONE",
        "INDIRECT",
        "DIRECT"
      ]
    },
    "challenge": {
      "type": "string",
      "description": "The registration challenge generated by Identity as a Service.  This is a base-64 encoded value."
    },
    "registeredCredentials": {
      "type": "array",
      "description": "The IDs of FIDO tokens already registered to this user.  These values are base-64 encoded.",
      "items": {
        "type": "string",
        "description": "The IDs of FIDO tokens already registered to this user.  These values are base-64 encoded."
      }
    },
    "registeredCredentialsNames": {
      "type": "array",
      "description": "The names of FIDO tokens already registered to this user.",
      "items": {
        "type": "string",
        "description": "The names of FIDO tokens already registered to this user."
      }
    },
    "registrationAuthenticatorAttachment": {
      "type": "string",
      "description": "Should the token be embedded on the device or stored externally?",
      "enum": [
        "EITHER",
        "PLATFORM",
        "CROSS_PLATFORM"
      ]
    },
    "registrationRequireResidentKey": {
      "type": "string",
      "description": "Should the User ID be stored on the Passkey/FIDO2 token?",
      "enum": [
        "DISCOURAGED",
        "PREFERRED",
        "REQUIRED"
      ]
    },
    "registrationUserVerification": {
      "type": "string",
      "description": "Should the token perform user verification?",
      "enum": [
        "DISCOURAGED",
        "PREFERRED",
        "REQUIRED"
      ]
    },
    "rpName": {
      "type": "string",
      "description": "The name of this relying party.  This is the name of the Identity as a Service account."
    },
    "timeout": {
      "type": "integer",
      "description": "The number of seconds that the client will wait for the FIDO token to respond. This field is deprecated, use 'timeoutMillis' instead.",
      "format": "int32",
      "deprecated": true
    },
    "timeoutMillis": {
      "type": "integer",
      "description": "The time in milliseconds that the client will wait for the FIDO token to respond.",
      "format": "int32"
    },
    "userDisplayName": {
      "type": "string",
      "description": "The display name of this user. It will be 'firstname lastname' of the user"
    },
    "userId": {
      "type": "string",
      "description": "The id of this user. It will be UUID of the user base-64 encoded."
    },
    "userName": {
      "type": "string",
      "description": "The name of this user. It will be the userId of the user."
    }
  },
  "description": "A FIDORegisterChallenge defines the information returned when a user starts to register a FIDO token.",
  "title": "FIDORegisterChallenge"
}
```

### 400

Bad Request

#### application/json

Schema

```json
{
  "type": "object",
  "properties": {
    "errorCode": {
      "type": "string",
      "description": "Error Codes specific to cause of failure.",
      "example": "invalid_user_response"
    },
    "errorMessage": {
      "type": "string",
      "description": "Additional Error Message describing the error.",
      "example": "Application id cannot be null"
    },
    "parameters": {
      "type": "array",
      "description": "Optional additional error information.",
      "items": {
        "type": "object",
        "description": "Optional additional error information."
      }
    }
  },
  "description": "Object containing information about errors reported by services.",
  "title": "ErrorInfo"
}
```

### 401

Access denied

#### application/json

Schema

```json
{
  "type": "object",
  "properties": {
    "errorCode": {
      "type": "string",
      "description": "Error Codes specific to cause of failure.",
      "example": "invalid_user_response"
    },
    "errorMessage": {
      "type": "string",
      "description": "Additional Error Message describing the error.",
      "example": "Application id cannot be null"
    },
    "parameters": {
      "type": "array",
      "description": "Optional additional error information.",
      "items": {
        "type": "object",
        "description": "Optional additional error information."
      }
    }
  },
  "description": "Object containing information about errors reported by services.",
  "title": "ErrorInfo"
}
```

### 403

Forbidden

#### application/json

Schema

```json
{
  "type": "object",
  "properties": {
    "errorCode": {
      "type": "string",
      "description": "Error Codes specific to cause of failure.",
      "example": "invalid_user_response"
    },
    "errorMessage": {
      "type": "string",
      "description": "Additional Error Message describing the error.",
      "example": "Application id cannot be null"
    },
    "parameters": {
      "type": "array",
      "description": "Optional additional error information.",
      "items": {
        "type": "object",
        "description": "Optional additional error information."
      }
    }
  },
  "description": "Object containing information about errors reported by services.",
  "title": "ErrorInfo"
}
```

### 404

Not Found

#### application/json

Schema

```json
{
  "type": "object",
  "properties": {
    "errorCode": {
      "type": "string",
      "description": "Error Codes specific to cause of failure.",
      "example": "invalid_user_response"
    },
    "errorMessage": {
      "type": "string",
      "description": "Additional Error Message describing the error.",
      "example": "Application id cannot be null"
    },
    "parameters": {
      "type": "array",
      "description": "Optional additional error information.",
      "items": {
        "type": "object",
        "description": "Optional additional error information."
      }
    }
  },
  "description": "Object containing information about errors reported by services.",
  "title": "ErrorInfo"
}
```

### 409

Conflict

#### application/json

Schema

```json
{
  "type": "object",
  "properties": {
    "errorCode": {
      "type": "string",
      "description": "Error Codes specific to cause of failure.",
      "example": "invalid_user_response"
    },
    "errorMessage": {
      "type": "string",
      "description": "Additional Error Message describing the error.",
      "example": "Application id cannot be null"
    },
    "parameters": {
      "type": "array",
      "description": "Optional additional error information.",
      "items": {
        "type": "object",
        "description": "Optional additional error information."
      }
    }
  },
  "description": "Object containing information about errors reported by services.",
  "title": "ErrorInfo"
}
```

## Security

Requirements

```json
[
  {
    "AdminAPIAuthentication": []
  }
]
```