> ## Documentation Index > Fetch the complete documentation index at: https://docs.polymorfa.com/llms.txt > Use this file to discover all available pages before exploring further. # Issue passkey challenge > **Protocols:** Linked Device API **Required scope:** `sessions:manage` Your team must have direct-pairing access for the target Number. Use [QuickLink](/numbers/quicklink) for standard connections. Binds a WhatsApp-originated passkey challenge to one session with a short TTL. The extension runs the ceremony and the assertion comes back to the redeem endpoint. ## OpenAPI ````yaml api-reference/features/operations.json POST /messaging/{session}/passkey/challenge openapi: 3.0.3 info: title: Operations API methods version: 1.0.0 description: Task-focused operations methods across supported Polymorfa connection types. servers: [] security: [] paths: /messaging/{session}/passkey/challenge: post: tags: - Passkey summary: Issue passkey challenge description: >- **Protocols:** Linked Device API **Required scope:** `sessions:manage` Your team must have direct-pairing access for the target Number. Use [QuickLink](/numbers/quicklink) for standard connections. Binds a WhatsApp-originated passkey challenge to one session with a short TTL. The extension runs the ceremony and the assertion comes back to the redeem endpoint. operationId: nativeIssuePasskeyChallenge parameters: - schema: type: string minLength: 1 required: true name: session in: path description: |- Identifier of the connected Polymorfa session. **Value constraints** | Constraint | Accepted input | | --- | --- | | String length | At least `1` characters | requestBody: content: application/json: schema: $ref: '#/components/schemas/native__IssuePasskeyChallengeRequest' responses: '200': description: Challenge ticket issued content: application/json: schema: $ref: '#/components/schemas/native__IssuePasskeyChallengeResponse' headers: X-RateLimit-Limit: $ref: '#/components/headers/native__X-RateLimit-Limit' X-RateLimit-Remaining: $ref: '#/components/headers/native__X-RateLimit-Remaining' X-RateLimit-Reset: $ref: '#/components/headers/native__X-RateLimit-Reset' '400': description: Bad request — request body or params failed validation content: application/json: schema: $ref: '#/components/schemas/native__PublicError' example: error: type: invalid_request_error code: invalid_parameter message: Correct the invalid request field. param: null request_id: 5f0c2a8e-3b1d-4c6f-9e2a-7d4b1c8f6a30 data: null docs: https://docs.polymorfa.com/api/errors#invalid-parameter headers: X-RateLimit-Limit: $ref: '#/components/headers/native__X-RateLimit-Limit' X-RateLimit-Remaining: $ref: '#/components/headers/native__X-RateLimit-Remaining' X-RateLimit-Reset: $ref: '#/components/headers/native__X-RateLimit-Reset' '401': description: Missing or invalid authentication token content: application/json: schema: $ref: '#/components/schemas/native__PublicError' example: error: type: authentication_error code: invalid_credential message: Supply a valid credential. param: null request_id: 5f0c2a8e-3b1d-4c6f-9e2a-7d4b1c8f6a30 data: null docs: https://docs.polymorfa.com/api/errors#invalid-credential headers: X-RateLimit-Limit: $ref: '#/components/headers/native__X-RateLimit-Limit' X-RateLimit-Remaining: $ref: '#/components/headers/native__X-RateLimit-Remaining' X-RateLimit-Reset: $ref: '#/components/headers/native__X-RateLimit-Reset' '403': description: Authenticated but not permitted (missing scope or rule violation) content: application/json: schema: $ref: '#/components/schemas/native__PublicError' example: error: type: permission_error code: permission_denied message: The credential does not have access to this resource. param: null request_id: 5f0c2a8e-3b1d-4c6f-9e2a-7d4b1c8f6a30 data: null docs: https://docs.polymorfa.com/api/errors#permission-denied headers: X-RateLimit-Limit: $ref: '#/components/headers/native__X-RateLimit-Limit' X-RateLimit-Remaining: $ref: '#/components/headers/native__X-RateLimit-Remaining' X-RateLimit-Reset: $ref: '#/components/headers/native__X-RateLimit-Reset' '404': description: Resource not found headers: X-RateLimit-Limit: $ref: '#/components/headers/native__X-RateLimit-Limit' X-RateLimit-Remaining: $ref: '#/components/headers/native__X-RateLimit-Remaining' X-RateLimit-Reset: $ref: '#/components/headers/native__X-RateLimit-Reset' content: application/json: schema: $ref: '#/components/schemas/native__PublicError' example: error: type: invalid_request_error code: resource_not_found message: The resource is unavailable to this caller. param: null request_id: 5f0c2a8e-3b1d-4c6f-9e2a-7d4b1c8f6a30 data: null docs: https://docs.polymorfa.com/api/errors#resource-not-found '409': description: No passkey challenge pending for this session content: application/json: schema: $ref: '#/components/schemas/native__PublicError' example: error: type: conflict_error code: state_conflict message: The request conflicts with the resource state. param: null request_id: 5f0c2a8e-3b1d-4c6f-9e2a-7d4b1c8f6a30 data: null docs: https://docs.polymorfa.com/api/errors#state-conflict headers: X-RateLimit-Limit: $ref: '#/components/headers/native__X-RateLimit-Limit' X-RateLimit-Remaining: $ref: '#/components/headers/native__X-RateLimit-Remaining' X-RateLimit-Reset: $ref: '#/components/headers/native__X-RateLimit-Reset' '410': description: Passkey ticket expired. Issue a new challenge. content: application/json: schema: $ref: '#/components/schemas/native__PublicError' example: error: type: invalid_request_error code: resource_gone message: The requested retained resource has expired or was removed. param: null request_id: 5f0c2a8e-3b1d-4c6f-9e2a-7d4b1c8f6a30 data: null docs: https://docs.polymorfa.com/api/errors#resource-gone headers: X-RateLimit-Limit: $ref: '#/components/headers/native__X-RateLimit-Limit' X-RateLimit-Remaining: $ref: '#/components/headers/native__X-RateLimit-Remaining' X-RateLimit-Reset: $ref: '#/components/headers/native__X-RateLimit-Reset' '413': description: Passkey body exceeds 1048576 UTF-8 bytes before JSON parsing. content: application/json: schema: $ref: '#/components/schemas/native__PublicError' example: error: type: invalid_request_error code: invalid_parameter message: Correct the invalid request field. param: null request_id: 5f0c2a8e-3b1d-4c6f-9e2a-7d4b1c8f6a30 data: null docs: https://docs.polymorfa.com/api/errors#invalid-parameter headers: X-RateLimit-Limit: $ref: '#/components/headers/native__X-RateLimit-Limit' X-RateLimit-Remaining: $ref: '#/components/headers/native__X-RateLimit-Remaining' X-RateLimit-Reset: $ref: '#/components/headers/native__X-RateLimit-Reset' '422': description: Assertion is not bound to the ticket challenge content: application/json: schema: $ref: '#/components/schemas/native__PublicError' example: error: type: invalid_request_error code: invalid_parameter message: Correct the invalid request field. param: null request_id: 5f0c2a8e-3b1d-4c6f-9e2a-7d4b1c8f6a30 data: null docs: https://docs.polymorfa.com/api/errors#invalid-parameter headers: X-RateLimit-Limit: $ref: '#/components/headers/native__X-RateLimit-Limit' X-RateLimit-Remaining: $ref: '#/components/headers/native__X-RateLimit-Remaining' X-RateLimit-Reset: $ref: '#/components/headers/native__X-RateLimit-Reset' '500': description: Internal server error content: application/json: schema: $ref: '#/components/schemas/native__PublicError' example: error: type: api_error code: internal_error message: >- An unexpected service failure occurred. Keep the request ID for support. param: null request_id: 5f0c2a8e-3b1d-4c6f-9e2a-7d4b1c8f6a30 data: null docs: https://docs.polymorfa.com/api/errors#internal-error headers: X-RateLimit-Limit: $ref: '#/components/headers/native__X-RateLimit-Limit' X-RateLimit-Remaining: $ref: '#/components/headers/native__X-RateLimit-Remaining' X-RateLimit-Reset: $ref: '#/components/headers/native__X-RateLimit-Reset' '502': description: Upstream WhatsApp request failed or its response could not be mapped content: application/json: schema: $ref: '#/components/schemas/native__PublicError' example: error: type: upstream_error code: upstream_failure message: The messaging provider could not complete the request. param: null request_id: 5f0c2a8e-3b1d-4c6f-9e2a-7d4b1c8f6a30 data: null docs: https://docs.polymorfa.com/api/errors#upstream-failure headers: X-RateLimit-Limit: $ref: '#/components/headers/native__X-RateLimit-Limit' X-RateLimit-Remaining: $ref: '#/components/headers/native__X-RateLimit-Remaining' X-RateLimit-Reset: $ref: '#/components/headers/native__X-RateLimit-Reset' '503': description: >- Passkey service is temporarily unavailable or the request upload exceeded nine seconds content: application/json: schema: $ref: '#/components/schemas/native__PublicError' example: error: type: api_error code: service_unavailable message: >- A required service is unavailable. Check completion before repeating a write. param: null request_id: 5f0c2a8e-3b1d-4c6f-9e2a-7d4b1c8f6a30 data: null docs: https://docs.polymorfa.com/api/errors#service-unavailable headers: X-RateLimit-Limit: $ref: '#/components/headers/native__X-RateLimit-Limit' X-RateLimit-Remaining: $ref: '#/components/headers/native__X-RateLimit-Remaining' X-RateLimit-Reset: $ref: '#/components/headers/native__X-RateLimit-Reset' security: - native__BearerAuth: [] servers: - url: https://api.polymorfa.com components: schemas: native__IssuePasskeyChallengeRequest: type: object properties: challengeB64Url: type: string minLength: 1 description: >- Optional expected challenge. If supplied it must match the current runner snapshot; it never supplies ceremony options. **Value constraints** | Constraint | Accepted input | | --- | --- | | String length | At least `1` characters | userVerification: type: string enum: - preferred - required - discouraged description: |- Ignored. The current runner determines user verification. **Allowed values** | Value | Meaning | | --- | --- | | `preferred` | Preferred. | | `required` | Required. | | `discouraged` | Discouraged. | deprecated: true ttlSeconds: type: integer description: >- Requested ticket lifetime, independent of the WebAuthn timeout. Defaults to 300 seconds and is clamped to 255–300 seconds, then capped by the current challenge deadline. No new ticket is issued with less than 255 seconds remaining. The budget includes one minute to enter the ticket, two 10-second verification calls, 30 seconds for explicit consent, 15 seconds for popup startup, a five-second minimum prompt, and a 120-second post-prompt reserve for final verification, one minute to copy the assertion, both direct server RPCs, access checks and transit. A short remaining window is withheld from new callers without retiring an advertised live ticket. Renewal waits for expiry; an explicitly shorter lifetime constraint may retire an unreserved ticket. In-flight forwarding blocks replacement. Current runner authority is revalidated throughout. timeoutMs: type: integer minimum: 0 exclusiveMinimum: true description: |- Ignored. The current runner determines ceremony timeout. **Value constraints** | Constraint | Accepted input | | --- | --- | | Numeric value | Greater than `0` | deprecated: true native__IssuePasskeyChallengeResponse: type: object properties: success: type: boolean enum: - true description: |- Whether the request succeeded. **Allowed values** | Value | Meaning | | --- | --- | | `true` | True. | data: allOf: - $ref: '#/components/schemas/native__PasskeyTicket' description: Structured data carried by this object. required: - success - data native__PublicError: type: object properties: error: type: object properties: type: type: string enum: - invalid_request_error - authentication_error - permission_error - billing_error - conflict_error - rate_limit_error - api_error - upstream_error description: |- Type discriminator for this object. **Allowed values** | Value | Meaning | | --- | --- | | `invalid_request_error` | Invalid request error. | | `authentication_error` | Authentication error. | | `permission_error` | Permission error. | | `billing_error` | Billing error. | | `conflict_error` | Conflict error. | | `rate_limit_error` | Rate limit error. | | `api_error` | Api error. | | `upstream_error` | Upstream error. | code: type: string enum: - zero_knowledge_session - invalid_parameter - invalid_credential - entitlement_required - gate_limit_reached - billing_credit_required - addon_required - safe_mode_not_entitled - warmup_plan_not_entitled - method_not_allowed - permission_denied - missing_scope - resource_not_found - hms_not_enabled - media_fetch_failed - resource_gone - feature_unavailable - stream_cursor_invalid - stream_cursor_expired - stream_connection_limit_reached - state_conflict - team_deletion_scheduled - hybrid_choice_required - hybrid_group_linked_devices_unavailable - idempotency_conflict - idempotency_in_progress - idempotency_completed - idempotency_outcome_unknown - call_claimed - call_not_ringing - connection_limit - unsupported_for_connection - call_permission_required - invalid_sip_trunk - calls_disabled - call_recipient_opted_out - call_destination_blocked - call_permission_request_limited - call_permission_granted - call_opt_out_limit - number_restricted - sip_trunk_in_use - sip_trunk_revision_conflict - sip_trunk_limit - sip_unavailable - voice_not_enabled - provider_credential_invalid - provider_unavailable - asset_not_ready - voice_asset_in_use - voice_asset_revision_conflict - voice_unavailable - rate_limit_exceeded - internal_error - operation_not_supported - upstream_failure - service_unavailable - credential_verification_unavailable - session_not_ready - command_dispatch_failed - result_unknown - parent_bsuid_not_supported - recipient_not_on_whatsapp - conversation_window_closed - template_not_approved - media_too_large - whatsapp_rate_limited - new_chat_limit_reached - marketing_disabled_on_cloud_api - whatsapp_account_restricted - whatsapp_authorization_required - whatsapp_payment_method_required - whatsapp_number_not_registered - bansafe_suspended - bansafe_org_suspended - bansafe_cold_blocked - bansafe_cold_held - bansafe_throttled - bansafe_daily_allowance_reached - bansafe_accounting_unavailable - bansafe_send_outcome_unknown - campaigns_not_entitled - campaign_throughput_capped - campaign_approval_required - campaign_approval_stale - campaign_variables_missing description: >- Stable machine-readable code for this result. **Allowed values** | Value | Meaning | | --- | --- | | `zero_knowledge_session` | Zero knowledge session. | | `invalid_parameter` | Invalid parameter. | | `invalid_credential` | Invalid credential. | | `entitlement_required` | Entitlement required. | | `gate_limit_reached` | Gate limit reached. | | `billing_credit_required` | Billing credit required. | | `addon_required` | Addon required. | | `safe_mode_not_entitled` | Safe mode not entitled. | | `warmup_plan_not_entitled` | Warmup plan not entitled. | | `method_not_allowed` | Method not allowed. | | `permission_denied` | Permission denied. | | `missing_scope` | Missing scope. | | `resource_not_found` | Resource not found. | | `hms_not_enabled` | Hms not enabled. | | `media_fetch_failed` | Media fetch failed. | | `resource_gone` | Resource gone. | | `feature_unavailable` | Feature unavailable. | | `stream_cursor_invalid` | Stream cursor invalid. | | `stream_cursor_expired` | Stream cursor expired. | | `stream_connection_limit_reached` | Stream connection limit reached. | | `state_conflict` | State conflict. | | `team_deletion_scheduled` | Team deletion scheduled. | | `hybrid_choice_required` | Hybrid choice required. | | `hybrid_group_linked_devices_unavailable` | Hybrid group linked devices unavailable. | | `idempotency_conflict` | Idempotency conflict. | | `idempotency_in_progress` | Idempotency in progress. | | `idempotency_completed` | Idempotency completed. | | `idempotency_outcome_unknown` | Idempotency outcome unknown. | | `call_claimed` | Call claimed. | | `call_not_ringing` | Call not ringing. | | `connection_limit` | Connection limit. | | `unsupported_for_connection` | Unsupported for connection. | | `call_permission_required` | Call permission required. | | `invalid_sip_trunk` | Invalid sip trunk. | | `calls_disabled` | Calls disabled. | | `call_recipient_opted_out` | Call recipient opted out. | | `call_destination_blocked` | Call destination blocked. | | `call_permission_request_limited` | Call permission request limited. | | `call_permission_granted` | Call permission granted. | | `call_opt_out_limit` | Call opt out limit. | | `number_restricted` | Number restricted. | | `sip_trunk_in_use` | Sip trunk in use. | | `sip_trunk_revision_conflict` | Sip trunk revision conflict. | | `sip_trunk_limit` | Sip trunk limit. | | `sip_unavailable` | Sip unavailable. | | `voice_not_enabled` | Voice not enabled. | | `provider_credential_invalid` | Provider credential invalid. | | `provider_unavailable` | Provider unavailable. | | `asset_not_ready` | Asset not ready. | | `voice_asset_in_use` | Voice asset in use. | | `voice_asset_revision_conflict` | Voice asset revision conflict. | | `voice_unavailable` | Voice unavailable. | | `rate_limit_exceeded` | Rate limit exceeded. | | `internal_error` | Internal error. | | `operation_not_supported` | Operation not supported. | | `upstream_failure` | Upstream failure. | | `service_unavailable` | Service unavailable. | | `credential_verification_unavailable` | Credential verification unavailable. | | `session_not_ready` | Session not ready. | | `command_dispatch_failed` | Command dispatch failed. | | `result_unknown` | Result unknown. | | `parent_bsuid_not_supported` | Parent bsuid not supported. | | `recipient_not_on_whatsapp` | Recipient not on whatsapp. | | `conversation_window_closed` | Conversation window closed. | | `template_not_approved` | Template not approved. | | `media_too_large` | Media too large. | | `whatsapp_rate_limited` | Whatsapp rate limited. | | `new_chat_limit_reached` | New chat limit reached. | | `marketing_disabled_on_cloud_api` | Marketing disabled on cloud api. | | `whatsapp_account_restricted` | Whatsapp account restricted. | | `whatsapp_authorization_required` | Whatsapp authorization required. | | `whatsapp_payment_method_required` | Whatsapp payment method required. | | `whatsapp_number_not_registered` | Whatsapp number not registered. | | `bansafe_suspended` | Bansafe suspended. | | `bansafe_org_suspended` | Bansafe org suspended. | | `bansafe_cold_blocked` | Bansafe cold blocked. | | `bansafe_cold_held` | Bansafe cold held. | | `bansafe_throttled` | Bansafe throttled. | | `bansafe_daily_allowance_reached` | Bansafe daily allowance reached. | | `bansafe_accounting_unavailable` | Bansafe accounting unavailable. | | `bansafe_send_outcome_unknown` | Bansafe send outcome unknown. | | `campaigns_not_entitled` | Campaigns not entitled. | | `campaign_throughput_capped` | Campaign throughput capped. | | `campaign_approval_required` | Campaign approval required. | | `campaign_approval_stale` | Campaign approval stale. | | `campaign_variables_missing` | Campaign variables missing. | message: type: string description: Human-readable message associated with this result. param: type: string nullable: true description: |- Specifies param for this error. **Accepted alternatives** | Alternative | Accepted input | | --- | --- | | Alternative 1 | Type: `string` | | Alternative 2 | `null` | request_id: type: string description: >- Matches the X-Request-Id response header. Include it when you contact support. request_log_url: type: string format: uri description: >- Console page that shows this request. Returned only to organization and project credentials whose request was logged. **Value constraints** | Constraint | Accepted input | | --- | --- | | Format | `uri` | required: - type - code - message - param - request_id description: Error details returned when the operation fails. data: type: string nullable: true enum: - null description: |- Always null for a failed request. **Allowed values** | Value | Meaning | | --- | --- | | `null` | Null. | docs: type: string format: uri description: |- Specifies docs for this native public error. **Value constraints** | Constraint | Accepted input | | --- | --- | | Format | `uri` | required: - error - data - docs native__PasskeyTicket: type: object properties: version: type: number enum: - 2 description: |- Specifies version for this native passkey ticket. **Allowed values** | Value | Meaning | | --- | --- | | `2` | 2. | ticket: type: string description: Specifies ticket for this native passkey ticket. session: type: string description: Identifier of the connected Polymorfa session. rpId: type: string description: Identifier for the rp. challengeB64Url: type: string description: URL for the challenge b64. userVerification: type: string enum: - preferred - required - discouraged description: |- Specifies user verification for this native passkey ticket. **Allowed values** | Value | Meaning | | --- | --- | | `preferred` | Preferred. | | `required` | Required. | | `discouraged` | Discouraged. | expiresAt: type: string description: ISO 8601 timestamp when this resource expires. timeoutMs: type: integer description: Specifies timeout ms for this native passkey ticket. required: - version - ticket - session - rpId - challengeB64Url - userVerification - expiresAt headers: native__X-RateLimit-Limit: description: >- Team request quota per rolling minute, when the per-team request limiter applies. schema: type: integer minimum: 1 native__X-RateLimit-Remaining: description: >- Requests left in the per-team quota; zero when this limiter rejects the request. schema: type: integer minimum: 0 native__X-RateLimit-Reset: description: >- Unix timestamp in seconds when the oldest counted request leaves the rolling window, when the per-team request limiter applies. Follow Retry-After on a rejected request. schema: type: integer minimum: 0 securitySchemes: native__BearerAuth: type: http scheme: bearer description: >- Polymorfa team key (pmfa_ prefix), project token (pmfa_pt_ prefix) where supported, or short-lived client token (pmfa_ct_ prefix). Team keys and project tokens may be personal or service-account owned and enforce selected action scopes. Team keys cover the team and its projects; project tokens stay inside one project. Client tokens stay inside their live project and session and enforce their client rules and immutable mint-time action ceiling. Treat all credentials as opaque strings. Never parse them or assume a fixed length; store at least 512 characters. Server keys use issuance-record lookup; short-lived client tokens carry a signed permission ceiling. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.