Synq Docs
Management APIPasskeys

Remove a user's passkey

It stops signing them in at once, even when it was their last way to sign in: a stolen device's passkey has to be removable, and the tenant decides what comes next (another way in, or disabling the user). Sessions it signed in keep going: end them with `revoke-sessions`. Needs `org.users.edit`. Recorded as `user.passkey_removed`, `by: management_api`.

DELETE/v1/orgs/{org}/brands/{brand}/users/{user}/passkeys/{passkey}

It stops signing them in at once, even when it was their last way to sign in: a stolen device's passkey has to be removable, and the tenant decides what comes next (another way in, or disabling the user). Sessions it signed in keep going: end them with revoke-sessions. Needs org.users.edit. Recorded as user.passkey_removed, by: management_api.

Authorization

bearer
AuthorizationBearer <token>

An org API key (sk_live_…, sk_test_…), or an access token from the Synq issuer (the synq brand, on the accounts host) for this API.

In: header

Path Parameters

org*string
brand*string
user*string
passkey*string
Lengthlength <= 100

Response Body

application/problem+json

application/problem+json

application/problem+json

application/problem+json

curl -X DELETE "https://example.com/v1/orgs/string/brands/string/users/string/passkeys/string"
Empty

Make an org POST

Makes an org with its default brand, and makes the caller its owner. Only a person can: an API key acts in its own org. It wants a verified email address (`email_unverified`). Where Synq isn't open for sign-up, only the people it lets in can (`org_creation_closed`), and one person owns a limited number of orgs (`org_quota_exceeded`). Recorded as `org.created`.

List a user's passkeys GET

Oldest first: whether each is synced and backed up, how the browser reached it, and when it was made and last used. Never its public key or credential id. Needs `org.users.view`.