# Start registration

Starts a registration of WebAuthn credentials for a specified user, returning a challenge to be signed by the client. If successful, the response contains a `credential_creation_options` field that should be passed to the WebAuthn `navigator.credentials.create()` API call. Note that some fields, such as `user.id` and `challenge`, are binary values represented as base64url-encoded strings. Before calling the WebAuthn API, parse the options using `PublicKeyCredential.parseCreationOptionsFromJSON()`.

Endpoint: POST /v1/auth/webauthn/register/start

## Request fields (application/json):

  - `client_id` (string, required)
    Your client ID.

  - `username` (string, required)
    Account name for this Relying Party. This is used both for display purposes, as well as during recovery flows where the user is asked for the account name.

  - `display_name` (string)
    Human-palatable name for the user account, only for display (max 64 characters).  If not set, the username parameter will also act as the display name

  - `timeout` (number)
    The timeout in seconds for the registration modal. 
    Must be between 30 and 600. 
    Default is 300 seconds.

  - `limit_single_credential_to_device` (boolean)
    Set to True in order to limit the creation of multiple credentials for the same account on a single authenticator. Default is False.

## Response 200 fields (application/json):

  - `webauthn_session_id` (string, required)
    WebAuthn session identifier

  - `credential_creation_options` (object, required)

  - `credential_creation_options.attestation` (string)
    Enum: "none"

  - `credential_creation_options.authenticatorSelection` (object)

  - `credential_creation_options.authenticatorSelection.authenticatorAttachment` (string)
    The authenticators' attachment modalities. Cross-platform authenticator are external to the current device, such as a USB security key or a different device
    Enum: "platform", "cross-platform"

  - `credential_creation_options.authenticatorSelection.requireResidentKey` (boolean)

  - `credential_creation_options.authenticatorSelection.residentKey` (object)

  - `credential_creation_options.authenticatorSelection.userVerification` (string)
    Enum: "preferred", "required"

  - `credential_creation_options.extensions` (object)

  - `credential_creation_options.extensions.appid` (string)

  - `credential_creation_options.extensions.credProps` (boolean)

  - `credential_creation_options.extensions.hmacCreateSecret` (boolean)

  - `credential_creation_options.excludeCredentials` (array)

  - `credential_creation_options.pubKeyCredParams` (array, required)

  - `credential_creation_options.pubKeyCredParams.alg` (number, required)

  - `credential_creation_options.pubKeyCredParams.type` (string, required)
    Key type. Should always be `public-key`
    Enum: "public-key"

  - `credential_creation_options.timeout` (number)

  - `credential_creation_options.challenge` (string, required)

  - `credential_creation_options.user` (object, required)

  - `credential_creation_options.user.id` (string, required)
    User handle

  - `credential_creation_options.user.name` (string, required)
    The webauthn username

  - `credential_creation_options.user.displayName` (string, required)
    The user display name

  - `credential_creation_options.rp` (object, required)

  - `credential_creation_options.rp.id` (string, required)
    Relying Party ID. Must be a valid domain pre-configured in the Admin Portal for the application

  - `credential_creation_options.rp.name` (string, required)
    Relying party displayable name

  - `credential_creation_options.rp.icon` (string, required)

## Response 400 fields (application/json):

  - `error_code` (string)
    Enum: "system_invalid_input", "auth_webauthn_invalid_webauthn_config"

  - `message` (string)

## Response 401 fields (application/json):

  - `error_code` (string)
    Enum: "auth_webauthn_invalid_origin_error"

  - `message` (string)

## Response 404 fields (application/json):

  - `error_code` (string)
    Enum: "client_not_exist", "auth_not_registered"

  - `message` (string)