Digipass S3 data types

outcome

String

Reason for the error.

app

App

Information about the calling client app

appID

String

The calling client app's UAF application ID.

Returned if the operation is LIST_REG and optionsData.needDetails is 3.

authenticatorsResults

List<AuthenticatorResult>

List of the authenticators that succeeded or failed to complete authentication. This info is specific to the protocol.

authNotificationText

String

Dynamic push notification text if sent during INIT_VERIFY and the push was successful then the same will be emitted back when authentication succeeds.

Applies only to the FIDO OOB Auth method.

device

DeviceDetail

Device details received from the client provided that the Server received this information in the request via message.

elapsedTime

Integer

The amount of time, in milliseconds, to process the request for a REST API Operation.

extensions

List<Extension>

Message payload extensions received by the Server.

headerExtensions

List<HeaderExtension>

Protocol-specific header extensions.

oobRefID

String

ID provided by the RP app to retrieve contextual information from the RP server that can be displayed to the app user. Only returned by an OOB REST API operation if oobRefId was included inside oobData in the scanned QR code or push notification. 512 character maximum.

protocol

String

Protocol used by the Authentication Server based on information from the request. If this is missing from the request, the Server uses the UAF protocol.

protocolFamily

String

protocolFamily is uaf or web.

Returned if:

i) the operation is LIST_REG, and

ii) optionsData.needDetails is 2 or 3, and

iii) the response filter is configured to return it.

policyName

String

FIDO Policy name used to verify the authenticator for the operation.

rpID

String

The calling client app's FIDO2 RP ID.

Returned if the operation is LIST_REG and optionsData.needDetails is 3.

rulesResult

RulesResult

Results from all matching FIDO policy post operation checks.

transaction

Transaction object

This object has one attribute: id.

displayName

String

A user-friendly name for the app.

id

String

The unique identifier for the app that is generated by the Digipass S3 App SDK.

name

String

The name of the app.

qrSupported

Boolean

If true, the app can perform FIDO OOB authentication on the 2nd device because the device it's running on can scan a QR code and authenticate the user. For example, mobile devices are capable of scanning a QR code, while desktop systems and laptops typically cannot.

The App SDK knows if the app has implemented FIDO OOB support and can determine if the device can scan a QR code. It includes that information in the message attribute in the request to the Auth Server. While performing Adaptive Registration and Adaptive Authentication, the Server uses this data along with the app's push-notification configuration to dictate if the user can register or authenticate with FIDO OOB.

However, if the app is configured not to support QR code scanning in the Server Admin Console, this overrides what the App SDK sends.

The value is returned in case the calling app needs to reference it.

data

JsonElement

Contains information specific to the authentication method. For example, for SMS OTP, this would be the user's cell phone.

The fields in this object can vary depending on the type of authentication method, the REST API operation, and whether the object is in an operation's request or response. For details, refer to the specific type of authentication method:

• FIDO Auth

• FIDO OOB Auth

• Email OTP

• External Authentication

• Photo ID

• SMS OTP

errorCode

String

Server-specific error code available when method processing has failed. Can be present in the response.

For “FIDO Auth” this can be the status code for failures.

lifetimeMillis

Long

Lifetime to complete method setup or verification in milliseconds. Can be present in the response.

Your client or web app can use this to tell a user how much time they have to complete the task or warn the user that the Server does not accept a response once lifetimeMillis has expired.

name

String

Name of the authentication method that the Server is registering for a particular tenant. Required. Present in both the request and response.

For example, recovery, bootstrap, etc.

state

String

State of the authentication method. Can be conditionally present in the response.

• AWAITING_USER_ACTION

• CANCELLED

• IN_PROGRESS

• PENDING

• SUCCEEDED

statusHandle

String

Present in the response from INIT_ADAPTIVE, INIT_VERIFY or INIT_SETUP.

Present in both the requests to and responses from SETUP, VERIFY, CANCEL_SETUP, and CANCEL_VERIFY.

type

String

Identifies the authentication method. Required. One of:

• FIDO Auth

• FIDO OOB Auth

• Email OTP

• SMS OTP

• Photo ID

• External Auth

additionalInfo

An object containing information from the client app that is initiating authentication.

In order for the API Server to return this information:

1. The client app must have sent this information in the INIT_ADAPTIVE request message attribute.

2. You configured the API Server's response filter to return the protocol. Refer to Response Filter Configuration.

protocol

Protocol used by the Server based on information from the request. String. One of UAF or Web.

message

Opaque value that contains the challenge exchanged between the Server and the App SDK. A base64-URL encoded string. message must be sent to the App SDK.

statusCode

One of 3 codes that report the success of the requested operation. See Success Status Codes below for possible values.

4000

OK. Operation completed

Authentication completed successfully.

4001

OK. Credential variance

UVI is different uaf.exact.match=true

4002

OK. Optional security checks failed.

Failed to validate ChannelBinding.

channelBinding

Optional. Channel binding data available from the TLS endpoint. ChannelBinding.

message

Required. Generated by the App SDK on the client. An opaque value. The client app is responsible for sending message. A base64-URL encoded string.

additionalInfo

An object containing information from the client app that is initiating authentication.

In order for the API Server to return this information:

1. The client app must have sent this information in the INIT_ADAPTIVE request message attribute.

2. You configured the API Server's response filter to return the protocol, policy name, transaction ID, additional authenticator details, post operation check results, and extension information.
   
   By default, the API Server returns all device-related information, the IDs of the authenticators used, and attachment hints for FIDO2 authenticators. Refer to Response Filter Configuration.

additionalInfo.protocol

Protocol used by the Server. String. One of UAF or Web.

additionalInfo.policyName

FIDO policy name used for VERIFY. String.

additionalInfo.transaction:id

Transaction ID provided by the client app to track a transaction. String. The transaction ID is provided in the request payload of INIT_ADAPTIVE.

additionalInfo.authenticatorsResult

List of the authenticators that succeeded or failed to complete authentication. List<AuthenticatorResult>.

additionalInfo.authenticatorsResult.transactionResult

If VERIFY performs a transaction, AuthenticatorResult also includes TransactionResult.

additionalInfo.rulesResult

RulesResult populated as a result of policy rules processing giving out the matched rules details. RulesResult.

additionalInfo.headerExtensions

Protocol-specific header extensions. List<HeaderExtension>

additionalInfo.extensions

Message payload extensions received by the Server in the INIT_ADAPTIVE and VERIFY request. List<Extension>

additionalInfo.elapsedTime

Time elapsed while processing the request

message

Information exchanged between the Server and the App SDK. message must be sent to the App SDK and is accepted conditionally. Base64-URL encoded string.

statusCode

One of 3 codes that report the success of the requested operation. See Success Status Codes above for possible values.

message

Opaque value that contains the challenge exchanged between the Server and the App SDK. A base64-URL encoded string. message must be sent to the App SDK.

devices

Optionally present if userName is sent in the INIT_ADAPTIVE request.

A set of DeviceEntry objects.

A DeviceEntry object contains device, app, and pushHandle.

• device: A Digipass S3 data structure containing device information.

• app: A Digipass S3 data structure containing information about the applications installed on the device.

• pushHandle: Identifies the device that receives a push notification and then initiates an OOB authentication. A Base64-encoded string, maximum 4000 characters.

authNotificationText

Optional. Dynamic push notification text sent in the push payload to the second device during OOB.

Requires that you assign the value dynamic to oob.auth.notification.text.mode, a tenant property. For instructions on how to set this property, refer to oob.auth.notification.text.mode in 4.d. Optional: Configure to Use Dynamic Authentication Text.

oobMode

Required. Object with 3 attributes, qr, push, and rawdata. Specifies the OOB mechanism to use in order to authenticate on the second device. You must provide at least one of oobMode.qr, oobMode.push, or oobMode.rawData.

oobMode.push

Optional. String. Enter true or false as follows:

• true: The Server generates and sends a push notification. One of the following entries must be provided for push notification:

  • userName

    • Send a push to any of the user’s most recently used device:

      • A device on which the last push notification was successful.

      • A device that was recently updated and also has a corresponding push notification identifier.

  • pushHandle

• false: The Server does not send a push notification.

oobMode.qr

Optional. String. Enter true or false as follows:

• true: The Server generates a QR code image for initiating the OOB operation.

• false: The Server does not generate a QR code image.

oobMode.qrType

Optional. String. Directs the Auth Server to generate the specified QR code. One of the values listed below, these are ordered by the size of the QR code they generate, from largest to smallest.

• UNIVERSAL_ANY_RP: Generates a universal QR Code that can be scanned by web apps, native mobile apps, and camera apps capable of processing a QR code. These apps can be deployed by different organizations.

• UNIVERSAL_RP_SPECIFIC: Generates a universal QR Code specific to apps deployed by one organization. The Server omits the API Server hostname from the QR code.

• APP_ANY_RP (default): Generates a QR Code that works with native mobile apps deployed by different organizations. The Server omits the web page hostname from the QR code.

• APP_RP_SPECIFIC: Generates a QR code that can only be scanned by native mobile apps deployed by one organization. The Server omits both the web page and API Server hostname from the QR code.
  
  Mobile apps that scan this QR code must hard code the registration and authentication endpoints as described in the Android Developer Guide or the iOS Developer Guide.

oobMode.rawData

Optional. String. Enter true or false as follows:

• false: You are using QR code or push notification, so you don’t need raw data.

• true: You are using your own mechanism to transfer information from the initiating device to a second device, so you need raw data to encode that information.

oobMode.webUrl

Required if oobMode.qrType is either UNIVERSAL_RP_SPECIFIC or UNIVERSAL_ANY_RP. The web page URL that handles OOB authentication. The Server encodes this web page URL in the generated QR code. String.

oobRefId

Optional. An alphanumeric string, maximum of 512 characters. ID provided by the RP app to retrieve contextual information from the RP server that can be displayed to the app user. This helps maintain continuity when a user is performing a transaction or task.

The system takes the oobRefId and packages it inside oobData. oobData is incorporated in the displayed QR code or sent via a push notification. The app running on the second device accesses oobRefID after it scans the QR code or receives the push notification.

additionalInfo

An object containing information returned by the Server.

In order for the API Server to return this information,

1. Send oobRefID in the method.data field of INIT_VERIFY's request.

2. Update the response filter configuration so the API Server returns this attribute. Refer to Response Filter Configuration.

additionalInfo.oobRefId

ID provided by the RP app to retrieve contextual information from the RP server. String.

modeResult

An object containing the server-generated QR code and/or raw data needed for your custom OOB mode. Has 3 attributes: qrCode.qrImage, push.status, and rawData.

modeResult.qrCode.qrImage

The server-generated QR Code. String (Base64-encoded PNG image).

Returned if oobMode.qr is true.

modeResult.push.status

Status for push notification mode. Integer.

Returned if oobMode.push is true. See START_OOB_AUTH's Push Notification Status Codes for possible push status values.

modeResult.rawData

Raw data to send to the second device when you are using your own mechanism in place of a QR code. String.

Returned if oobMode.rawData is true.

additionalInfo

An object containing information from the client app running on the second device. Contains the attributes listed in the rows below.

In order for the API Server to return this information,

1. The client app must have sent this information in the INIT_OOB_AUTH request’s message attribute.

2. Update the response filter configuration so the API Server returns the protocol, policy name, transaction ID, additional authenticator details, extension-related information, and OOB reference ID.
   
   By default, the API Server returns device information, authenticator handles, and FIDO2 authenticator attachment hints. Refer to Response Filter Configuration.

additionalInfo.authenticatorsResult

Authenticators that succeeded or failed to complete the OOB authentication operation. List<AuthenticatorResult>.

additionalInfo.authenticatorsResult.transactionResult

If VERIFY performs a transaction, AuthenticatorResult also includes TransactionResult.

additionalInfo.authNotificationText

Dynamic push notification text. If the client app sends this in the request to INIT_VERIFY and the push is successful, then this string is returned when authentication succeeds. String. To send custom text from your client app, refer to Sending Custom Push Notifications in the Android, iOS or Web Developer Guide.

additionalInfo.device

A DeviceDetail object containing information about the client.

additionalInfo.extensions

Message payload extensions received by the Server in FINISH_OOB_AUTH and INIT_OOB_AUTH requests. List<Extension>.

additionalInfo.headerExtensions

Protocol-specific header extensions. List<HeaderExtension>.

additionalInfo.oobRefId

ID provided by the RP app to retrieve contextual information from the RP server. String.

In order for the API Server to return this information, send oobRefID in the method.data field of INIT_VERIFY's request.

oobRefId is present in the VERIFY operation following the FINISH_OOB_AUTH operation.

additionalInfo.policyName

Policy name used for the operation. String.

additionalInfo.protocol

The protocol used by the Server based on information from the request. String. One of UAF or Web.

additionalInfo.transaction.id

Transaction ID provided by RP to track a transaction. String.

The transaction ID is provided in INIT_ADAPTIVE’s request.

push

An object containing information about the push notification. Contains the 3 attributes listed below.

push.handleLifetimeDays

Remaining lifetime of the push handle in days. Long.

push.pushHandle

Identifies the device that receives a push notification and then initiates an OOB authentication. A Base64-encoded string, maximum 4000 characters.

push.status

Result of the push notification. Integer.

Also indicates status when the Server is unable to generate a new pushHandle because the maximum number of push notifications has been reached. This could be due to delivery or processing failures.

statusCode

FIDO Auth status code that reports the success of the requested operation. See Success Status Codes for the possible values. Integer.

additionalInfo

An object containing information from the client app that is initiating registration. Contains the 3 attributes listed in the rows below.

In order for the API Server to return this information,

1. The client app must have sent this information in the INIT_SETUP request message attribute.

2. Update the response filter configuration so the API Server returns app information and payload extensions.
   
   By default, the API Server automatically returns device information. Refer to Response Filter Configuration.

additionalInfo.app

App information received from the client. App.

additionalInfo.device

A DeviceDetail object containing information about the device that issued the INIT_ADAPTIVE_REG request, such as the device’s unique ID, model, and manufacturer.

additionalInfo.extensions

Message payload extensions received by the Server in the INIT_SETUP request. List<Extension>.

authcounter

The total number of authentications performed using this registered email address.

Present in the response from LIST_METHODS or FETCH_USER_DATA.

devices

An array of device information entries where each entry has a device and app field.

Present in the response from LIST_METHODS, FETCH_USER_DATA, SUSPEND_METHODS, or RESUME_METHODS.

identifier

The email address where the passcode is sent. Sent in the request to INIT_SETUP or, optionally, INIT_VERIFY. Present in the response from several operations.

otp

The one-time passcode. Sent in the request to SETUP or VERIFY.

status

The registered method's status. One of the following:

• 1: Active

• 2: Deleted

• 3: Suspended

Present in the response from LIST_METHODS or FETCH_USER_DATA.

additionalInfo

An object containing information from the client app that is initiating registration. Contains the 3 attributes listed in the rows below.

In order for the API Server to return this information,

1. The client app must have sent this information in the INIT_SETUP request message attribute.

2. Update the response filter configuration so the API Server returns app information and payload extensions.
   
   By default, the API Server automatically returns device information. Refer to Response Filter Configuration.

additionalInfo.app

App information received from the client. App.

additionalInfo.device

A DeviceDetail object containing information about the device that issued the INIT_SETUP request, such as the device’s unique ID, model, and manufacturer.

additionalInfo.extensions

Message payload extensions received by the Server in the INIT_SETUP request. List<Extension>.

authcounter

The total number of authentications performed using this registered username.

Present in the response from LIST_METHODS or FETCH_USER_DATA.

credential

This is a JWT generated by an RP server that performs an external authentication method.

Sent in a request for an INIT_ADAPTIVE or VERIFY operation.

If you have a custom External Authentication plugin, the credential could be different.

devices

An array of device information entries where each entry has a device and app field.

Present in the response from LIST_METHODS, FETCH_USER_DATA, SUSPEND_METHODS, or RESUME_METHODS.

status

The registered method's status. One of the following:

• 1: Active

• 2: Deleted

• 3: Suspended

Present in the response from LIST_METHODS or FETCH_USER_DATA.

additionalInfo

An object containing information from the client app that is initiating registration. Contains the 3 attributes listed in the rows below.

In order for the API Server to return this information,

1. The client app must have sent this information in the INIT_SETUP request message attribute.

2. Update the response filter configuration so the API Server returns app information and payload extensions.
   
   By default, the API Server automatically returns device information. Refer to Response Filter Configuration.

additionalInfo.app

App information received from the client. App.

additionalInfo.device

A DeviceDetail object containing information about the device that issued the INIT_SETUP request, such as the device’s unique ID, model, and manufacturer.

additionalInfo.extensions

Message payload extensions received by the Server in the INIT_SETUP request. List<Extension>.

authcounter

The total number of authentications performed using this registered Photo ID.

Present in the response from LIST_METHODS or FETCH_USER_DATA.

devices

An array of device information entries where each entry has a device and app field.

Present in the response from LIST_METHODS, FETCH_USER_DATA, SUSPEND_METHODS, or RESUME_METHODS.

identifier

A Server-computed hash based on the content of the Photo ID.

scanReferenceID

The scan reference ID returned by NetVerify after it receives the images sent by the client app. Used by the Server when it polls the NetVerify server about the verification status of the ID document. Sent in the request to INIT_SETUP or INIT_VERIFY.

status

The registered method's status. One of the following:

• 1: Active

• 2: Deleted

• 3: Suspended

Present in the response from LIST_METHODS or FETCH_USER_DATA.

additionalInfo

An object containing information from the client app that is initiating registration. Contains the 3 attributes listed in the rows below.

In order for the API Server to return this information,

1. The client app must have sent this information in the INIT_SETUP request message attribute.

2. Update the response filter configuration so the API Server returns app information and payload extensions.
   
   By default, the API Server automatically returns device information. Refer to Response Filter Configuration.

additionalInfo.app

App information received from the client. App.

additionalInfo.device

A DeviceDetail object containing information about the device that issued the INIT_SETUP request, such as the device’s unique ID, model, and manufacturer.

additionalInfo.extensions

Message payload extensions received by the Server in the INIT_SETUP request. List<Extension>.

authcounter

The total number of authentications performed using this registered phone number.

Present in the response from LIST_METHODS or FETCH_USER_DATA.

devices

An array of device information entries where each entry has a device and app field.

Present in the response from LIST_METHODS, FETCH_USER_DATA, SUSPEND_METHODS, or RESUME_METHODS.

identifier

The phone number, including country code, where the passcode is sent. Sent in the request to INIT_SETUP or, optionally, INIT_VERIFY. Present in the response from several operations.

otp

The one-time passcode. Sent in the request to SETUP or VERIFY.

status

The registered method's status. One of the following:

• 1: Active

• 2: Deleted

• 3: Suspended

Present in the response from LIST_METHODS or FETCH_USER_DATA.

aaguid

String

The FIDO2 Authenticator Attestation GUID.

Present for a FIDO2 authenticator when optionsData.needDetails = 3 in LIST_REG’s request.

aaid

String

The UAF Authenticator Attestation ID.

Present for a UAF authenticator when optionsData.needDetails = 3 in LIST_REG’s request.

acki

String

The Attestation Certificate public Key Identifier for U2F authenticator metadata.

Present for a FIDO2 authenticator when optionsData.needDetails = 3 in LIST_REG’s request.

appAtts

Array of AppAttest

An array of AppAttests. AppAttests contains authenticator attributes specific to the iOS app integrity credential.

Optionally present only for an iOS FIDO2 or iOS UAF authenticator to validate the app’s integrity.

authCount

Integer

The total number of authentications performed by this registered authenticator.

authenticatorName

Alphanumeric string. 128 character maximum.

The name of the registered authenticator.

createdTimeStamp

Long

The time when the authenticator was registered for the user.

credentialId

String

The unique identifier identifying a WebAuthn authenticator's public key credential source and its authentication assertions sent by the client and remembered by the Auth Server.

Present for a FIDO2 authenticator when optionsData.needDetails = 3 in LIST_REG’s request.

description

String

Describes the registered authenticator.

handle

Alphanumeric string. 4000 character maximum.

String that uniquely identifies the registered authenticator.

keyID

String

A unique identifier for the authenticator, within the scope of an AAID.

Present for a UAF authenticator when
optionsData.needDetails = 3 in LIST_REG’s request.

lastUsedTimeStamp

Long

The time when the authenticator was last used.

Present if optionsData.needDetails = 2 or 3 in LIST_REG’s request.

publicKey

String

The authenticator’s public key that was received during registration.

Present for a UAF authenticator when
optionsData.needDetails = 3 in LIST_REG’s request.

status

Integer

The registered authenticator’s status:

• 1: Active

• 2: Deleted

• 3: Suspended

aaguid

String

The FIDO2 Authenticator Attestation GUID.

aaid

String

The Authenticator Attestation ID (AAID).

appAtt

AppAttest

Present only if the app attest extension is requested as per the policy on an Apple platform.

assertionExtensions

List<HeaderExtension>

Represents authenticator assertion extension data per the UAF specification.

attachmentHints

Array of strings

Provides hints about how the authenticator communicates with the client app. Valid values:

• ble: Bluetooth Low Energy (BLE)

• hybrid: A combination of data transport and proximity mechanisms.

• internal: The authenticator is a platform authenticator.

• nfc: Near Field Communication (NFC)

• usb: Removable USB

• smart-card: The authenticator can be contacted over an ISO/IEC 7816 smart card.

For more information, refer to the WebAuthn spec: https://w3c.github.io/webauthn/#enum-transport

attestationType

Integer

The type of attestation used by the authenticator. Based on the FIDO spec's authenticator attestation types, see: https://fidoalliance.org/specs/common-specs/fido-registry-v2.2-ps-20220523.html#authenticator-attestation-types.

Has the following differences:

• "ecdaa" attestation is not supported.

• The value returned is the decimal representation of the Hex number.

  • 0x3e07 = 15879 (basic_full)

  • 0x3e08 = 15880 (basic_surrogate or self-attestation)

  • 0x3e0a = 15882 (attca)

  • 0x3e0c = 15884 (anonca)

  • 0x0000 = 0 (none)

attestationFormat

String

The attestation statement format identifier

attestationCertSubjectD

String

The subject of the credential certificate. Present based on the attestationFormat received. Applicable to webauthn authenticator.

attestationTypeName

String

The attestation type name.

attestationStatus

String

The outcome of the attestation processing for webauthn. Value can be one of:

• SUCCESS

• FAILED

• UNAVAILABLE

• ENTERPRISE_FAILED

authenticatorAttachment

String

Describes the authenticator’s attachment modalities, if available from the client. Valid values:

• platform: A platform attachment.

• cross-platform: a cross-platform or roaming attachment.

For more information, refer to the WebAuthn spec.

authenticatorExtensions

List<HeaderExtension>

Represents authenticator non-TLV encoded extension data per the UAF specification.

authenticatorName

Alphanumeric string. 128 character maximum

The name of the authenticator.

authenticatorSerialNumber

String

The unique serial number of the authenticator extracted from the credential certificate. Present based on the attestationFormat received.

Applicable for webauthn authenticator.

authenticatorVersion

Integer

The authenticator version.

backedUp

Boolean

Applicable only for a synced passkey.

• true: The synced passkey was backed up

• false: The synced passkey was not backed up

backUpEligible

Boolean

Indicates if the authenticator can be backed up. Only true for synced passkeys.

credentialID

String

A probabilistically-unique byte sequence identifying a public key credential source and its authentication assertions. Applicable for webauthn authenticator.

dpk

DevicePublicKey

Present only if the authenticator is a synced passkey. Includes details about the Device Public Key.

handle

String

Unique identifier for the authenticator.

headerExtensions

List<HeaderExtension>

Represents protocol-specific header extensions.

status

Integer

The status code.

This may or may not be applicable.

transactionResult

TransactionResult

Represents the result from a transaction.

userPresence

Boolean

• true: user is present

• false: user is not present

userVerification

Boolean

• true: user is verified

• false: user is not verified.

For example, userVerification is true if the authenticator verified the user via fingerprint.

uvi

String

The user verification index. Used for Android. Indicates which biometric authentication method, which finger for example.

uvm

List<Uvm>

Represents the fido.uaf.uvm user verification method extension. An object that contains userVerificationMethod, keyProtection, and matcherProtection.

Below is a sample uvm field from a REST API response.

startcode"uvm": [

{

"userVerificationMethod": "presence",

"keyProtection": "hardware",

"matcherProtection": "software"

}

]

uviStatus

String

The status of UVI.

uvs

String

The user verification state. Used for iOS. Indicates which biometric authentication method, which finger for example.

uvsStatus

Integer

The status of UVS.

4000

OK. Operation completed

Authentication or registration completed successfully.

4002

OK. Optional security checks failed

Applies to both registration and authentication. Non-critical FIDO policy check failures. For example:

• The app attest extension was not received or was not processed successfully during authentication.

• Attestation was not received during registration.

4400

Registration

NotFound

Exception

Failed to authenticate because the registration does not exist on Server for a specific user.

This error code is applicable for the UAF protocol.

4402

Security Exception

Applies to both registration and authentication. Examples:

• Failed to validate the attestation.

• Failed to validate Server challenge.

• Failed to validate the Server data.

• Failed to locate authenticator metadata.

• Challenge replay detected.

• Failed to validate extension data.

• Failed to validate user name.

4403

Policy Exception

Applies to both registration and authentication. The authenticator doesn't match the FIDO policy.

4404

Internal Server Error

Applies to both registration and authentication. Examples:

• Failed to write to the database.

• Failed to read from the database.

• Failed to connect to the database.

• Failed to read properties.

4410

Authenticator Revoked

Applies to authentication only. The authenticator is considered revoked by the Server. Authenticator state is not valid. The certificate used for authentication was revoked.

4455

Authenticator suspended

Applies to authentication only. The authenticator is suspended. This generally only applies to FIDO2 authenticators.

id

String

Unique identifier for the authentication sequence. Required.

methods

Set<Authentication Method>

The set of authentication methods that can be used to complete either registration or authentication. Required.

reason

String

A reason code that explains why the end user is being prompted to use the authentication methods in this AuthSequence to authenticate. The App SDK takes care of mapping the reason code to a text explanation that can be displayed to the end user in the client app. Optional.

cid_pubkey

String

Optional. The public key of the public-private key pair generated by the client application. This is currently unused.

serverEndPoint

String

Optional. The TLS server certificate. The certificate includes a Base64url-encoded hash function.

tlsServerCertificate

String

Optional. The DER-encoded TLS server certificate. The certificate is Base64url-encoded.

tlsUnique

String

Optional. The TLS channel Finished structure (RFC5929). The structure is Base64url-encoded.

type

String

The device type: android, ios, or browser.

id

String

The unique identifier for the device. This is generated by the Digipass S3 App SDK. The device ID is unique per app and device. So different apps on the same device have different device IDs. Device IDs remain the same when an app is uninstalled and reinstalled. Device IDs are different after a factory reset.

Javascript Device IDs change after clearing the browser local store.

info

String

The device name, for example, Hildy’s phone.

manufacturer

String

The manufacturer of the device

model

String

The device’s model

os

String

The device’s operating system and version

id

String

The unique identifier for the device. This is generated by the Digipass S3 App SDK. The device ID is unique per app and device. So different apps on the same device have different device IDs.

Device IDs remain the same when an app is uninstalled and reinstalled. Device IDs change after a factory reset.

JavaScript Device IDs change after clearing the browser's local store.

info

String

The device name (for example, My iPhone).

manufacturer

String

The name of the manufacturer.

model

String

Model details of the device.

os

String

The operating system of the device.

push

An object containing information about a new push handle. Contains the 3 attributes listed below. Present in LIST_REG's response when needDetails= 3 and there is a push notification ID associated with this device.

push.pushHandle

String

The device that receives a push notification and initiates an OOB authentication. A Base64-encoded string, maximum 4000 characters.

push.handleLifetimeDays

Long

Remaining lifetime of the push handle in days.

push.createdTimeStamp

String

Creation date and time of push handle in UTC format.

type

String

The device type: android, ios, or browser.

aaguid

String

The FIDO2 Authenticator Attestation GUID.

attestationFormat

String

The attestation for the DPK. Currently, only the value "none" is supported.

For a detailed description, see https://www.iana.org/assignments/webauthn/webauthn.xhtml#webauthn-attestation-statement-format-ids

description

String

Describes the DPK.

handle

String

Unique identifier for the DPK.

scope

Integer

The scope of the DPK.

• 0: Scope is the entire device, in other words affects all apps

• 1: Scope is per app

state

String

The outcome after the Auth Server processed the devicePubKey extension.

• NOT_APPLICABLE: The DPK extension is not applicable. For example, the information may pertain to a UAF authenticator, not a synced passkey.

• UNAVAILABLE: The DPK extension was not sent in the request.

• INVALID: The DPK extension is invalid.

• UNTRUSTED: The device is not trusted, additional authentication may be necessary.

• TRUSTED: The device is trusted.

status

Integer

The status of the DPK stored in the Auth Server's database. One of the following values:

• 0: Pending (not yet trusted, indicates that this is the first time the DPK was used)

• 1: Active (trusted)

• 3: Active DPK, but suspended

• 6: Pending DPK, but suspended

data

String

The extension specific data.

id

String

Unique identifier for the extension.

operation

String

The operation ID in which the extension was received

data

String

The extension specific data.

failIfUnknown

Boolean

• true: an unknown extension results in an error.

• false: ignore the unknown extension

id

String

Unique identifier for the extension.

needDetails

Integer

An attribute used to indicate the level of the details returned in the additionalInfo field in the response. One of:

• 2 (default): Return information about the app and device. Actual data varies depending on the REST API operation you use.

• 3: Used only by LIST_REG. Return information about the protocol family, registered authenticator (AuthenticatorInfo), and push handle (DeviceDetail.push.pushHandle).

You must also modify the API Server's response filter so the data is returned.

For information about the type of data that can be returned in additionalInfo, see AdditionalInfo.

To modify the filtering done on additionalInfo, see Response Filter Configuration.

policyName

String, max 256 characters

A FIDO registration policy name configured and stored on the Authentication Server. The Server uses the policy to determine which FIDO authenticators are valid to register for Adaptive Authentication.

This attribute applies to INIT_REG and START_OOB_REG. If present, it overrides the policyType attribute below.

policyType

String

A policy type that maps to a policy name configured on the Authentication Server. Only use this if you define app-specific policy types. In other words, you configured additional policy types by adding them to the app_specified_policies field in the PolicyPlugin's configuration (default_config). Use the Admin Console to import this configuration.

This attribute applies to INIT_REG, START_OOB_REG, and START_OOB_AUTH.

See Create a Policy Plugin for further information.

transactionText

String, very large

Text that the client displays to the user to verify and authorize a secure transaction.

app

App object

Information about the user’s app that utilizes the authenticators.

authenticators

List<AuthenticatorInfo>

Information about the registered authenticators for the associated device and app.

device

Device object

A JSON-formatted structure that contains information about the user’s device.

action

String

Indicates the final action/outcome of the operation. ALLOW or DENY are the two actions performed by the post operation rule.

matchedRules

List

Includes information about all post operation rules that are matched during policy evaluation.

matchedRules.group

String

Group name to which the template belongs.

matchedRules.name

String

Name of the post operation rule.

matchedRules.riskScore

Integer

Risk score of the configured post operation rule.

matchedRules.template

String

Template name used to configure the post operation rule.

riskThresholdRule

Object

Information about the RiskThreshold rule, if it was defined for the FIDO policy.

riskThresholdRule.aboveThreshold

Boolean

• true: RiskScore ≥ threshold

• false: RiskScore < threshold

riskThresholdRule.riskScore

Integer

The sum of all of the risk scores from succeeding post operation checks.

riskThresholdRule.threshold

Integer

The defined threshold value for riskThreshold rule.

emv3dsData

Object

Output. Optional. A JSON Web Signature (JWS) object containing an EMV 3DS FIDO blob. It is returned when the EMV 3DS Session plugin is enabled and under the following conditions:

• Regular FIDO: Successful registration, authentication, or transaction confirmation.

• Adaptive Authentication: When there is a successful adaptive rule that was defined to return a 3DS FIDO blob.

exp

Integer

Output. Optional. Contains the session expiration time in seconds since UNIX epoch

pushHandle

String

Input. Optional. A handle (unique ID) used to trigger push notification to a specific device.

sessionKey

Object

Session-related data for maintaining the session state for a specific user on the client side. In the request, sessionKey is optional for authentication REST API operations but required for other operations. The value must be a JWT.

Returned in the response by REST API operations that perform authentication.

tcToken

Object

Output. Optional. The Transaction Confirmation Token generated by the API Server for successfully confirmed transactions. The value is a JWT.

Contains the transaction ID as a claim. See Transaction Confirmation Token.

userName

String

Input. Optional. Specifies the authenticating user name, if known. The user name must be unique across all users in a tenant. This attribute is used for authentication operations.

The API Server must have been configured for FIDO2 to use this attribute. See Configure FIDO2 authentication.

hash

String

Hashed value of transaction.text. transaction.text can come from START_OOB_AUTH or INIT_ADAPTIVE.

hashAlgorithm

String

Algorithm used to hash transaction.text.

Valid algorithms:

• SHA-256

• SHA-384

• SHA-512

nonce

String

An arbitrary string that can be used just once in a cryptographic communication. Present only when the protocol is FIDO2. Nonce that the server used to derive the challenge used in the transaction.

serverChallenge

String

The initial server challenge. Present only when the protocol is FIDO2. Initial server challenge that the server used to derive the final challenge used in the transaction.