Introduction

This document is about the APIs of the LINE FIDO2 Server application that has been released as open-source.

These define the messages exchanged between the RP server and LINE FIDO2 server.

For more information, please see README.md at the link below.

If you want to know the details of the WebAuthn standard, you can also refer to the official documentation.

Basically, FIDO2 has the following operations - Registration, Authentication.

Example APIs worked like this:

Registration

Registration consists of two APIs: an API for requesting a challenge, and an API for delivering the results of the client’s registration.

Get Reg Challenge

HTTP request
POST /fido2/reg/challenge HTTP/1.1
Content-Type: application/json
Content-Length: 444
Host: localhost:8080

{
  "rp" : {
    "name" : "Test RP",
    "icon" : null,
    "id" : "localhost"
  },
  "user" : {
    "name" : "TestUser",
    "icon" : null,
    "id" : "65fUCTlqPlOSk22tkrkJ2m8I2MEhpF4fCI_pdosMAzk",
    "displayName" : "Test Display Name"
  },
  "authenticatorSelection" : {
    "authenticatorAttachment" : "platform",
    "requireResidentKey" : true,
    "userVerification" : "preferred"
  },
  "attestation" : "none",
  "credProtect" : null
}
HTTP response
HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 1471

{
  "serverResponse" : {
    "description" : null,
    "internalError" : "SUCCESS",
    "internalErrorCode" : 0,
    "internalErrorCodeDescription" : null
  },
  "rp" : {
    "name" : "example1",
    "icon" : null,
    "id" : "localhost"
  },
  "user" : {
    "name" : "TestUser",
    "icon" : null,
    "id" : "65fUCTlqPlOSk22tkrkJ2m8I2MEhpF4fCI_pdosMAzk",
    "displayName" : "Test Display Name"
  },
  "challenge" : "TXgZfiz2B88oNbksOpC4GjNQ8YNaFzntXMBTMdN3K1XgIgKRr3FoXltAhV1zNmmdF4WJhxnoQDeq4s0bARhtRg",
  "pubKeyCredParams" : [ {
    "type" : "public-key",
    "alg" : -65535
  }, {
    "type" : "public-key",
    "alg" : -257
  }, {
    "type" : "public-key",
    "alg" : -258
  }, {
    "type" : "public-key",
    "alg" : -259
  }, {
    "type" : "public-key",
    "alg" : -37
  }, {
    "type" : "public-key",
    "alg" : -38
  }, {
    "type" : "public-key",
    "alg" : -39
  }, {
    "type" : "public-key",
    "alg" : -7
  }, {
    "type" : "public-key",
    "alg" : -35
  }, {
    "type" : "public-key",
    "alg" : -36
  }, {
    "type" : "public-key",
    "alg" : -8
  }, {
    "type" : "public-key",
    "alg" : -43
  } ],
  "timeout" : 180000,
  "excludeCredentials" : [ ],
  "authenticatorSelection" : {
    "authenticatorAttachment" : "platform",
    "requireResidentKey" : true,
    "userVerification" : "preferred"
  },
  "attestation" : "none",
  "sessionId" : "8bfc693e-8582-45e1-ad08-e2b71901cc97",
  "extensions" : {
    "credProps" : true
  }
}

Send Reg Response

HTTP request
POST /fido2/reg/response HTTP/1.1
Content-Type: application/json
Content-Length: 1331
Host: localhost:8080

{
  "serverPublicKeyCredential" : {
    "id" : "AYF-hoBThKTDPlpZs5i-xXCmPppyXuqEf8g0PpBclsJaSqnxOkC3qa3QVAdLeyBav-1cqnRhhB34YPsjQuN2DlH0AlGDNisTU6mi3TQRnOUSqodRkZKAPKnwx6s",
    "type" : "public-key",
    "response" : {
      "clientDataJSON" : "eyJ0eXBlIjoid2ViYXV0aG4uY3JlYXRlIiwiY2hhbGxlbmdlIjoiSGw5eU4xRkh0T01ZdjJqOE1PVENQcmhRRFRSSGQ2Y2VCenFtMkhrMGxqTl9tR24yaUR6RzN5UGxoNEwtVTdzWTljc2FPZ1ZpWmJIZ0o5RU5xRDROMFEiLCJvcmlnaW4iOiJodHRwOi8vbG9jYWxob3N0OjgwODAiLCJjcm9zc09yaWdpbiI6ZmFsc2V9",
      "attestationObject" : "o2NmbXRkbm9uZWdhdHRTdG10oGhhdXRoRGF0YVjgSZYN5YgOjGh0NBcPZHZgW4_krrmihjLHmVzzuoMdl2NFYW-p8K3OAAI1vMYKZIsLJfHwVQMAXAGBfoaAU4Skwz5aWbOYvsVwpj6acl7qhH_IND6QXJbCWkqp8TpAt6mt0FQHS3sgWr_tXKp0YYQd-GD7I0Ljdg5R9AJRgzYrE1Opot00EZzlEqqHUZGSgDyp8MerpQECAyYgASFYIIhbKqrHnS6kY-g57es_NRLrr7MUVaM1MNnjxYAjRFQYIlggKx3lFHU9zGTbdG2FSKqZODGdf47oYb-1SiCleHSTDgk",
      "transports" : [ "internal" ]
    },
    "extensions" : {
      "appid" : null,
      "txAuthSimple" : null,
      "txAuthGeneric" : null,
      "authnSel" : null,
      "exts" : null,
      "uvi" : null,
      "loc" : null,
      "biometricPerfBounds" : null,
      "credProps" : {
        "rk" : true
      }
    }
  },
  "sessionId" : "fde89293-9dd4-4244-b7db-1df1086c7bc9",
  "origin" : "http://localhost:8080",
  "rpId" : "localhost",
  "tokenBinding" : null
}
HTTP response
HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 475

{
  "serverResponse" : {
    "description" : null,
    "internalError" : "SUCCESS",
    "internalErrorCode" : 0,
    "internalErrorCodeDescription" : null
  },
  "aaguid" : "adce0002-35bc-c60a-648b-0b25f1f05503",
  "credentialId" : "AYF-hoBThKTDPlpZs5i-xXCmPppyXuqEf8g0PpBclsJaSqnxOkC3qa3QVAdLeyBav-1cqnRhhB34YPsjQuN2DlH0AlGDNisTU6mi3TQRnOUSqodRkZKAPKnwx6s",
  "attestationType" : "NONE",
  "authenticatorTransports" : [ "internal" ],
  "userVerified" : true,
  "rk" : true
}

Authentication

Authentication consists of two APIs: an API for requesting a challenge and an API for delivering the client’s authentication result.

Get Auth Challenge

HTTP request
POST /fido2/auth/challenge HTTP/1.1
Content-Type: application/json
Content-Length: 122
Host: localhost:8080

{
  "rpId" : "localhost",
  "userId" : "65fUCTlqPlOSk22tkrkJ2m8I2MEhpF4fCI_pdosMAzk",
  "userVerification" : "preferred"
}
HTTP response
HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 624

{
  "serverResponse" : {
    "description" : null,
    "internalError" : "SUCCESS",
    "internalErrorCode" : 0,
    "internalErrorCodeDescription" : null
  },
  "challenge" : "7ZKNccKcYL0Rky0YqVx-_-yHDudCPScBayiw17arUfzpAfqa-A8nv-OmQbSLMHtpEE0rp0MbblIzLw-bE5x6zQ",
  "timeout" : 180000,
  "rpId" : "localhost",
  "allowCredentials" : [ {
    "type" : "public-key",
    "id" : "AUTjvBgL29DEg4aoRVchh4KSi9cLUmNuL4JqH4H8RTvKaBVDu88CnXGHDTkpIag5ODydvM-UP5FgqzDzzM3A_tzLSeoWc7hnkQK3g0N0jifjatDHgXX6YmMVAJc"
  } ],
  "userVerification" : "preferred",
  "sessionId" : "3d310653-8d7a-449e-975e-30a467dfbe9a",
  "extensions" : { }
}

Send Auth Response

HTTP request
POST /fido2/auth/response HTTP/1.1
Content-Type: application/json
Content-Length: 1310
Host: localhost:8080

{
  "serverPublicKeyCredential" : {
    "id" : "AUTjvBgL29DEg4aoRVchh4KSi9cLUmNuL4JqH4H8RTvKaBVDu88CnXGHDTkpIag5ODydvM-UP5FgqzDzzM3A_tzLSeoWc7hnkQK3g0N0jifjatDHgXX6YmMVAJc",
    "type" : "public-key",
    "response" : {
      "clientDataJSON" : "eyJ0eXBlIjoid2ViYXV0aG4uZ2V0IiwiY2hhbGxlbmdlIjoid19aOGctaklHdW5GYkM4S1g5THU0MThVUHV5RmNxQTlnM2ZqajVQRC1OdFYyWXA3R3dxeHdYdXJFNnRSZkp5V29rS21wV2R5c1VSS3lXRDRYNjJFb0EiLCJvcmlnaW4iOiJodHRwOi8vbG9jYWxob3N0OjgwODAiLCJjcm9zc09yaWdpbiI6ZmFsc2UsIm90aGVyX2tleXNfY2FuX2JlX2FkZGVkX2hlcmUiOiJkbyBub3QgY29tcGFyZSBjbGllbnREYXRhSlNPTiBhZ2FpbnN0IGEgdGVtcGxhdGUuIFNlZSBodHRwczovL2dvby5nbC95YWJQZXgifQ",
      "authenticatorData" : "SZYN5YgOjGh0NBcPZHZgW4_krrmihjLHmVzzuoMdl2MFYW-4ew",
      "signature" : "MEYCIQC74yVXB6oz66Y1hfahBYnHvrhl42p8l2PWpGIPv2EgEgIhAM8ooggslk3efQhiulISGw489JMPQqTWjj0kRXvgc61G",
      "userHandle" : "65fUCTlqPlOSk22tkrkJ2m8I2MEhpF4fCI_pdosMAzk"
    },
    "extensions" : {
      "appid" : null,
      "txAuthSimple" : null,
      "txAuthGeneric" : null,
      "authnSel" : null,
      "exts" : null,
      "uvi" : null,
      "loc" : null,
      "biometricPerfBounds" : null,
      "credProps" : null
    }
  },
  "sessionId" : "c05c782a-77ca-4721-b523-19389bfcf3d7",
  "origin" : "http://localhost:8080",
  "rpId" : "localhost",
  "tokenBinding" : null
}
HTTP response
HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 322

{
  "serverResponse" : {
    "description" : null,
    "internalError" : "SUCCESS",
    "internalErrorCode" : 0,
    "internalErrorCodeDescription" : null
  },
  "aaguid" : "adce0002-35bc-c60a-648b-0b25f1f05503",
  "userId" : "65fUCTlqPlOSk22tkrkJ2m8I2MEhpF4fCI_pdosMAzk",
  "userVerified" : true,
  "userPresent" : true
}

Credential API

These are not within the scope of the WebAuthn specification but its own APIs.

Get Credential by CredentialId

HTTP request
GET /fido2/credentials/AUTjvBgL29DEg4aoRVchh4KSi9cLUmNuL4JqH4H8RTvKaBVDu88CnXGHDTkpIag5ODydvM-UP5FgqzDzzM3A_tzLSeoWc7hnkQK3g0N0jifjatDHgXX6YmMVAJc?rpId=localhost HTTP/1.1
Host: localhost:8080
Path parameters
Table 1. /fido2/credentials/{id}
Parameter Description

id

credential Id

Request parameters

Parameter

Required

Description

rpId

true

RP Id

HTTP response
HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 966

{
  "serverResponse" : {
    "description" : null,
    "internalError" : "SUCCESS",
    "internalErrorCode" : 0,
    "internalErrorCodeDescription" : null
  },
  "credential" : {
    "rpId" : "localhost",
    "id" : "65fUCTlqPlOSk22tkrkJ2m8I2MEhpF4fCI_pdosMAzk",
    "name" : "TestUser",
    "icon" : null,
    "displayName" : "Test Display Name",
    "aaguid" : "adce0002-35bc-c60a-648b-0b25f1f05503",
    "credentialId" : "AUTjvBgL29DEg4aoRVchh4KSi9cLUmNuL4JqH4H8RTvKaBVDu88CnXGHDTkpIag5ODydvM-UP5FgqzDzzM3A_tzLSeoWc7hnkQK3g0N0jifjatDHgXX6YmMVAJc",
    "publicKey" : "MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE6A7PJ7L7xHAP3wrd1i6Th9ep8KmOi8slCeT2SjREtuFDJfoF1L42dzgww2adGGq7cjYspbjl9YvJA-sr9R2sOg",
    "algorithm" : "ES256",
    "signCounter" : 1634711283,
    "attestationType" : "NONE",
    "transports" : null,
    "rk" : true,
    "credProtect" : 1,
    "registeredAt" : "2021-10-20T06:27:17.595+00:00",
    "authenticatedAt" : "2021-10-20T06:28:08.530+00:00"
  }
}

Get Credential by UserId

HTTP request
GET /fido2/credentials?rpId=localhost&userId=65fUCTlqPlOSk22tkrkJ2m8I2MEhpF4fCI_pdosMAzk HTTP/1.1
Host: localhost:8080
Request parameters

Parameter

Required

Description

rpId

true

RP Id

userId

true

User Id

HTTP response
HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 971

{
  "serverResponse" : {
    "description" : null,
    "internalError" : "SUCCESS",
    "internalErrorCode" : 0,
    "internalErrorCodeDescription" : null
  },
  "credentials" : [ {
    "rpId" : "localhost",
    "id" : "65fUCTlqPlOSk22tkrkJ2m8I2MEhpF4fCI_pdosMAzk",
    "name" : "TestUser",
    "icon" : null,
    "displayName" : "Test Display Name",
    "aaguid" : "adce0002-35bc-c60a-648b-0b25f1f05503",
    "credentialId" : "AUTjvBgL29DEg4aoRVchh4KSi9cLUmNuL4JqH4H8RTvKaBVDu88CnXGHDTkpIag5ODydvM-UP5FgqzDzzM3A_tzLSeoWc7hnkQK3g0N0jifjatDHgXX6YmMVAJc",
    "publicKey" : "MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE6A7PJ7L7xHAP3wrd1i6Th9ep8KmOi8slCeT2SjREtuFDJfoF1L42dzgww2adGGq7cjYspbjl9YvJA-sr9R2sOg",
    "algorithm" : "ES256",
    "signCounter" : 1634711283,
    "attestationType" : "NONE",
    "transports" : null,
    "rk" : true,
    "credProtect" : 1,
    "registeredAt" : "2021-10-20T06:27:17.595+00:00",
    "authenticatedAt" : "2021-10-20T06:28:08.530+00:00"
  } ]
}

Delete Credential by CredentialId

HTTP request
DELETE /fido2/credentials/AUTjvBgL29DEg4aoRVchh4KSi9cLUmNuL4JqH4H8RTvKaBVDu88CnXGHDTkpIag5ODydvM-UP5FgqzDzzM3A_tzLSeoWc7hnkQK3g0N0jifjatDHgXX6YmMVAJc?rpId=localhost HTTP/1.1
Host: localhost:8080
Path parameters
Table 1. /fido2/credentials/{id}
Parameter Description

id

credential Id

Request parameters

Parameter

Required

Description

rpId

true

RP Id

HTTP response
HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 160

{
  "serverResponse" : {
    "description" : null,
    "internalError" : "SUCCESS",
    "internalErrorCode" : 0,
    "internalErrorCodeDescription" : null
  }
}

Delete Credential by UserId

HTTP request
DELETE /fido2/credentials?rpId=localhost&userId=65fUCTlqPlOSk22tkrkJ2m8I2MEhpF4fCI_pdosMAzk HTTP/1.1
Host: localhost:8080
Request parameters

Parameter

Required

Description

rpId

true

RP Id

userId

true

User Id

HTTP response
HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 160

{
  "serverResponse" : {
    "description" : null,
    "internalError" : "SUCCESS",
    "internalErrorCode" : 0,
    "internalErrorCodeDescription" : null
  }
}

Health Check

This is not within the scope of the WebAuthn specification but its own API.

Get Health Check Status

HTTP request

GET /health HTTP/1.1
Host: localhost:8080

HTTP response

HTTP/1.1 200 OK
Content-Type: text/plain;charset=UTF-8
Content-Length: 2

OK