# Device keys

**Device keys** are used to cryptographically bind devices to a user for strong device identification. This allows the device to act as a user-identifying factor, and allows elevating trust for known devices. <br><br> These APIs are used to manage and verify bound devices for a user and application. The device may correspond to either a browser (for web apps) or a mobile device (for mobile apps).<br><br>Device binding relies on a cryptographic key-pair generated by the device. The private key is securely stored on the device (typically protected by biometrics or a PIN), while the public key is stored by Transmit for a given user. When needed, the device uses the private key to sign a challenge that Transmit verifies using the public key.<br><br>**Note: This feature requires the client to implement the relevant cryptography APIs exposed by the browser or mobile platform (Android or iOS).**


## Servers

Sandbox environment
```
https://api.sbx.transmitsecurity.io/cis
```

US production environment
```
https://api.transmitsecurity.io/cis
```

EU production environment
```
https://api.eu.transmitsecurity.io/cis
```

CA production environment
```
https://api.ca.transmitsecurity.io/cis
```

AU production environment
```
https://api.au.transmitsecurity.io/cis
```

JP production environment
```
https://api.gasne1-ts01.transmitsecurity.io/cis
```

## Security

### bearer

Type: http
Scheme: bearer
Bearer Format: JWT

### UserAccessToken

A token returned upon end-user authentication, which provides access to resources and data for the user and app for which it was generated

Type: http
Scheme: bearer
Bearer Format: JWT

### AdminAccessToken

[object Object]

Type: oauth2
Token URL: /oidc/token
Scopes:

### ClientAccessToken

[object Object]

Type: oauth2
Token URL: /oidc/token
Scopes:

### OrgAdminAccessToken

A token returned upon B2B authentication for a user that has the organizationAdmin or organizationCreator role.

Type: oauth2
Token URL: /oidc/token
Scopes:

## Download OpenAPI description

 - [Device keys](https://developer.transmitsecurity.com/_bundle/openapi/user/device-key.openapi.yaml)

 - [POST /v1/users/{user_id}/device-keys](https://developer.transmitsecurity.com/openapi/user/device-key.openapi/other/createdevicekeys.md): Registers a device key in the platform for a specific user and app. Device keys are generated by the client using the relevant cryptography APIs exposed by the browser or mobile platform (Android or i
 - [GET /v1/users/{user_id}/device-keys](https://developer.transmitsecurity.com/openapi/user/device-key.openapi/other/getdevicekeysforuser.md): Retrieves all the device keys registered for a specific user. This can be used to display a list of the user's devices. <br><br>**Required permissions**: `apps:read`, `[appId]:read`, `devices:read`, `
 - [GET /v1/users/{user_id}/device-keys/{key_id}](https://developer.transmitsecurity.com/openapi/user/device-key.openapi/other/getdevicekeys.md): Retrieves a specific device key. For example, this can be used to verify that the device key exists and is active. <br><br>**Required permissions**: `apps:read`, `[appId]:read`, `devices:read`.
 - [PUT /v1/users/{user_id}/device-keys/{key_id}](https://developer.transmitsecurity.com/openapi/user/device-key.openapi/other/updatedevicekey.md): Updates the metadata of a device key, such as the friendly device name or other custom data. <br><br>**Required permissions**: `apps:edit`, `[appId]:edit`, `devices:edit`.
 - [DELETE /v1/users/{user_id}/device-keys/{key_id}](https://developer.transmitsecurity.com/openapi/user/device-key.openapi/other/deletedevicekeys.md): Unregisters the user's device. For example, it can be used in case the device is lost, stolen, or no longer in the user's possession. <br><br>**Required permissions**: `apps:delete`, `[appId]:delete`,
 - [POST /v1/users/{user_id}/device-keys/{key_id}/validate](https://developer.transmitsecurity.com/openapi/user/device-key.openapi/other/validatedevicekeys.md): Verifies that the user's device is in their possession. Before calling this API, the device signs a challenge using the private key stored by the device. This API is used to verify the signed challeng
 - [PUT /v1/users/{user_id}/device-keys/{key_id}/block](https://developer.transmitsecurity.com/openapi/user/device-key.openapi/other/blockdevicekey.md): Block a user's device. Once blocked, the device status will be `Blocked` and device validation will fail if requested. <br><br>**Required permissions**: `apps:edit`, `[appId]:edit`, `devices:edit`.
 - [PUT /v1/users/{user_id}/device-keys/{key_id}/unblock](https://developer.transmitsecurity.com/openapi/user/device-key.openapi/other/unblockdevicekey.md): Unblocks a user's device. Once unblocked, the device status returns to `Active` and the device can be verified using the device key. <br><br>**Required permissions**: `apps:edit`, `[appId]:edit`, `dev