Submit passkey assertion
Protocols: Linked Device API
Required scope: sessions:manage
The complete HTTP body is limited to 1048576 UTF-8 bytes before JSON parsing. Credential IDs allow at most 1023 decoded bytes; user handles allow 64. Opaque assertion fields share the body budget without independent small caps. Your team must have direct-pairing access for the target Number. Single-use: verifies the assertion is bound to the ticket challenge, forwards it to the session runner, and consumes the ticket once acknowledged.
curl --request POST \
--url https://api.polymorfa.com/messaging/{session}/passkey/assertion \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"ticketId": "<string>",
"assertion": {
"id": "<string>",
"rawIdB64Url": "<string>",
"response": {
"authenticatorDataB64": "<string>",
"clientDataJSONB64": "<string>",
"signatureB64": "<string>",
"userHandleB64": "<string>"
}
}
}
'const options = {
method: 'POST',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({
ticketId: '<string>',
assertion: {
id: '<string>',
rawIdB64Url: '<string>',
response: {
authenticatorDataB64: '<string>',
clientDataJSONB64: '<string>',
signatureB64: '<string>',
userHandleB64: '<string>'
}
}
})
};
fetch('https://api.polymorfa.com/messaging/{session}/passkey/assertion', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));import requests
url = "https://api.polymorfa.com/messaging/{session}/passkey/assertion"
payload = {
"ticketId": "<string>",
"assertion": {
"id": "<string>",
"rawIdB64Url": "<string>",
"response": {
"authenticatorDataB64": "<string>",
"clientDataJSONB64": "<string>",
"signatureB64": "<string>",
"userHandleB64": "<string>"
}
}
}
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.polymorfa.com/messaging/{session}/passkey/assertion"
payload := strings.NewReader("{\n \"ticketId\": \"<string>\",\n \"assertion\": {\n \"id\": \"<string>\",\n \"rawIdB64Url\": \"<string>\",\n \"response\": {\n \"authenticatorDataB64\": \"<string>\",\n \"clientDataJSONB64\": \"<string>\",\n \"signatureB64\": \"<string>\",\n \"userHandleB64\": \"<string>\"\n }\n }\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}false{
"success": true,
"data": {
"ok": true,
"ticket": "<string>",
"session": "<string>"
}
}{
"error": {
"type": "invalid_request_error",
"code": "invalid_parameter",
"message": "Correct the invalid request field.",
"param": null,
"request_id": "5f0c2a8e-3b1d-4c6f-9e2a-7d4b1c8f6a30"
},
"data": null,
"docs": "https://docs.polymorfa.com/api/errors#invalid-parameter"
}{
"error": {
"type": "authentication_error",
"code": "invalid_credential",
"message": "Supply a valid credential.",
"param": null,
"request_id": "5f0c2a8e-3b1d-4c6f-9e2a-7d4b1c8f6a30"
},
"data": null,
"docs": "https://docs.polymorfa.com/api/errors#invalid-credential"
}{
"error": {
"type": "permission_error",
"code": "permission_denied",
"message": "The credential does not have access to this resource.",
"param": null,
"request_id": "5f0c2a8e-3b1d-4c6f-9e2a-7d4b1c8f6a30"
},
"data": null,
"docs": "https://docs.polymorfa.com/api/errors#permission-denied"
}{
"error": {
"type": "invalid_request_error",
"code": "resource_not_found",
"message": "The resource is unavailable to this caller.",
"param": null,
"request_id": "5f0c2a8e-3b1d-4c6f-9e2a-7d4b1c8f6a30"
},
"data": null,
"docs": "https://docs.polymorfa.com/api/errors#resource-not-found"
}{
"error": {
"type": "conflict_error",
"code": "state_conflict",
"message": "The request conflicts with the resource state.",
"param": null,
"request_id": "5f0c2a8e-3b1d-4c6f-9e2a-7d4b1c8f6a30"
},
"data": null,
"docs": "https://docs.polymorfa.com/api/errors#state-conflict"
}{
"error": {
"type": "invalid_request_error",
"code": "resource_gone",
"message": "The requested retained resource has expired or was removed.",
"param": null,
"request_id": "5f0c2a8e-3b1d-4c6f-9e2a-7d4b1c8f6a30"
},
"data": null,
"docs": "https://docs.polymorfa.com/api/errors#resource-gone"
}{
"error": {
"type": "invalid_request_error",
"code": "invalid_parameter",
"message": "Correct the invalid request field.",
"param": null,
"request_id": "5f0c2a8e-3b1d-4c6f-9e2a-7d4b1c8f6a30"
},
"data": null,
"docs": "https://docs.polymorfa.com/api/errors#invalid-parameter"
}{
"error": {
"type": "invalid_request_error",
"code": "invalid_parameter",
"message": "Correct the invalid request field.",
"param": null,
"request_id": "5f0c2a8e-3b1d-4c6f-9e2a-7d4b1c8f6a30"
},
"data": null,
"docs": "https://docs.polymorfa.com/api/errors#invalid-parameter"
}{
"error": {
"type": "api_error",
"code": "internal_error",
"message": "An unexpected service failure occurred. Keep the request ID for support.",
"param": null,
"request_id": "5f0c2a8e-3b1d-4c6f-9e2a-7d4b1c8f6a30"
},
"data": null,
"docs": "https://docs.polymorfa.com/api/errors#internal-error"
}{
"error": {
"type": "upstream_error",
"code": "upstream_failure",
"message": "The messaging provider could not complete the request.",
"param": null,
"request_id": "5f0c2a8e-3b1d-4c6f-9e2a-7d4b1c8f6a30"
},
"data": null,
"docs": "https://docs.polymorfa.com/api/errors#upstream-failure"
}{
"error": {
"type": "api_error",
"code": "service_unavailable",
"message": "A required service is unavailable. Check completion before repeating a write.",
"param": null,
"request_id": "5f0c2a8e-3b1d-4c6f-9e2a-7d4b1c8f6a30"
},
"data": null,
"docs": "https://docs.polymorfa.com/api/errors#service-unavailable"
}Authorizations
Polymorfa team key (pmfa_ prefix), project token (pmfa_pt_ prefix) where supported, or short-lived client token (pmfa_ct_ prefix). Team keys and project tokens may be personal or service-account owned and enforce selected action scopes. Team keys cover the team and its projects; project tokens stay inside one project. Client tokens stay inside their live project and session and enforce their client rules and immutable mint-time action ceiling. Treat all credentials as opaque strings. Never parse them or assume a fixed length; store at least 512 characters. Server keys use issuance-record lookup; short-lived client tokens carry a signed permission ceiling.
Path Parameters
Identifier of the connected Polymorfa session.
Value constraints
| Constraint | Accepted input |
|---|---|
| String length | At least 1 characters |
1Body
Was this page helpful?
curl --request POST \
--url https://api.polymorfa.com/messaging/{session}/passkey/assertion \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"ticketId": "<string>",
"assertion": {
"id": "<string>",
"rawIdB64Url": "<string>",
"response": {
"authenticatorDataB64": "<string>",
"clientDataJSONB64": "<string>",
"signatureB64": "<string>",
"userHandleB64": "<string>"
}
}
}
'const options = {
method: 'POST',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({
ticketId: '<string>',
assertion: {
id: '<string>',
rawIdB64Url: '<string>',
response: {
authenticatorDataB64: '<string>',
clientDataJSONB64: '<string>',
signatureB64: '<string>',
userHandleB64: '<string>'
}
}
})
};
fetch('https://api.polymorfa.com/messaging/{session}/passkey/assertion', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));import requests
url = "https://api.polymorfa.com/messaging/{session}/passkey/assertion"
payload = {
"ticketId": "<string>",
"assertion": {
"id": "<string>",
"rawIdB64Url": "<string>",
"response": {
"authenticatorDataB64": "<string>",
"clientDataJSONB64": "<string>",
"signatureB64": "<string>",
"userHandleB64": "<string>"
}
}
}
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.polymorfa.com/messaging/{session}/passkey/assertion"
payload := strings.NewReader("{\n \"ticketId\": \"<string>\",\n \"assertion\": {\n \"id\": \"<string>\",\n \"rawIdB64Url\": \"<string>\",\n \"response\": {\n \"authenticatorDataB64\": \"<string>\",\n \"clientDataJSONB64\": \"<string>\",\n \"signatureB64\": \"<string>\",\n \"userHandleB64\": \"<string>\"\n }\n }\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}false{
"success": true,
"data": {
"ok": true,
"ticket": "<string>",
"session": "<string>"
}
}{
"error": {
"type": "invalid_request_error",
"code": "invalid_parameter",
"message": "Correct the invalid request field.",
"param": null,
"request_id": "5f0c2a8e-3b1d-4c6f-9e2a-7d4b1c8f6a30"
},
"data": null,
"docs": "https://docs.polymorfa.com/api/errors#invalid-parameter"
}{
"error": {
"type": "authentication_error",
"code": "invalid_credential",
"message": "Supply a valid credential.",
"param": null,
"request_id": "5f0c2a8e-3b1d-4c6f-9e2a-7d4b1c8f6a30"
},
"data": null,
"docs": "https://docs.polymorfa.com/api/errors#invalid-credential"
}{
"error": {
"type": "permission_error",
"code": "permission_denied",
"message": "The credential does not have access to this resource.",
"param": null,
"request_id": "5f0c2a8e-3b1d-4c6f-9e2a-7d4b1c8f6a30"
},
"data": null,
"docs": "https://docs.polymorfa.com/api/errors#permission-denied"
}{
"error": {
"type": "invalid_request_error",
"code": "resource_not_found",
"message": "The resource is unavailable to this caller.",
"param": null,
"request_id": "5f0c2a8e-3b1d-4c6f-9e2a-7d4b1c8f6a30"
},
"data": null,
"docs": "https://docs.polymorfa.com/api/errors#resource-not-found"
}{
"error": {
"type": "conflict_error",
"code": "state_conflict",
"message": "The request conflicts with the resource state.",
"param": null,
"request_id": "5f0c2a8e-3b1d-4c6f-9e2a-7d4b1c8f6a30"
},
"data": null,
"docs": "https://docs.polymorfa.com/api/errors#state-conflict"
}{
"error": {
"type": "invalid_request_error",
"code": "resource_gone",
"message": "The requested retained resource has expired or was removed.",
"param": null,
"request_id": "5f0c2a8e-3b1d-4c6f-9e2a-7d4b1c8f6a30"
},
"data": null,
"docs": "https://docs.polymorfa.com/api/errors#resource-gone"
}{
"error": {
"type": "invalid_request_error",
"code": "invalid_parameter",
"message": "Correct the invalid request field.",
"param": null,
"request_id": "5f0c2a8e-3b1d-4c6f-9e2a-7d4b1c8f6a30"
},
"data": null,
"docs": "https://docs.polymorfa.com/api/errors#invalid-parameter"
}{
"error": {
"type": "invalid_request_error",
"code": "invalid_parameter",
"message": "Correct the invalid request field.",
"param": null,
"request_id": "5f0c2a8e-3b1d-4c6f-9e2a-7d4b1c8f6a30"
},
"data": null,
"docs": "https://docs.polymorfa.com/api/errors#invalid-parameter"
}{
"error": {
"type": "api_error",
"code": "internal_error",
"message": "An unexpected service failure occurred. Keep the request ID for support.",
"param": null,
"request_id": "5f0c2a8e-3b1d-4c6f-9e2a-7d4b1c8f6a30"
},
"data": null,
"docs": "https://docs.polymorfa.com/api/errors#internal-error"
}{
"error": {
"type": "upstream_error",
"code": "upstream_failure",
"message": "The messaging provider could not complete the request.",
"param": null,
"request_id": "5f0c2a8e-3b1d-4c6f-9e2a-7d4b1c8f6a30"
},
"data": null,
"docs": "https://docs.polymorfa.com/api/errors#upstream-failure"
}{
"error": {
"type": "api_error",
"code": "service_unavailable",
"message": "A required service is unavailable. Check completion before repeating a write.",
"param": null,
"request_id": "5f0c2a8e-3b1d-4c6f-9e2a-7d4b1c8f6a30"
},
"data": null,
"docs": "https://docs.polymorfa.com/api/errors#service-unavailable"
}