robosystems-ai Auth: Passkeys API

openapi: 3.2.0
info:
  title: 'RoboSystems Auth: Passkeys API'
  description: 'The REST and GraphQL API for RoboSystems — an open-source, AI-native platform for accounting, financial reporting and investment management. It powers RoboLedger and RoboInvestor.


    ## Two surfaces


    **Platform** — `/v1/…` — graphs, queries, schema, documents, search, memory, connections, billing and access. Reads are REST `GET`s; every write is a named operation at `/operations/{name}` returning an `OperationEnvelope`, accepting an `Idempotency-Key`, and streaming progress at `/v1/operations/{id}/stream`.

    → API reference


    **Extensions** — `/extensions/…` — RoboLedger and RoboInvestor, scoped by `graph_id` in the URL. Reads are GraphQL at `POST /extensions/{graph_id}/graphql` and change nothing; writes are named operations at `/extensions/{domain}/{graph_id}/operations/{name}`; analytical views read the materialized graph.

    → Extensions reference · every GraphQL query


    ## Authenticating


    `X-API-Key: rfs…` on REST, GraphQL and per-graph MCP. Browser sessions use JWTs from `POST /v1/auth/login`. The graph-agnostic MCP endpoint `/v1/mcp` takes OAuth 2.1 bearer tokens only.


    ## Connecting an AI client


    Every graph is an MCP server at `POST /v1/graphs/{graph_id}/mcp`, and `POST /v1/mcp` serves OAuth clients that pick their graph at consent.

    → MCP guide


    ## Clients


    `robosystems-client` for Python, `@robosystems/client` for TypeScript.

    → Guides · Technical docs'
  version: 1.20.6
tags:
- name: 'Auth: Passkeys'
  description: 🔑 Passkeys - WebAuthn registration, passwordless login, and re-authentication
paths:
  /v1/auth/passkeys/register/options:
    post:
      tags:
      - 'Auth: Passkeys'
      summary: Passkey Registration Options
      description: Begin a passkey enrollment ceremony. The settings lane requires a fresh re-auth proof (password or assertion); the forced lane presents its enrollment token.
      operationId: getPasskeyRegistrationOptions
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PasskeyRegisterOptionsRequest'
        required: true
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CeremonyOptionsResponse'
        '400':
          description: Invalid request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '429':
          description: Rate limit exceeded
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '500':
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '401':
          description: Authentication required
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /v1/auth/passkeys/register/verify:
    post:
      tags:
      - 'Auth: Passkeys'
      summary: Passkey Registration Verify
      description: Finish enrollment. The first passkey returns recovery codes (once); the forced-enrollment lane also completes the login.
      operationId: verifyPasskeyRegistration
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PasskeyRegisterVerifyRequest'
        required: true
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PasskeyRegisterVerifyResponse'
        '400':
          description: Registration failed
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '429':
          description: Rate limit exceeded
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '500':
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '401':
          description: Authentication required
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /v1/auth/passkeys:
    get:
      tags:
      - 'Auth: Passkeys'
      summary: List Passkeys
      description: The authenticated user's enrolled passkeys.
      operationId: listUserPasskeys
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PasskeyListResponse'
        '400':
          description: Invalid request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '429':
          description: Rate limit exceeded
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '500':
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      security:
      - APIKeyHeader: []
  /v1/auth/passkeys/reauth/options:
    post:
      tags:
      - 'Auth: Passkeys'
      summary: Re-authentication Options
      description: Fresh-assertion options for destructive passkey lifecycle actions.
      operationId: getPasskeyReauthOptions
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CeremonyOptionsResponse'
        '400':
          description: Invalid request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '429':
          description: Rate limit exceeded
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '500':
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
  /v1/auth/passkeys/{passkey_id}:
    delete:
      tags:
      - 'Auth: Passkeys'
      summary: Remove Passkey
      description: Remove one passkey after re-authentication (password or fresh assertion). The last passkey of an MFA-required role cannot be removed while enforcement is active.
      operationId: deleteUserPasskey
      parameters:
      - name: passkey_id
        in: path
        required: true
        schema:
          type: string
          title: Passkey Id
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PasskeyDeleteRequest'
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SuccessResponse'
        '400':
          description: Invalid request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '429':
          description: Rate limit exceeded
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '500':
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '401':
          description: Re-authentication failed
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '409':
          description: Last passkey of an MFA-required role
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /v1/auth/passkeys/login/options:
    post:
      tags:
      - 'Auth: Passkeys'
      summary: Passwordless Login Options
      description: Usernameless assertion options for passwordless (passkey) login.
      operationId: getPasskeyLoginOptions
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CeremonyOptionsResponse'
        '400':
          description: Invalid request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '429':
          description: Rate limit exceeded
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '500':
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
  /v1/auth/passkeys/login/verify:
    post:
      tags:
      - 'Auth: Passkeys'
      summary: Passwordless Login Verify
      description: Complete a passwordless login. A user-verified passkey assertion is two factors in one gesture.
      operationId: verifyPasskeyLogin
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PasskeyLoginVerifyRequest'
        required: true
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AuthResponse'
        '400':
          description: Invalid request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '429':
          description: Rate limit exceeded
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '500':
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '401':
          description: Verification failed
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
components:
  schemas:
    SuccessResponse:
      properties:
        success:
          type: boolean
          title: Success
          description: Indicates the operation completed successfully
          default: true
        message:
          type: string
          title: Message
          description: Human-readable success message
          examples:
          - Operation completed successfully
        data:
          anyOf:
          - additionalProperties: true
            type: object
          - type: 'null'
          title: Data
          description: Optional additional data related to the operation
      type: object
      required:
      - message
      title: SuccessResponse
      description: Standard success response for operations without specific return data.
      example:
        data:
          deleted_count: 1
        message: Resource deleted successfully
        success: true
    PasskeyInfo:
      properties:
        id:
          type: string
          title: Id
          description: Passkey identifier
        name:
          type: string
          title: Name
          description: User-facing label
        created_at:
          type: string
          title: Created At
          description: Enrollment time (ISO 8601)
        last_used_at:
          anyOf:
          - type: string
          - type: 'null'
          title: Last Used At
          description: Last successful assertion time (ISO 8601)
        backup_eligible:
          type: boolean
          title: Backup Eligible
          description: Whether the credential is synced (multi-device) capable
        backup_state:
          type: boolean
          title: Backup State
          description: Whether the credential is currently backed up
      type: object
      required:
      - id
      - name
      - created_at
      - backup_eligible
      - backup_state
      title: PasskeyInfo
      description: One enrolled passkey, as listed in account settings.
    ValidationError:
      properties:
        loc:
          items:
            anyOf:
            - type: string
            - type: integer
          type: array
          title: Location
        msg:
          type: string
          title: Message
        type:
          type: string
          title: Error Type
        input:
          title: Input
        ctx:
          type: object
          title: Context
      type: object
      required:
      - loc
      - msg
      - type
      title: ValidationError
    PasskeyRegisterVerifyRequest:
      properties:
        credential:
          additionalProperties: true
          type: object
          title: Credential
          description: WebAuthn registration credential (browser JSON, opaque)
        name:
          anyOf:
          - type: string
            maxLength: 100
          - type: 'null'
          title: Name
          description: User-facing label for this passkey
        mfa_token:
          anyOf:
          - type: string
          - type: 'null'
          title: Mfa Token
          description: Enrollment token when finishing a forced enrollment
      type: object
      required:
      - credential
      title: PasskeyRegisterVerifyRequest
      description: Finish enrollment with the authenticator's attestation response.
    PasskeyDeleteRequest:
      properties:
        password:
          anyOf:
          - type: string
          - type: 'null'
          title: Password
          description: Current password (password-holding users)
        assertion:
          anyOf:
          - additionalProperties: true
            type: object
          - type: 'null'
          title: Assertion
          description: Fresh WebAuthn assertion from the re-auth ceremony
      type: object
      title: PasskeyDeleteRequest
      description: Re-authentication proof for removing a passkey.
    HTTPValidationError:
      properties:
        detail:
          items:
            $ref: '#/components/schemas/ValidationError'
          type: array
          title: Detail
      type: object
      title: HTTPValidationError
    PasskeyLoginVerifyRequest:
      properties:
        assertion:
          additionalProperties: true
          type: object
          title: Assertion
          description: WebAuthn assertion (browser JSON, opaque)
      type: object
      required:
      - assertion
      title: PasskeyLoginVerifyRequest
      description: Complete a passwordless login with a discoverable-credential assertion.
    PasskeyRegisterOptionsRequest:
      properties:
        mfa_token:
          anyOf:
          - type: string
          - type: 'null'
          title: Mfa Token
          description: Enrollment token from a login that returned mfa_enrollment_required
        password:
          anyOf:
          - type: string
          - type: 'null'
          title: Password
          description: Current password — settings-lane re-authentication
        assertion:
          anyOf:
          - additionalProperties: true
            type: object
          - type: 'null'
          title: Assertion
          description: Fresh WebAuthn assertion from the re-auth ceremony (settings lane)
      type: object
      title: PasskeyRegisterOptionsRequest
      description: 'Begin enrollment.


        Two disjoint lanes: `mfa_token` (forced enrollment — the token was minted

        seconds after a password verify, so it is its own freshness proof) or an

        authenticated settings-flow enrollment, which must carry a fresh re-auth

        proof — `password`, or a `reauth`-ceremony `assertion` when adding a

        passkey beside an existing one.'
    PasskeyListResponse:
      properties:
        passkeys:
          items:
            $ref: '#/components/schemas/PasskeyInfo'
          type: array
          title: Passkeys
          description: Enrolled passkeys
      type: object
      required:
      - passkeys
      title: PasskeyListResponse
      description: The user's enrolled passkeys.
    CeremonyOptionsResponse:
      properties:
        options:
          additionalProperties: true
          type: object
          title: Options
          description: PublicKeyCredential options (browser JSON, opaque)
      type: object
      required:
      - options
      title: CeremonyOptionsResponse
      description: WebAuthn options for the browser, verbatim from the RP library.
    AuthResponse:
      properties:
        user:
          additionalProperties: true
          type: object
          title: User
          description: User information
        org:
          anyOf:
          - additionalProperties: true
            type: object
          - type: 'null'
          title: Org
          description: Organization information (personal org created automatically on registration)
        message:
          type: string
          title: Message
          description: Success message
        status:
          type: string
          enum:
          - authenticated
          - mfa_required
          - mfa_enrollment_required
          title: Status
          description: 'Login flow state: authenticated (token present), or a passkey MFA step is required before a session is issued (mfa_token present)'
          default: authenticated
        mfa_token:
          anyOf:
          - type: string
          - type: 'null'
          title: Mfa Token
          description: Short-lived token authorizing the MFA second step or forced enrollment; present only when status is not 'authenticated'
        token:
          anyOf:
          - type: string
          - type: 'null'
          title: Token
          description: JWT authentication token (optional for cookie-based auth)
        expires_in:
          anyOf:
          - type: integer
          - type: 'null'
          title: Expires In
          description: Token expiry time in seconds from now
        refresh_threshold:
          anyOf:
          - type: integer
          - type: 'null'
          title: Refresh Threshold
          description: Recommended refresh threshold in seconds before expiry
      type: object
      required:
      - user
      - message
      title: AuthResponse
      description: Authentication response model.
    ErrorResponse:
      properties:
        detail:
          type: string
          title: Detail
          description: Human-readable error message explaining what went wrong
          examples:
          - Insufficient credits for operation
        code:
          anyOf:
          - type: string
          - type: 'null'
          title: Code
          description: Machine-readable error code for programmatic handling
          examples:
          - INSUFFICIENT_CREDITS
        request_id:
          anyOf:
          - type: string
          - type: 'null'
          title: Request Id
          description: Unique request ID for tracking and debugging
          examples:
          - req_1234567890abcdef
        timestamp:
          anyOf:
          - type: string
            format: date-time
          - type: 'null'
          title: Timestamp
          description: Timestamp when the error occurred
          examples:
          - '2024-01-01T00:00:00Z'
      type: object
      required:
      - detail
      title: ErrorResponse
      description: Error body returned by every endpoint.
      example:
        code: RESOURCE_NOT_FOUND
        detail: Resource not found
        request_id: req_1234567890abcdef
        timestamp: '2024-01-01T00:00:00Z'
    PasskeyRegisterVerifyResponse:
      properties:
        passkey:
          $ref: '#/components/schemas/PasskeyInfo'
          description: The newly enrolled passkey
        recovery_codes:
          anyOf:
          - items:
              type: string
            type: array
          - type: 'null'
          title: Recovery Codes
          description: Single-use recovery codes — returned exactly once, at first enrollment
        auth:
          anyOf:
          - $ref: '#/components/schemas/AuthResponse'
          - type: 'null'
          description: Completed login (forced-enrollment lane only)
      type: object
      required:
      - passkey
      title: PasskeyRegisterVerifyResponse
      description: 'Enrollment result; the first passkey also carries recovery codes and,

        in the forced-enrollment lane, the completed login.'
  securitySchemes:
    APIKeyHeader:
      type: apiKey
      in: header
      name: X-API-Key
      description: API key for authentication
    BearerAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: JWT bearer token