List the current account's passkeys
const url = 'https://api.aetherpush.com/v1/mfa/passkeys';const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};
try { const response = await fetch(url, options); const data = await response.json(); console.log(data);} catch (error) { console.error(error);}curl --request GET \ --url https://api.aetherpush.com/v1/mfa/passkeys \ --header 'Authorization: Bearer <token>'Session-only. Returns the account’s passkeys together with the MFA state, the number of unused recovery codes, and the two-factor setup deadline the dashboard enforces.
Authorizations
Section titled “Authorizations”Responses
Section titled “Responses”Passkeys, MFA state, and remaining recovery codes.
object
object
singleDevice or multiDevice, as reported at registration.
Whether a confirmed authenticator app is set up.
Whether the next passkey enrolment will replace this account’s recovery codes. True only while MFA is off, because that enrolment turns MFA on and issues the first codes; a passkey added to an account that already has MFA keeps its codes. A client that times out on that enrolment raises the recovery-codes warning when this is true.
Whether confirming an authenticator will replace this account’s recovery codes. A client that times out on that confirmation raises the recovery-codes warning when this is true.
When this account must have two-factor authentication set up, in epoch milliseconds. Null until a first password login stamps it. The dashboard reads this rather than its own session storage, so the deadline survives a new tab.
The server’s own verdict on the deadline, so the dashboard does not have to compare timestamps against a client clock.
Example generated
{ "passkeys": [ { "id": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0", "name": "example", "deviceType": "example", "backedUp": true, "transports": [ "example" ], "createdAt": "2026-04-15T12:00:00Z", "lastUsedAt": "2026-04-15T12:00:00Z" } ], "mfaEnabled": true, "remainingRecoveryCodes": 1, "totpEnabled": true, "passkeyEnrollmentReplacesRecoveryCodes": true, "totpConfirmationReplacesRecoveryCodes": true, "mfaSetupDeadline": 1, "mfaSetupOverdue": true}Authentication required.
Standard error envelope. code is the stable machine identifier for
client branching and i18n. The wording of error is a human-readable
fallback and is not part of the contract. Specialized responses keep
narrower code enums where clients already branch on them.
object
Human-readable error message.
Stable machine code. Prefer this over matching on error. The
values this API can answer with are listed in the ApiErrorCode
schema of the raw document at
https://api.aetherpush.com/openapi.yaml. The field stays an
open string here so that a release adding a value does not
invalidate this response.
Unique identifier for the request, also exposed as the X-Request-Id response header.
Example
{ "error": "The requested resource was not found.", "code": "not_found", "requestId": "req_abc123"}API keys and named access keys cannot manage passkeys; a login session is required.
Standard error envelope. code is the stable machine identifier for
client branching and i18n. The wording of error is a human-readable
fallback and is not part of the contract. Specialized responses keep
narrower code enums where clients already branch on them.
object
Human-readable error message.
Stable machine code. Prefer this over matching on error. The
values this API can answer with are listed in the ApiErrorCode
schema of the raw document at
https://api.aetherpush.com/openapi.yaml. The field stays an
open string here so that a release adding a value does not
invalidate this response.
Unique identifier for the request, also exposed as the X-Request-Id response header.
Example
{ "error": "This operation requires a login session. API keys and named access keys cannot access it.", "code": "session_required", "requestId": "req_abc123"}The tenant’s per-minute management API budget is spent.
Retry-After and X-RateLimit-* say when to retry. This is
not a plan quota: quota 429s use the Error envelope and do
not set Retry-After.
Returned with HTTP 429 when an endpoint-specific rate limit is hit,
including the per-tenant management API budget. Not the process-wide
address limiter (see GlobalAddressRateLimitErrorResponse).
retryAfterSeconds
indicates how long the client should wait before retrying, and matches
the Retry-After header when that header is set. code names the
limit that fired so clients can translate without matching on error.
object
Example
{ "error": "Rate limit exceeded", "code": "tenant_rate_limit_exceeded", "retryAfterSeconds": 60}Headers
Section titled “Headers”Seconds until the tenant window resets.