---
title: "resolveDiscoverableCredential"
method: POST
path: "/v2/users/public/passkeys:resolveCredential"
tags: ["User V2"]
---

# resolveDiscoverableCredential

`POST /v2/users/public/passkeys:resolveCredential`

Resolve user identity from a discoverable passkey assertion. Returns the user's email and login parameters.

## Request body

- object
  - `challenge_token` string, required — The challenge token from authenticateBeginDiscoverable
  - `assertion_response` object, required — WebAuthn AuthenticatorAssertionResponse JSON

## Response `200`

Resolved user identity and login parameters

- object
  - `email` string, email
  - `organization_id` string
  - `user_id` string
  - `login_parameters` LoginParameters[]
    - `organization_id` string
    - `organization_name` string
    - `organization_type` string
    - `organization_use` string
    - `parent_production_org_id` string, nullable — For a Sandbox org, the id of its Production parent (its brand); null/absent for Production orgs. Lets the org switcher group a sandbox under its brand without relying on list order.
    - `cognito_region` string
    - `cognito_user_pool_id` string
    - `cognito_user_pool_client_id` string
    - `cognito_oauth_domain` string
    - `cognito_oauth_scopes` string[]
    - `oauth_response_type` 'code' | 'token'
    - `passkey_enabled` boolean — Whether passkey login is enabled for this organization
    - `passkeys_registered` boolean — Whether the user has at least one passkey registered. Lets the login UI offer passkey authentication as an alternative to an MFA code. Discloses nothing that :beginPasskeyAuthentication doesn't already reveal for a known email address.

## Other responses

- `401` — Challenge token expired or assertion verification failed
- `404` — Credential not found

---

[API](https://skmtc.net/epilot/apis/user-api.md) · [All operations](https://skmtc.net/epilot/apis/user-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/epilot/user-api/versions/7fae886a3c99/schema)