# Register for logged-out user

Complete WebAuthn credential registration for a new user (in Transmit) or a user that isn't currently logged in via Transmit. This API must be called from the backend using a client access token. If successful, the credentials will be registered for the user corresponding to the external user ID in the request. If no user is found, a new user will be created.

Endpoint: POST /v1/auth/webauthn/external/register
Security: ClientAccessToken

## Request fields (application/json):

  - `webauthn_encoded_result` (string, required)
    WebAuthn attestation data returned by the browser upon credential creation. If the credential was created using navigator.credentials.create(), call toJSON() on the returned PublicKeyCredential before sending it to the backend. Optionally include deviceInfo (publicKeyId, publicKey) in the same object to bind the device to the user, so it appears in the device_keys claim of the ID token after passkey login.

  - `device_id` (string)
    The device associated with this registration.

  - `external_user_id` (string, required)
    A unique identifier in the tenant, which corresponds to an identifier of the user in your system.

  - `user_email` (string)
    The user's primary email address

## Response 200 fields (application/json):

  - `webauthn_session_id` (string, required)
    WebAuthn session identifier

  - `user_id` (string)
    Transmit user ID, autogenerated upon user creation

  - `webauthn_username` (string, required)
    Name of user account, as specified in the WebAuthn registration

  - `credential_id` (string, required)
    WebAuthn credential ID

  - `authenticator_attachment` (string, required)
    The authenticators' attachment modalities. Cross-platform authenticator are external to the current device, such as a USB security key or a different device
    Enum: "platform", "cross-platform"

  - `aaguid` (string)
    The authenticator's AAGUID

  - `external_user_id` (string, required)
    External User identifier

  - `is_user_created` (boolean, required)
    Indicates if this is a new user or not

## Response 400 fields (application/json):

  - `error_code` (string)
    Enum: "auth_webauthn_invalid_encoded_result", "user_external_user_id_missing", "client_id_mismatch", "auth_webauthn_credential_name_already_exists"

  - `message` (string)

## Response 401 fields (application/json):

  - `error_code` (string)
    Enum: "auth_webauthn_invalid_session", "auth_webauthn_origin_not_allowed", "auth_invalid_credentials", "auth_webauthn_invalid_register_cred_token"

  - `message` (string)


## Response 404 fields