# Register for logged-out user

Complete WebAuthn credential registration for a new user (in Transmit) or a user that isn't currently logged in via Transmit. This API must be called from the backend using a client access token. If successful, the credentials will be registered for the user corresponding to the external user ID in the request. If no user is found, a new user will be created.

Endpoint: POST /v1/auth/webauthn/external/register
Security: ClientAccessToken

## Security:

  - `ClientAccessToken` (unknown)
    oauth2

## Request fields (application/json):

  - `webauthn_encoded_result` (string, required)
    WebAuthn attestation data returned by the browser upon credential creation. If the credential was created using `navigator.credentials.create()`, call `toJSON()` on the returned `PublicKeyCredential` before sending it to the backend. Optionally include `deviceInfo` (`publicKeyId`, `publicKey`) in the same object to bind the device to the user, so it appears in the `device_keys` claim of the ID token after passkey login.

  - `device_id` (string)
    The device associated with this registration.

  - `external_user_id` (string, required)
    A unique identifier in the tenant, which corresponds to an identifier of the user in your system.

  - `user_email` (string)
    The user's primary email address

## Response 200:

  - `200` (unknown)
    Registered credential details

## Response 200 fields (application/json):

  - `webauthn_session_id` (string, required)
    WebAuthn session identifier

  - `user_id` (string)
    Transmit user ID, autogenerated upon user creation

  - `webauthn_username` (string, required)
    Name of user account, as specified in the WebAuthn registration

  - `credential_id` (string, required)
    WebAuthn credential ID

  - `authenticator_attachment` (string, required)
    The authenticators' attachment modalities. Cross-platform authenticator are external to the current device, such as a USB security key or a different device
    Enum: "platform", "cross-platform"

  - `aaguid` (string)
    The authenticator's AAGUID

  - `external_user_id` (string, required)
    External User identifier

  - `is_user_created` (boolean, required)
    Indicates if this is a new user or not

## Response 400:

  - `400` (unknown)
    Invalid encoded result, missing external user ID, client ID mismatch, or credential name already exists

## Response 400 fields (application/json):

  - `error_code` (string)
    Enum: "auth_webauthn_invalid_encoded_result", "user_external_user_id_missing", "client_id_mismatch", "auth_webauthn_credential_name_already_exists"

  - `message` (string)

## Response 401:

  - `401` (unknown)
    Invalid session, origin not allowed, invalid credentials, or invalid register token

## Response 401 fields (application/json):

  - `error_code` (string)
    Enum: "auth_webauthn_invalid_session", "auth_webauthn_origin_not_allowed", "auth_invalid_credentials", "auth_webauthn_invalid_register_cred_token"

  - `message` (string)

## Response 404 examples:

  - `ClientNotFound` (unknown)