users_passkeys_list

Tool

users_passkeys_list

List the passkeys (WebAuthn credentials) an end user has registered: the credential's id, the name the user gave it, its transports (`internal` is a platform passkey on the device itself, `usb`/`nfc`/`ble` a security key, `hybrid` a phone used from another device), the authenticator model's `aaguid`, whether the credential is `backedUp` (synced by the platform, so it survives losing the device), its sign counter and when it was last used. NO KEY MATERIAL IS EVER RETURNED — the public key is deliberately absent: nothing on this plane needs it, and it is a stable cross-site fingerprint for the device holding it. A user with passkeys signs in without a password, and reaches `aal2` in one gesture whenever their authenticator verified them.

Behavior

HTTP: GET /users/users/:userId/passkeys

Arguments

Name	Type	Required	Description
userId	string	•	The end user whose passkeys to list.

Response

Field	Type	Always	Description
passkeys	array	•

Try it

List the passkeys (WebAuthn credentials) an end user has registered: the credential's id, the name the user gave it, its transports (`internal` is a platform passkey on the device itself, `usb`/`nfc`/`ble` a security key, `hybrid` a phone used from another device), the authenticator model's `aaguid`, whether the credential is `backedUp` (synced by the platform, so it survives losing the device), its sign counter and when it was last used.

When to use

Example

Ask your agent something like this:

List the passkeys (WebAuthn credentials) an end user has registered: the credential's id, the name the user gave it, its transports (`internal` is a platform passkey on the device itself, `usb`/`nfc`/`ble` a security key, `hybrid` a phone used from another device), the authenticator model's `aaguid`, whether the credential is `backedUp` (synced by the platform, so it survives losing the device), its sign counter and when it was last used.

The agent will invoke users_passkeys_list with these arguments:

{
  "userId": "<userId>"
}