⌘ K
OpenAPI

BUILD

Passkey step-up

High-impact mutations require a recent passkey step-up in addition to the active session.

POST/api/auth/step-up/passkey/options

Issue a step-up challenge

This operation is part of the public Lucion Identity contract.

Safe request
curl -X POST 'https://identity.lucionglobal.com/api/auth/step-up/passkey/options'
  -H 'Authorization: Bearer YOUR_ACCESS_TOKEN'
  -H 'Content-Type: application/json'
  -H 'Idempotency-Key: YOUR_IDEMPOTENCY_KEY'
  --data '{}'

Authentication

session + CSRF

Request

No request body documented.

Responses and errors

Request IDs: X-Request-IDFull OpenAPI operation
POST/api/auth/step-up/passkey/complete

Complete passkey step-up

This operation is part of the public Lucion Identity contract.

Safe request
curl -X POST 'https://identity.lucionglobal.com/api/auth/step-up/passkey/complete'
  -H 'Authorization: Bearer YOUR_ACCESS_TOKEN'
  -H 'Content-Type: application/json'
  -H 'Idempotency-Key: YOUR_IDEMPOTENCY_KEY'
  --data '{}'

Authentication

session + CSRF

Request

No request body documented.

Responses and errors

Request IDs: X-Request-IDFull OpenAPI operation
POST/api/auth/step-up/password

Complete password re-authentication step-up

This operation is part of the public Lucion Identity contract.

Safe request
curl -X POST 'https://identity.lucionglobal.com/api/auth/step-up/password'
  -H 'Authorization: Bearer YOUR_ACCESS_TOKEN'
  -H 'Content-Type: application/json'
  -H 'Idempotency-Key: YOUR_IDEMPOTENCY_KEY'
  --data '{}'

Authentication

session + CSRF + password credential

Request

No request body documented.

Responses and errors

Request IDs: X-Request-IDFull OpenAPI operation

Organization administration, developer credential mutations, webhook operations, and approval decisions use the server's recent step-up boundary where required. Exact Origin and CSRF checks remain separate controls.