Check a passwordless credential

No account session, by design: the credential is the session's own.
Two forms.

v1 — credential in the body: <body>.<signature>, a grant
(role, scope, window) signed with the session secret for the current
30-second window. Refused once the session is bound v2
(device_signature_required).

v2 — the request itself, signed by the device key bound to the
session: Authorization: Klock <grant> (the service session's grant)
or Authorization: Klock device=<thumbprint> with the key in
Klock-Device-Pub, plus an RFC 9421 signature over the method, path
and body digest (single-use nonce). The service session must be live,
stand for this passwordless session, and hold passwordless:use;
scope in the body (or the whole ceiling) is what is asked for.
Refused for a session never bound (not_bound).

Either way the asked scope must sit inside the ceiling — the session's
scope, or its role's as it stands now — and a tls or kerberos
session must also present its certificate (through the edge) or its
ticket (Authorization: Negotiate). Asked about a table and op,
the answer covers that too.

What comes back is what the caller may do and until when — not a
credential. The older refusals are { error: "<sentence>" }; the
klock error catalog names them v1_* (v1_session_unusable,
v1_wrong_database, v1_signature_mismatch, v1_window_expired, …).

Capability: none from the table; the credential is its own (see above). A signed grant (v1) or passwordless:use (v2).

curl --location 'https://api.prod-orm.io/provision/databases//passwordless/exchange' \ --header 'Content-Type: application/json' \ --data '{ "sessionId": "f6567dd8-e069-418e-8893-7d22fcf12459", "credential": "string", "scope": { "ops": [ "read" ], "tables": [ "string" ] }, "table": "string", "op": "read" }'

{ "role": "string", "scope": { "ops": [ "read" ], "tables": [ "string" ] }, "ceiling": { "ops": [ "read" ], "tables": [ "string" ], "columns": { "property1": [ "string" ], "property2": [ "string" ] } }, "database": "df8eac19-d158-497f-ac84-447e3d8cf906", "expiresAt": "2019-08-24T14:15:22.123Z" }

Check a passwordless credential

Request

Responses