Delete a passkey
const url = 'https://api.aetherpush.com/v1/mfa/passkeys/2489E9AD-2EE2-8E00-8EC9-32D5F69181C0';const options = { method: 'DELETE', headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'}, body: '{"stepUp":{"type":"passkey","response":{},"code":"example"}}'};
try { const response = await fetch(url, options); const data = await response.json(); console.log(data);} catch (error) { console.error(error);}curl --request DELETE \ --url https://api.aetherpush.com/v1/mfa/passkeys/2489E9AD-2EE2-8E00-8EC9-32D5F69181C0 \ --header 'Authorization: Bearer <token>' \ --header 'Content-Type: application/json' \ --data '{ "stepUp": { "type": "passkey", "response": {}, "code": "example" } }'Deleting the account’s last passkey disables MFA only when no confirmed authenticator app remains either; in that case the remaining recovery codes are discarded and pending MFA logins are invalidated. When MFA is enabled, a fresh step-up proof of an existing factor is required.
Authorizations
Section titled “Authorizations”Parameters
Section titled “Parameters”Path Parameters
Section titled “Path Parameters”Request Body
Section titled “Request Body”object
Fresh proof of a second factor the account already holds, required to change the factor set once MFA is enabled. A stolen session cannot enrol its own factor and then strip the owner’s. Recovery codes and passwords are deliberately not accepted here: a recovery code recovers a login but never authorizes a factor change.
object
WebAuthn AuthenticationResponseJSON. Required when type is passkey.
object
A current authenticator code. Required when type is totp.
Responses
Section titled “Responses”Passkey deleted.
object
False when the account is left with no MFA method at all (no passkeys and no confirmed authenticator app); MFA is then disabled and the remaining recovery codes are discarded.
Example generated
{ "message": "example", "mfaEnabled": true}Authentication required, or step-up is required and not satisfied (code: step_up_required).
Standard error envelope. code is the stable machine identifier for
client branching and i18n. The wording of error is a human-readable
fallback and is not part of the contract. Specialized responses keep
narrower code enums where clients already branch on them.
object
Human-readable error message.
Stable machine code. Prefer this over matching on error. The
values this API can answer with are listed in the ApiErrorCode
schema of the raw document at
https://api.aetherpush.com/openapi.yaml. The field stays an
open string here so that a release adding a value does not
invalidate this response.
Unique identifier for the request, also exposed as the X-Request-Id response header.
Returned when a factor-set change on an MFA-enabled account arrives
without a fresh step-up proof. Same shape as the reauth response so
clients branch on code and open the step-up flow, not on message text.
object
Example
{ "error": "The requested resource was not found.", "code": "not_found", "requestId": "req_abc123"}API keys and named access keys cannot manage passkeys; a login session is required.
Standard error envelope. code is the stable machine identifier for
client branching and i18n. The wording of error is a human-readable
fallback and is not part of the contract. Specialized responses keep
narrower code enums where clients already branch on them.
object
Human-readable error message.
Stable machine code. Prefer this over matching on error. The
values this API can answer with are listed in the ApiErrorCode
schema of the raw document at
https://api.aetherpush.com/openapi.yaml. The field stays an
open string here so that a release adding a value does not
invalidate this response.
Unique identifier for the request, also exposed as the X-Request-Id response header.
Example
{ "error": "This operation requires a login session. API keys and named access keys cannot access it.", "code": "session_required", "requestId": "req_abc123"}Passkey not found.
Standard error envelope. code is the stable machine identifier for
client branching and i18n. The wording of error is a human-readable
fallback and is not part of the contract. Specialized responses keep
narrower code enums where clients already branch on them.
object
Human-readable error message.
Stable machine code. Prefer this over matching on error. The
values this API can answer with are listed in the ApiErrorCode
schema of the raw document at
https://api.aetherpush.com/openapi.yaml. The field stays an
open string here so that a release adding a value does not
invalidate this response.
Unique identifier for the request, also exposed as the X-Request-Id response header.
Example
{ "error": "The requested resource was not found.", "code": "not_found", "requestId": "req_abc123"}The tenant’s per-minute management API budget is spent.
Retry-After and X-RateLimit-* say when to retry. This is
not a plan quota: quota 429s use the Error envelope and do
not set Retry-After.
Returned with HTTP 429 when an endpoint-specific rate limit is hit,
including the per-tenant management API budget. Not the process-wide
address limiter (see GlobalAddressRateLimitErrorResponse).
retryAfterSeconds
indicates how long the client should wait before retrying, and matches
the Retry-After header when that header is set. code names the
limit that fired so clients can translate without matching on error.
object
Example
{ "error": "Rate limit exceeded", "code": "tenant_rate_limit_exceeded", "retryAfterSeconds": 60}Headers
Section titled “Headers”Seconds until the tenant window resets.