> ## Documentation Index > Fetch the complete documentation index at: https://developers.circle.com/llms.txt > Use this file to discover all available pages before exploring further. # List passkeys > Returns all passkeys registered for an end user. ## OpenAPI ````yaml openapi/accounts.yaml get /v1/accounts/passkeys openapi: 3.1.0 info: version: 1.0.0 title: Accounts (Stablecoin) API description: > Circle's Accounts API provides endpoints for managing stablecoin accounts -- including transfers, withdrawals, deposits, wire and ACH bank accounts, and blockchain addresses. An **Account** is a general representation of a ledger or custody object that holds balances. It can be a business account, a stablecoin account ledger for an end user, an extra sub-ledger, or any future custody solution. license: name: Circle License url: https://circle.com/terms servers: - url: https://api-sandbox.circle.com - url: https://api.circle.com security: [] tags: - name: Accounts description: Manage accounts. - name: Account Groups description: Manage custody account groups and their memberships. - name: Limits description: View effective account limits and current usage. - name: Transfers description: Manage account transfers. - name: Transactions description: | Get a unified, customer-friendly view of account transaction activity. - name: Wires description: Manage account bank accounts for wire transfers. - name: Deposits description: Get information on account bank deposits. - name: Withdrawals description: Manage account bank withdrawals (fiat offramp). - name: ACH description: Manage account bank accounts for ACH transfers. - name: Deposit Addresses description: Manage account deposit addresses. - name: Recipient Addresses description: Manage account recipient addresses used for transfers. - name: Passkeys description: > Manage WebAuthn passkeys and Strong Customer Authentication (SCA) challenges for end users. - name: Webhook Subscriptions description: Manage subscriptions to Digital Asset Accounts webhook notifications. paths: /v1/accounts/passkeys: get: tags: - Passkeys summary: List passkeys description: Returns all passkeys registered for an end user. operationId: listPasskeys parameters: - $ref: '#/components/parameters/ClientEntityId' responses: '200': description: Successfully retrieved a list of passkeys. headers: X-Request-Id: $ref: '#/components/headers/XRequestId' content: application/json: schema: $ref: '#/components/schemas/ListPasskeysResponse' '400': $ref: '#/components/responses/BadRequest' '401': $ref: '#/components/responses/NotAuthorized' '500': $ref: '#/components/responses/InternalServerError' security: - bearerAuth: [] components: parameters: ClientEntityId: name: clientEntityId description: >- Identifier of the client entity. Filters results to fetch only resources associated with the specified client entity. in: query required: false schema: type: string format: uuid example: a3f1b2c4-d5e6-7890-abcd-ef1234567890 headers: XRequestId: description: > Circle-generated universally unique identifier (UUID v4). Useful for identifying a specific request when communicating with Circle Support. schema: $ref: '#/components/schemas/XRequestId' schemas: ListPasskeysResponse: type: object properties: data: type: array items: $ref: '#/components/schemas/Passkey' XRequestId: type: string format: uuid example: 2adba88e-9d63-44bc-b975-9b6ae3440dde Passkey: type: object properties: passkeyId: type: string format: uuid description: Unique identifier for the passkey. example: a1b2c3d4-e5f6-7890-ab12-cdef34567890 credentialId: type: string description: | The WebAuthn credential ID, base64url-encoded. example: dGhpcyBpcyBhIGJhc2U2NHVybCBleGFtcGxl createDate: type: string format: date-time description: When the passkey was registered. example: '2026-09-24T12:00:00Z' revokedDate: type: - string - 'null' format: date-time description: When the passkey was revoked, if applicable. example: '2026-09-24T13:00:00Z' updateDate: type: string format: date-time description: When the passkey record was last updated. example: '2026-09-24T12:01:00Z' algorithm: type: integer description: > COSE algorithm identifier for the credential's key pair. `-7` is ES256 (P-256), `-257` is RS256. example: -7 aaguid: type: string description: > Authenticator AAGUID in hyphenated UUID format, identifying the authenticator model. Self-asserted; not validated. example: adce0002-35bc-c60a-648b-0b25f1f05503 attestationFormat: type: string description: > Attestation format as received from the browser (e.g. `"packed"`, `"none"`). Stored verbatim; presence is not evidence of verified provenance. example: packed transports: type: array items: type: string description: > Transport hints reported by the browser at registration. Fed into `allowCredentials` on future ceremonies to guide authenticator selection. example: - internal - hybrid backupEligible: type: boolean description: > Self-asserted: whether this credential can sync across devices (e.g. synced passkeys). example: true backupState: type: boolean description: | Self-asserted: whether this credential is currently backed up. example: true signCount: type: integer format: int64 description: > Signature counter reported by the authenticator. Many synced passkeys always report `0` — this alone is not a red flag. example: 0 rpId: type: string description: > The WebAuthn relying-party ID this credential was registered under. Recorded per credential to make a future RP-ID migration detectable. example: circle.com paymentEligible: type: boolean description: > Whether `spcCapable` was requested at enrollment. Records what was **requested**, not a verified outcome — `true` means SPC was requested, not that the authenticator honored it. example: false required: - passkeyId - credentialId - createDate Error: type: object required: - code - message properties: code: type: integer description: > Circle internal status code from the platform `CoreStatusCode` enum (and its domain-specific extensions). **This is not the HTTP status code** — `-1` is the catch-all unknown error, `1`/`2` indicate API parameter problems, `3` is forbidden, `4` is unauthorized, and larger values identify domain-specific failures. Consumers should rely on the HTTP status line for transport-level error class and on this field for the specific Circle error case. example: 2 message: type: string description: >- Internal error message; suitable for logging but not for end-user display. example: API parameter invalid. externalMessage: type: string description: > End-user-displayable error message. Present when the server has generated a customer-facing variant for this error; omitted otherwise. example: The provided amount exceeds the maximum allowed. errors: type: array description: Additional request-field validation errors, when available. items: $ref: '#/components/schemas/ErrorDetail' ErrorDetail: type: object required: - error - message properties: error: type: string description: Machine-readable error identifier. example: invalid_value location: type: string description: Query parameter or request field that caused the error. example: assetType message: type: string description: Human-readable description of the specific error. example: The operation and assetType combination is invalid. responses: BadRequest: description: The request cannot be processed due to a client error. headers: X-Request-Id: $ref: '#/components/headers/XRequestId' content: application/json: schema: $ref: '#/components/schemas/Error' example: code: 2 message: API parameter invalid. NotAuthorized: description: >- The request has not been applied because it lacks valid authentication credentials. headers: X-Request-Id: $ref: '#/components/headers/XRequestId' content: application/json: schema: $ref: '#/components/schemas/Error' example: code: 4 message: Unauthorized. InternalServerError: description: >- The server encountered an unexpected condition that prevented it from fulfilling the request. headers: X-Request-Id: $ref: '#/components/headers/XRequestId' content: application/json: schema: $ref: '#/components/schemas/Error' example: code: -1 message: 'Something went wrong. errId: 1f0b0c455e40f753f07b4f0ae6abd4b4' securitySchemes: bearerAuth: type: http scheme: bearer ````