Delete a passkey

DELETE

/v1/mfa/passkeys/{passkeyId}

curl --request DELETE \
  --url https://api.aetherpush.com/v1/mfa/passkeys/2489E9AD-2EE2-8E00-8EC9-32D5F69181C0 \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '{ "stepUp": { "type": "passkey", "response": {}, "code": "example" } }'

• Production
• Staging
• Local development

Deleting the account’s last passkey disables MFA only when no confirmed authenticator app remains either; in that case the remaining recovery codes are discarded and pending MFA logins are invalidated. When MFA is enabled, a fresh step-up proof of an existing factor is required.

Authorizations

• accessKeyAuth

Parameters

Path Parameters

passkeyId

required

string format: uuid

Request Body

Media typeapplication/json

object

stepUp

Fresh proof of a second factor the account already holds, required to change the factor set once MFA is enabled. A stolen session cannot enrol its own factor and then strip the owner’s. Recovery codes and passwords are deliberately not accepted here: a recovery code recovers a login but never authorizes a factor change.

object

type

required

string

Allowed values: passkey totp

response

WebAuthn AuthenticationResponseJSON. Required when type is passkey.

object

key

additional properties

any

code

A current authenticator code. Required when type is totp.

string

Responses

200

Passkey deleted.

Media typeapplication/json

object

message

required

string

mfaEnabled

required

False when the account is left with no MFA method at all (no passkeys and no confirmed authenticator app); MFA is then disabled and the remaining recovery codes are discarded.

boolean

Example^generated

{
  "message": "example",
  "mfaEnabled": true
}

401

Authentication required, or step-up is required and not satisfied (code: step_up_required).

Media typeapplication/json

One of:

object

object

error

required

Human-readable error message.

string

requestId

Unique identifier for the request, also exposed as the X-Request-Id response header.

string

object

Returned when a factor-set change on an MFA-enabled account arrives without a fresh step-up proof. Same shape as the reauth response so clients branch on code and open the step-up flow, not on message text.

object

error

required

string

code

required

string

Allowed values: step_up_required

requestId

string

Example

{
  "error": "The requested resource was not found.",
  "requestId": "req_abc123"
}

403

API keys and named access keys cannot manage passkeys; a login session is required.

Media typeapplication/json

object

error

required

Human-readable error message.

string

requestId

Unique identifier for the request, also exposed as the X-Request-Id response header.

string

Example

{
  "error": "The requested resource was not found.",
  "requestId": "req_abc123"
}

404

Passkey not found.

Media typeapplication/json

object

error

required

Human-readable error message.

string

requestId

Unique identifier for the request, also exposed as the X-Request-Id response header.

string

Example

{
  "error": "The requested resource was not found.",
  "requestId": "req_abc123"
}