Start a step-up assertion challenge
const url = 'https://api.aetherpush.com/v1/mfa/stepup/challenge';const options = {method: 'POST', headers: {Authorization: 'Bearer <token>'}};
try { const response = await fetch(url, options); const data = await response.json(); console.log(data);} catch (error) { console.error(error);}curl --request POST \ --url https://api.aetherpush.com/v1/mfa/stepup/challenge \ --header 'Authorization: Bearer <token>'Dashboard sessions only. Returns WebAuthn authentication options for the
account’s own passkeys, to prove possession of an existing factor before
changing the factor set. Opening a challenge voids the account’s
in-flight one. API keys and named access keys are rejected by the login
session guard with a plain 403. A valid CLI session or a session that
predates credential attribution is refused with 403 and code
dashboard_session_required; a TOTP proof needs no challenge and stays
available to any login session. Accounts with only an authenticator app
receive 409 and step up with a TOTP code instead.
Authorizations
Section titled “Authorizations”Responses
Section titled “Responses”WebAuthn authentication options for the step-up assertion.
object
WebAuthn PublicKeyCredentialRequestOptionsJSON for the step-up assertion.
object
Examplegenerated
{ "options": {}}Authentication required.
object
Human-readable error message.
Unique identifier for the request, also exposed as the X-Request-Id response header.
Example
{ "error": "The requested resource was not found.", "requestId": "req_abc123"}API keys and named access keys receive a plain 403. A login session
that is not a dashboard login session receives code
dashboard_session_required.
object
Human-readable error message.
Unique identifier for the request, also exposed as the X-Request-Id response header.
Returned after login-session validation when a valid session that is
not a dashboard login session tries to issue or widen an API key,
create an access key or change its lifetime, enrol a passkey or
authenticator app, start a passkey step-up challenge, or run the CLI
device ceremony. Endpoints that enforce both guards reject API keys and
named access keys earlier with a plain 403 response and no code.
API-key creation applies only the dashboard-session guard, so any
non-dashboard credential receives this response there. Listing,
renaming and revoking stay open to any login session. Sessions created
before the credential_origin column existed cannot be attributed to
the dashboard and are also refused; signing out and back in fixes that.
object
Example
{ "error": "The requested resource was not found.", "requestId": "req_abc123"}No passkey is available to challenge (code: step_up_unavailable); use a TOTP code.
object
Human-readable error message.
Unique identifier for the request, also exposed as the X-Request-Id response header.
Returned by the step-up challenge when the account has no passkey to assert; the client falls back to an authenticator code.
object
Example
{ "error": "The requested resource was not found.", "requestId": "req_abc123"}