v1

latestOpenAPI 3.0.12026-07-245303882.5 MB

Iniciação de Pagamentos JSR (Jornada sem Redirecionamento)

Obtém as opções de assinatura FIDO para autenticação.

Método para obter as opções de assinatura FIDO para autenticação.

post/open-keys/itp/api/v2/enrollments/v2/payment-initiations/{id}/fido/sign-options

Path parameters

idstring required

O id é o identificador único do ITP

Request body

journeySessionIdstring

ID is the unique identifier of journey

paymentInitiationIdstring

Unique identifier of the payment initiation for which FIDO2 authentication is requested. Required when using API scope to link the authentication to a specific payment operation.

Example request

{
  "journeySessionId": "f362a873-c127-4122-b711-a37b24a36914",
  "paymentInitiationId": "f362a873-c127-4122-b711-a37b24a36914",
  "data": {
    "platform": "ANDROID"
  }
}

Response

Object containing the necessary information for signing with a FIDO2 credential.

challengestring required

Random byte sequence generated by the FIDO2 server for this authentication request. Must be the value in base64url format without padding. This challenge is cryptographically unique for each authentication attempt and must be signed by the user's private key to prove possession of the credential.

timeoutinteger

Timeout in milliseconds for completing the FIDO2 authentication. Specifies how long the user has to complete the authentication process before the challenge expires. Common values range from 30000 (30 seconds) to 300000 (5 minutes).

userVerificationstring

Level of user verification required for this FIDO2 authentication. Values: 'required' (user verification must occur), 'preferred' (user verification is preferred but not required), 'discouraged' (user verification should not occur). User verification typically involves biometrics, PIN, or other local authentication methods on the device.

rpIdstring

Relying Party identifier for FIDO2 authentication origin validation. Must match the domain or identifier used during credential registration. This ensures that credentials can only be used for the intended service and prevents unauthorized cross-origin usage.

Example response

{
  "challenge": "SA03whJqfB7rWRiaEh6dyLNm3Wg4EY7H50g9b1XCMBw",
  "allowCredentials": [
    {
      "id": "xf1k_8KzydfqRMxvchl0axbwZINYaDGmYNvHldVnT6Mmmil1",
      "type": "public-key"
    }
  ],
  "timeout": 60000,
  "userVerification": "preferred",
  "rpId": "webauthn-simulator.web.app"
}