Introduction

This document is about the APIs of the LINE FIDO2 Server application that has been released as open-source.

These define the messages exchanged between the RP server and LINE FIDO2 server.

For more information, please see README.md at the link below.

Basically, FIDO2 has the following operations - Registration, Authentication.

Example APIs worked like this:

Registration

Registration consists of two APIs: an API for requesting a challenge, and an API for delivering the results of the client’s registration.

Get Reg Challenge

HTTP request
POST /fido2/reg/challenge HTTP/1.1
Content-Type: application/json
Content-Length: 444
Host: localhost:8080

{
  "rp" : {
    "name" : "Test RP",
    "icon" : null,
    "id" : "localhost"
  },
  "user" : {
    "name" : "TestUser",
    "icon" : null,
    "id" : "65fUCTlqPlOSk22tkrkJ2m8I2MEhpF4fCI_pdosMAzk",
    "displayName" : "Test Display Name"
  },
  "authenticatorSelection" : {
    "authenticatorAttachment" : "platform",
    "requireResidentKey" : true,
    "userVerification" : "preferred"
  },
  "attestation" : "none",
  "credProtect" : null
}
HTTP response
HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 1471

{
  "serverResponse" : {
    "description" : null,
    "internalError" : "SUCCESS",
    "internalErrorCode" : 0,
    "internalErrorCodeDescription" : null
  },
  "rp" : {
    "name" : "example1",
    "icon" : null,
    "id" : "localhost"
  },
  "user" : {
    "name" : "TestUser",
    "icon" : null,
    "id" : "65fUCTlqPlOSk22tkrkJ2m8I2MEhpF4fCI_pdosMAzk",
    "displayName" : "Test Display Name"
  },
  "challenge" : "XR2NGK0HZW1-gUeuaPoLpf48ZFjz0sN2e5QfWZN7aIgjeXPksmJmJ0F0Oq9DHGZ74EvzejyEW6PHADMLxdqeng",
  "pubKeyCredParams" : [ {
    "type" : "public-key",
    "alg" : -65535
  }, {
    "type" : "public-key",
    "alg" : -257
  }, {
    "type" : "public-key",
    "alg" : -258
  }, {
    "type" : "public-key",
    "alg" : -259
  }, {
    "type" : "public-key",
    "alg" : -37
  }, {
    "type" : "public-key",
    "alg" : -38
  }, {
    "type" : "public-key",
    "alg" : -39
  }, {
    "type" : "public-key",
    "alg" : -7
  }, {
    "type" : "public-key",
    "alg" : -35
  }, {
    "type" : "public-key",
    "alg" : -36
  }, {
    "type" : "public-key",
    "alg" : -8
  }, {
    "type" : "public-key",
    "alg" : -43
  } ],
  "timeout" : 180000,
  "excludeCredentials" : [ ],
  "authenticatorSelection" : {
    "authenticatorAttachment" : "platform",
    "requireResidentKey" : true,
    "userVerification" : "preferred"
  },
  "attestation" : "none",
  "sessionId" : "6f5a8fbb-e801-4077-9b90-f5598a419604",
  "extensions" : {
    "credProps" : true
  }
}

Send Reg Response

HTTP request
POST /fido2/reg/response HTTP/1.1
Content-Type: application/json
Content-Length: 1331
Host: localhost:8080

{
  "serverPublicKeyCredential" : {
    "id" : "AYF-hoBThKTDPlpZs5i-xXCmPppyXuqEf8g0PpBclsJaSqnxOkC3qa3QVAdLeyBav-1cqnRhhB34YPsjQuN2DlH0AlGDNisTU6mi3TQRnOUSqodRkZKAPKnwx6s",
    "type" : "public-key",
    "response" : {
      "clientDataJSON" : "eyJ0eXBlIjoid2ViYXV0aG4uY3JlYXRlIiwiY2hhbGxlbmdlIjoiSGw5eU4xRkh0T01ZdjJqOE1PVENQcmhRRFRSSGQ2Y2VCenFtMkhrMGxqTl9tR24yaUR6RzN5UGxoNEwtVTdzWTljc2FPZ1ZpWmJIZ0o5RU5xRDROMFEiLCJvcmlnaW4iOiJodHRwOi8vbG9jYWxob3N0OjgwODAiLCJjcm9zc09yaWdpbiI6ZmFsc2V9",
      "attestationObject" : "o2NmbXRkbm9uZWdhdHRTdG10oGhhdXRoRGF0YVjgSZYN5YgOjGh0NBcPZHZgW4_krrmihjLHmVzzuoMdl2NFYW-p8K3OAAI1vMYKZIsLJfHwVQMAXAGBfoaAU4Skwz5aWbOYvsVwpj6acl7qhH_IND6QXJbCWkqp8TpAt6mt0FQHS3sgWr_tXKp0YYQd-GD7I0Ljdg5R9AJRgzYrE1Opot00EZzlEqqHUZGSgDyp8MerpQECAyYgASFYIIhbKqrHnS6kY-g57es_NRLrr7MUVaM1MNnjxYAjRFQYIlggKx3lFHU9zGTbdG2FSKqZODGdf47oYb-1SiCleHSTDgk",
      "transports" : [ "internal" ]
    },
    "extensions" : {
      "appid" : null,
      "txAuthSimple" : null,
      "txAuthGeneric" : null,
      "authnSel" : null,
      "exts" : null,
      "uvi" : null,
      "loc" : null,
      "biometricPerfBounds" : null,
      "credProps" : {
        "rk" : true
      }
    }
  },
  "sessionId" : "fde89293-9dd4-4244-b7db-1df1086c7bc9",
  "origin" : "http://localhost:8080",
  "rpId" : "localhost",
  "tokenBinding" : null
}
HTTP response
HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 475

{
  "serverResponse" : {
    "description" : null,
    "internalError" : "SUCCESS",
    "internalErrorCode" : 0,
    "internalErrorCodeDescription" : null
  },
  "aaguid" : "adce0002-35bc-c60a-648b-0b25f1f05503",
  "credentialId" : "AYF-hoBThKTDPlpZs5i-xXCmPppyXuqEf8g0PpBclsJaSqnxOkC3qa3QVAdLeyBav-1cqnRhhB34YPsjQuN2DlH0AlGDNisTU6mi3TQRnOUSqodRkZKAPKnwx6s",
  "attestationType" : "NONE",
  "authenticatorTransports" : [ "internal" ],
  "userVerified" : true,
  "rk" : true
}

Authentication

Authentication consists of two APIs: an API for requesting a challenge and an API for delivering the client’s authentication result.

Get Auth Challenge

HTTP request
POST /fido2/auth/challenge HTTP/1.1
Content-Type: application/json
Content-Length: 122
Host: localhost:8080

{
  "rpId" : "localhost",
  "userId" : "65fUCTlqPlOSk22tkrkJ2m8I2MEhpF4fCI_pdosMAzk",
  "userVerification" : "preferred"
}
HTTP response
HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 624

{
  "serverResponse" : {
    "description" : null,
    "internalError" : "SUCCESS",
    "internalErrorCode" : 0,
    "internalErrorCodeDescription" : null
  },
  "challenge" : "nf15HXQ11EdR8ckcVJn-UDt59rHSnOF0JEgB53W65CZX2IL1pAf22XEIXnGnkCHssogQZ4VWHfDa3u7VSScEkw",
  "timeout" : 180000,
  "rpId" : "localhost",
  "allowCredentials" : [ {
    "type" : "public-key",
    "id" : "AUTjvBgL29DEg4aoRVchh4KSi9cLUmNuL4JqH4H8RTvKaBVDu88CnXGHDTkpIag5ODydvM-UP5FgqzDzzM3A_tzLSeoWc7hnkQK3g0N0jifjatDHgXX6YmMVAJc"
  } ],
  "userVerification" : "preferred",
  "sessionId" : "048fc496-7de8-41e7-acf7-6da60885f436",
  "extensions" : { }
}

Send Auth Response

HTTP request
POST /fido2/auth/response HTTP/1.1
Content-Type: application/json
Content-Length: 1310
Host: localhost:8080

{
  "serverPublicKeyCredential" : {
    "id" : "AUTjvBgL29DEg4aoRVchh4KSi9cLUmNuL4JqH4H8RTvKaBVDu88CnXGHDTkpIag5ODydvM-UP5FgqzDzzM3A_tzLSeoWc7hnkQK3g0N0jifjatDHgXX6YmMVAJc",
    "type" : "public-key",
    "response" : {
      "clientDataJSON" : "eyJ0eXBlIjoid2ViYXV0aG4uZ2V0IiwiY2hhbGxlbmdlIjoid19aOGctaklHdW5GYkM4S1g5THU0MThVUHV5RmNxQTlnM2ZqajVQRC1OdFYyWXA3R3dxeHdYdXJFNnRSZkp5V29rS21wV2R5c1VSS3lXRDRYNjJFb0EiLCJvcmlnaW4iOiJodHRwOi8vbG9jYWxob3N0OjgwODAiLCJjcm9zc09yaWdpbiI6ZmFsc2UsIm90aGVyX2tleXNfY2FuX2JlX2FkZGVkX2hlcmUiOiJkbyBub3QgY29tcGFyZSBjbGllbnREYXRhSlNPTiBhZ2FpbnN0IGEgdGVtcGxhdGUuIFNlZSBodHRwczovL2dvby5nbC95YWJQZXgifQ",
      "authenticatorData" : "SZYN5YgOjGh0NBcPZHZgW4_krrmihjLHmVzzuoMdl2MFYW-4ew",
      "signature" : "MEYCIQC74yVXB6oz66Y1hfahBYnHvrhl42p8l2PWpGIPv2EgEgIhAM8ooggslk3efQhiulISGw489JMPQqTWjj0kRXvgc61G",
      "userHandle" : "65fUCTlqPlOSk22tkrkJ2m8I2MEhpF4fCI_pdosMAzk"
    },
    "extensions" : {
      "appid" : null,
      "txAuthSimple" : null,
      "txAuthGeneric" : null,
      "authnSel" : null,
      "exts" : null,
      "uvi" : null,
      "loc" : null,
      "biometricPerfBounds" : null,
      "credProps" : null
    }
  },
  "sessionId" : "c05c782a-77ca-4721-b523-19389bfcf3d7",
  "origin" : "http://localhost:8080",
  "rpId" : "localhost",
  "tokenBinding" : null
}
HTTP response
HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 322

{
  "serverResponse" : {
    "description" : null,
    "internalError" : "SUCCESS",
    "internalErrorCode" : 0,
    "internalErrorCodeDescription" : null
  },
  "aaguid" : "adce0002-35bc-c60a-648b-0b25f1f05503",
  "userId" : "65fUCTlqPlOSk22tkrkJ2m8I2MEhpF4fCI_pdosMAzk",
  "userVerified" : true,
  "userPresent" : true
}

Credential API

These are not within the scope of the WebAuthn specification but its own APIs.

Get Credential by CredentialId

HTTP request
GET /fido2/credentials/AUTjvBgL29DEg4aoRVchh4KSi9cLUmNuL4JqH4H8RTvKaBVDu88CnXGHDTkpIag5ODydvM-UP5FgqzDzzM3A_tzLSeoWc7hnkQK3g0N0jifjatDHgXX6YmMVAJc?rpId=localhost HTTP/1.1
Host: localhost:8080
Path parameters
Table 1. /fido2/credentials/{id}
Parameter Description

id

credential Id

Request parameters

Parameter

Required

Description

rpId

true

RP Id

HTTP response
HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 966

{
  "serverResponse" : {
    "description" : null,
    "internalError" : "SUCCESS",
    "internalErrorCode" : 0,
    "internalErrorCodeDescription" : null
  },
  "credential" : {
    "rpId" : "localhost",
    "id" : "65fUCTlqPlOSk22tkrkJ2m8I2MEhpF4fCI_pdosMAzk",
    "name" : "TestUser",
    "icon" : null,
    "displayName" : "Test Display Name",
    "aaguid" : "adce0002-35bc-c60a-648b-0b25f1f05503",
    "credentialId" : "AUTjvBgL29DEg4aoRVchh4KSi9cLUmNuL4JqH4H8RTvKaBVDu88CnXGHDTkpIag5ODydvM-UP5FgqzDzzM3A_tzLSeoWc7hnkQK3g0N0jifjatDHgXX6YmMVAJc",
    "publicKey" : "MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE6A7PJ7L7xHAP3wrd1i6Th9ep8KmOi8slCeT2SjREtuFDJfoF1L42dzgww2adGGq7cjYspbjl9YvJA-sr9R2sOg",
    "algorithm" : "ES256",
    "signCounter" : 1634711283,
    "attestationType" : "NONE",
    "transports" : null,
    "rk" : true,
    "credProtect" : 1,
    "registeredAt" : "2021-10-20T06:27:17.595+00:00",
    "authenticatedAt" : "2021-10-20T06:28:08.530+00:00"
  }
}

Get Credential by UserId

HTTP request
GET /fido2/credentials?rpId=localhost&userId=65fUCTlqPlOSk22tkrkJ2m8I2MEhpF4fCI_pdosMAzk HTTP/1.1
Host: localhost:8080
Request parameters

Parameter

Required

Description

rpId

true

RP Id

userId

true

User Id

HTTP response
HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 971

{
  "serverResponse" : {
    "description" : null,
    "internalError" : "SUCCESS",
    "internalErrorCode" : 0,
    "internalErrorCodeDescription" : null
  },
  "credentials" : [ {
    "rpId" : "localhost",
    "id" : "65fUCTlqPlOSk22tkrkJ2m8I2MEhpF4fCI_pdosMAzk",
    "name" : "TestUser",
    "icon" : null,
    "displayName" : "Test Display Name",
    "aaguid" : "adce0002-35bc-c60a-648b-0b25f1f05503",
    "credentialId" : "AUTjvBgL29DEg4aoRVchh4KSi9cLUmNuL4JqH4H8RTvKaBVDu88CnXGHDTkpIag5ODydvM-UP5FgqzDzzM3A_tzLSeoWc7hnkQK3g0N0jifjatDHgXX6YmMVAJc",
    "publicKey" : "MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE6A7PJ7L7xHAP3wrd1i6Th9ep8KmOi8slCeT2SjREtuFDJfoF1L42dzgww2adGGq7cjYspbjl9YvJA-sr9R2sOg",
    "algorithm" : "ES256",
    "signCounter" : 1634711283,
    "attestationType" : "NONE",
    "transports" : null,
    "rk" : true,
    "credProtect" : 1,
    "registeredAt" : "2021-10-20T06:27:17.595+00:00",
    "authenticatedAt" : "2021-10-20T06:28:08.530+00:00"
  } ]
}

Delete Credential by CredentialId

HTTP request
DELETE /fido2/credentials/AUTjvBgL29DEg4aoRVchh4KSi9cLUmNuL4JqH4H8RTvKaBVDu88CnXGHDTkpIag5ODydvM-UP5FgqzDzzM3A_tzLSeoWc7hnkQK3g0N0jifjatDHgXX6YmMVAJc?rpId=localhost HTTP/1.1
Host: localhost:8080
Path parameters
Table 1. /fido2/credentials/{id}
Parameter Description

id

credential Id

Request parameters

Parameter

Required

Description

rpId

true

RP Id

HTTP response
HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 160

{
  "serverResponse" : {
    "description" : null,
    "internalError" : "SUCCESS",
    "internalErrorCode" : 0,
    "internalErrorCodeDescription" : null
  }
}

Delete Credential by UserId

HTTP request
DELETE /fido2/credentials?rpId=localhost&userId=65fUCTlqPlOSk22tkrkJ2m8I2MEhpF4fCI_pdosMAzk HTTP/1.1
Host: localhost:8080
Request parameters

Parameter

Required

Description

rpId

true

RP Id

userId

true

User Id

HTTP response
HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 160

{
  "serverResponse" : {
    "description" : null,
    "internalError" : "SUCCESS",
    "internalErrorCode" : 0,
    "internalErrorCodeDescription" : null
  }
}

Health Check

This is not within the scope of the WebAuthn specification but its own API.

Get Health Check Status

HTTP request

GET /health HTTP/1.1
Host: localhost:8080

HTTP response

HTTP/1.1 200 OK
Content-Type: text/plain;charset=UTF-8
Content-Length: 2

OK