# List Your Passkeys

Your passkeys, newest first — revoked ones included —, and your tenant's step-up mode.

## Overview

- `data`: each passkey's `id`, `name`, `status` (`active` or `revoked`), `deviceType` (`multiDevice`: synced, in a password manager or a platform's keychain; `singleDevice`: bound to one authenticator), `backedUp`, `transports`, `createdAt`, `lastUsedAt` (the last step-up it confirmed), `revokedAt` and `revokeReason`.
- `stepUp.mode`: your tenant's step-up mode — `log` (recorded) or `enforce` (required before a policy set is published or rolled back to, and before your passkeys change). `stepUp.available`: whether passkeys can be used — `true` for every tenant.
- Your own passkeys only.

## Endpoint

### `GET /v1/auth/passkeys`

Authentication: bearer token required.

The caller's passkeys, and the step-up mode of the caller's tenant.

**Responses**

`200` OK

```json
{
  "data": [
    {
      "id": "3c8e1f6a-2d4b-4e7f-9a15-6b0c2d8e4f71",
      "name": "Work laptop",
      "status": "active",
      "deviceType": "multiDevice",
      "backedUp": true,
      "transports": ["hybrid", "internal"],
      "createdAt": "2026-10-14T08:02:11.512Z",
      "lastUsedAt": "2026-10-14T09:15:40.208Z",
      "revokedAt": null,
      "revokeReason": null
    },
    {
      "id": "9f2a4b7c-1e3d-4c58-8b6a-0d7e5f1c3a92",
      "name": "Security key",
      "status": "revoked",
      "deviceType": "singleDevice",
      "backedUp": false,
      "transports": ["usb"],
      "createdAt": "2026-10-10T07:40:02.004Z",
      "lastUsedAt": null,
      "revokedAt": "2026-10-13T16:21:09.731Z",
      "revokeReason": "Left at the office"
    }
  ],
  "stepUp": { "mode": "log", "available": true }
}
```

**Example request**

```bash
curl https://api.aureahub.com/v1/auth/passkeys \
  -H "Authorization: Bearer YOUR_ACCESS_TOKEN"
```

---

Web version: https://docs.aureahub.com/#passkeys-list