Returns the passkeys and security keys registered to one person, newest first —…
Returns the passkeys and security keys registered to one person, newest first — which device each lives on and when it was registered. Yours by default.
GET /v1/iam/webauthn-credentials
| Address | https://api.hanzo.ai/v1/iam/webauthn-credentials |
| Method | GET |
| Operation | listWebauthnCredentials |
| Auth | Authorization: Bearer $HANZO_API_KEY |
Returns the passkeys and security keys registered to one person, newest first — which device each lives on and when it was registered.
Yours by default. Name somebody else and you get them only if you already administer their account, which is the same authority that governs reading their user record — so this list can never show more people than the surface beside it already does.
There is no organization-wide list, by design. Scoping to the ORG would hand an org admin every member's credential rows in one answer and a SuperAdmin every tenant's, while a plain member could not read even their own (an unnamed target fails the Guard's tenant rule). One scope answers both halves cleanly: the answer is a person's, and the caller is that person unless they say otherwise and may.
Request
1 field.
| Field | In | Type | Required | Description |
|---|---|---|---|---|
user | query | string | — |
Response
| Status | Body | Meaning |
|---|---|---|
200 | iam.listWebauthnCredentialsOut | ok |
200 body — 22 fields.
| Field | In | Type | Always | Description |
|---|---|---|---|---|
webauthnCredentials | body | iam.WebauthnCredential[] | — | |
webauthnCredentials[].aaguid | body | string | — | |
webauthnCredentials[].attachment | body | string | — | |
webauthnCredentials[].attestationFormat | body | string | — | AttestationFormat is the statement format the authenticator attested in ("packed", "apple", "none", …), which is a DIFFERENT value from the attestation type… |
webauthnCredentials[].attestationType | body | string | — | |
webauthnCredentials[].backupEligible | body | boolean | — | |
webauthnCredentials[].backupState | body | boolean | — | |
webauthnCredentials[].cloneWarning | body | boolean | — | |
webauthnCredentials[].createdAt | body | string (date-time) | — | |
webauthnCredentials[].createdTime | body | string | — | |
webauthnCredentials[].credentialId | body | string | — | |
webauthnCredentials[].deleted | body | boolean | — | |
webauthnCredentials[].id | body | string | — | |
webauthnCredentials[].name | body | string | — | |
webauthnCredentials[].owner | body | string | — | |
webauthnCredentials[].publicKey | body | string | — | |
webauthnCredentials[].signCount | body | integer | — | |
webauthnCredentials[].transport | body | string[] | — | |
webauthnCredentials[].updatedAt | body | string (date-time) | — | |
webauthnCredentials[].user | body | string | — | |
webauthnCredentials[].userPresent | body | boolean | — | |
webauthnCredentials[].userVerified | body | boolean | — |
Failure carries the platform error shape — see Errors.
Examples
hanzo has no subcommand for this operation — the CLI serves only what cloud's live route table confirms. Use HTTP or an SDK.
import { Configuration, IamApi } from 'hanzoai';
const api = new IamApi(new Configuration({ accessToken: process.env.HANZO_API_KEY }));
const { data } = await api.listWebauthnCredentials();from hanzoai.cloud import ApiClient, Configuration
from hanzoai.cloud.api import IamApi
client = ApiClient(Configuration(access_token=os.environ["HANZO_API_KEY"]))
result = IamApi(client).list_webauthn_credentials()cfg := cloud.NewConfiguration()
cfg.AddDefaultHeader("Authorization", "Bearer "+os.Getenv("HANZO_API_KEY"))
client := cloud.NewAPIClient(cfg)
resp, _, err := client.IamAPI.ListWebauthnCredentials(context.Background()).Execute()
if err != nil {
return err
}use hanzo_cloud::apis::{configuration::Configuration, iam_api};
let mut cfg = Configuration::new();
cfg.bearer_access_token = std::env::var("HANZO_API_KEY").ok();
let result = iam_api::list_webauthn_credentials(&cfg, Default::default()).await?;import ai.hanzo.cloud.ApiClient;
import ai.hanzo.cloud.api.IamApi;
ApiClient client = new ApiClient();
client.setRequestInterceptor(b -> b.header("Authorization", "Bearer " + System.getenv("HANZO_API_KEY")));
var result = new IamApi(client).listWebauthnCredentials();curl https://api.hanzo.ai/v1/iam/webauthn-credentials \
-H "Authorization: Bearer $HANZO_API_KEY"The door reaches iam through the iam tool, which names its 75 operations with its own verbs — this one among them, under a name only the door declares. describe explains any of them:
curl -X POST https://api.hanzo.ai/v1/mcp \
-H "Content-Type: application/json" \
-d '{
"jsonrpc": "2.0",
"id": 1,
"method": "tools/call",
"params": {
"name": "describe",
"arguments": {
"op": "list__well_known_jwks"
}
}
}'How is this guide?