# Step-Up

Your passkey's answer to the step-up's options: a token for that one action, for two minutes.

## Overview

- `ceremonyId`: from [Step-Up Options](https://docs.aureahub.com/docs/step-up-options.md). `credential`: the assertion's `toJSON()` (AuthenticationResponseJSON).
- Verified with the passkey it names, which must be one of yours, active, and of the relying party the options named — Aurea's, or your tenant's own passkey address: that relying party's web address, user verification, the passkey's counter — a replayed assertion is refused — and the signature over the challenge.
- `200` with `stepUpToken`, `action` and `expiresAt`: the token lives 2 minutes and is used once, by you, for that action on that target only — send it with the action as `stepUpToken`. `Cache-Control: no-store`: keep it in memory, never log it. Written to the audit trail as `step_up.verified`, and `step_up.used` when the action uses it [Coming soon, upon request](https://docs.aureahub.com/docs/feature-availability.md).
- `403` `STEP_UP_INVALID` (`The passkey's answer did not verify for this step-up: ask for a new one`) for anything wrong — options unknown, used, expired or another user's, a credential that is not one of your active passkeys, a passkey of the other relying party, an answer that does not verify — one answer for every reason. `503` `PASSKEYS_NOT_CONFIGURED`. 20 requests per minute per client IP.

## Endpoint

### `POST /v1/auth/step-up`

Authentication: bearer token required.

Verifies a passkey's assertion and answers a single-use step-up token for the action.

**Request body**

| Name | Type | Required | Description |
| --- | --- | --- | --- |
| `ceremonyId` | string (uuid) | yes | `ceremonyId` of the step-up's options |
| `credential` | object | yes | The assertion's `toJSON()`: AuthenticationResponseJSON |

**Responses**

`200` OK

```json
{
  "stepUpToken": "EXAMPLE-step-up-token-000000000000000000001",
  "action": "approval.approve",
  "expiresAt": "2026-10-14T09:22:41.000Z"
}
```

`403` Did not verify

```json
{
  "statusCode": 403,
  "error": "ForbiddenError",
  "message": "The passkey's answer did not verify for this step-up: ask for a new one",
  "details": { "code": "STEP_UP_INVALID" }
}
```

**Example request**

```bash
curl -X POST https://api.aureahub.com/v1/auth/step-up \
  -H "Authorization: Bearer YOUR_ACCESS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "ceremonyId": "5e9a2c71-3b8d-4f06-a4e2-7d1c9b0f3a58",
    "credential": {
      "id": "AkuuQ3HZmehDc7su8X9U7g6kRKc",
      "rawId": "AkuuQ3HZmehDc7su8X9U7g6kRKc",
      "type": "public-key",
      "response": {
        "clientDataJSON": "eyJ0eXBlIjoid2ViYXV0aG4uZ2V0Iiwi…",
        "authenticatorData": "SZYN5YgOjGh0NBcPZHZgW4_krrmihjLHmVzzuoMdl2MFAAAABQ",
        "signature": "MEUCIQDf…",
        "userHandle": "ahyePyt9T1COSgxdO59-Eg"
      },
      "clientExtensionResults": {},
      "authenticatorAttachment": "platform"
    }
  }'
```

---

Web version: https://docs.aureahub.com/#step-up