# List webauthn credentials URL: https://docs.hanzo.ai/docs/openapi/iam/listwebauthncredentials > Returns the passkeys and security keys registered to one person, newest first — which device each lives on and when it was registered. `GET /v1/iam/webauthn-credentials` > [IAM →](https://docs.hanzo.ai/docs/openapi/iam) · [All API references →](https://docs.hanzo.ai/docs/openapi) · [Get started →](https://docs.hanzo.ai/docs/guides) | | | | ------------- | -------------------------------------------------- | | **Address** | `https://api.hanzo.ai/v1/iam/webauthn-credentials` | | **Method** | `GET` | | **Operation** | `listWebauthnCredentials` | | **Auth** | `Authorization: Bearer $HANZO_API_KEY` | Returns the passkeys and security keys registered to one person, newest first — which device each lives on and when it was registered. Yours by default. Name somebody else and you get them only if you already administer their account, which is the same authority that governs reading their user record — so this list can never show more people than the surface beside it already does. There is no organization-wide list, by design. Scoping to the ORG would hand an org admin every member's credential rows in one answer and a SuperAdmin every tenant's, while a plain member could not read even their own (an unnamed target fails the Guard's tenant rule). One scope answers both halves cleanly: the answer is a person's, and the caller is that person unless they say otherwise and may. ## Request 1 field. | Field | In | Type | Required | Description | | ------ | ----- | ------ | -------- | ----------- | | `user` | query | string | — | | ## Response | Status | Body | Meaning | | --------- | ------------------------------ | ----------------- | | `200` | iam.listWebauthnCredentialsOut | ok | | `202` | Approval | held for approval | | `default` | problem-details | refused | `200` body — 22 fields. | Field | In | Type | Always | Description | | ----------------------------------------- | ---- | ------------------------- | ------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `webauthnCredentials` | body | iam.WebauthnCredential\[] | — | | | `webauthnCredentials[].aaguid` | body | string | — | | | `webauthnCredentials[].attachment` | body | string | — | | | `webauthnCredentials[].attestationFormat` | body | string | — | AttestationFormat is the statement format the authenticator attested in ("packed", "apple", "none", …), which is a DIFFERENT value from the attestation type above. | | `webauthnCredentials[].attestationType` | body | string | — | | | `webauthnCredentials[].backupEligible` | body | boolean | — | | | `webauthnCredentials[].backupState` | body | boolean | — | | | `webauthnCredentials[].cloneWarning` | body | boolean | — | | | `webauthnCredentials[].createdAt` | body | string (date-time) | — | | | `webauthnCredentials[].createdTime` | body | string | — | | | `webauthnCredentials[].credentialId` | body | string | — | | | `webauthnCredentials[].deleted` | body | boolean | — | | | `webauthnCredentials[].id` | body | string | — | | | `webauthnCredentials[].name` | body | string | — | | | `webauthnCredentials[].owner` | body | string | — | | | `webauthnCredentials[].publicKey` | body | string | — | | | `webauthnCredentials[].signCount` | body | integer (uint32) | — | | | `webauthnCredentials[].transport` | body | string\[] | — | | | `webauthnCredentials[].updatedAt` | body | string (date-time) | — | | | `webauthnCredentials[].user` | body | string | — | | | `webauthnCredentials[].userPresent` | body | boolean | — | | | `webauthnCredentials[].userVerified` | body | boolean | — | | Failure carries the platform error shape — see [Errors](https://docs.hanzo.ai/docs/errors). ## Examples **CLI** ```bash hanzo iam webauthn-credentials list ``` **SDK** **.ts** ```ts import { Configuration, IamApi } from 'hanzoai'; const api = new IamApi(new Configuration({ accessToken: process.env.HANZO_API_KEY })); const { data } = await api.listWebauthnCredentials(); ``` **.py** ```python from hanzoai.cloud import ApiClient, Configuration from hanzoai.cloud.api import IamApi client = ApiClient(Configuration(access_token=os.environ["HANZO_API_KEY"])) result = IamApi(client).list_webauthn_credentials() ``` **.go** ```go cfg := hanzoai.NewConfiguration() cfg.AddDefaultHeader("Authorization", "Bearer "+os.Getenv("HANZO_API_KEY")) client := hanzoai.NewAPIClient(cfg) resp, _, err := client.IamAPI.ListWebauthnCredentials(context.Background()).Execute() if err != nil { return err } ``` **.rs** ```rust use hanzo_client::apis::{configuration::Configuration, iam_api}; let mut cfg = Configuration::new(); cfg.bearer_access_token = std::env::var("HANZO_API_KEY").ok(); let result = iam_api::list_webauthn_credentials(&cfg, Default::default()).await?; ``` **.java** ```java import ai.hanzo.cloud.ApiClient; import ai.hanzo.cloud.api.IamApi; ApiClient client = new ApiClient(); client.setBearerToken(System.getenv("HANZO_API_KEY")); var result = new IamApi(client).listWebauthnCredentials(); ``` **HTTP** ```bash curl https://api.hanzo.ai/v1/iam/webauthn-credentials \ -H "Authorization: Bearer $HANZO_API_KEY" ``` **MCP** MCP reaches **iam** through the `iam` tool, which names its 44 operations with its own verbs — this one among them, under a name only MCP declares. `describe` explains any of them: ```bash curl -X POST https://api.hanzo.ai/v1/mcp \ -H "Content-Type: application/json" \ -d '{ "jsonrpc": "2.0", "id": 1, "method": "tools/call", "params": { "name": "describe", "arguments": { "op": "list_iam_applications" } } }' ``` --- [IAM API](https://docs.hanzo.ai/docs/openapi/iam) · [All Hanzo APIs](https://docs.hanzo.ai/docs/openapi) · [Interactive reference](https://docs.hanzo.ai/docs/openapi/reference)