Skip to main content

Delete WebAuthn Credential

Delete a WebAuthn credential from the user's account.

Quick Navigation

Endpoint

DELETE /api/v1/webauthn/credentials/{credential_id}

Headers

HeaderRequiredDescription
AuthorizationYesBearer <access_token>

Path Parameters

ParameterTypeRequiredDescription
credential_idintegerYesID of the WebAuthn credential to delete

Validations

  • Credential ID must exist
  • Credential must belong to current user

Response

Success (200)

{
"success": true,
"data": {
"success": true,
"message": "WebAuthn credential deleted successfully"
},
"message": "WebAuthn credential deleted successfully"
}

Error Codes

StatusCodeDescription
401UNAUTHORIZEDInvalid or missing token
404CREDENTIAL_NOT_FOUNDCredential not found or doesn't belong to user
500CREDENTIAL_DELETION_FAILEDInternal server error

Data Flow

  1. Authentication

    • Verify access token
    • Get current user
  2. Credential Validation

    • Query WebAuthnCredential table
    • Verify credential exists and belongs to user
  3. Credential Deletion

    • Delete credential from database
    • Remove public key data
  4. User Status Update

    • If last credential: Update user's WebAuthn status
    • Disable WebAuthn if no credentials remain
  5. Audit Logging

    • Log credential deletion event
    • Record credential information
  6. Response

    • Return success confirmation

Features

  • Remove credential from database
  • Update user's WebAuthn status
  • Audit logging
  • Prevents removal of non-existent credentials
  • Prevents removal of other users' credentials

Important Notes

  • Removing the last credential disables WebAuthn for the user
  • User can register new credentials anytime
  • Credential deletion is permanent

Example

curl -X DELETE https://api.rivergen.com/api/v1/webauthn/credentials/1 \
-H "Authorization: Bearer <access_token>"