{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://raw.githubusercontent.com/api-evangelist/hanko/main/json-schema/hanko-webauthn-credential-schema.json",
  "title": "Hanko WebAuthn Credential",
  "description": "A WebAuthn/FIDO2 passkey or security key credential registered to a Hanko user.",
  "type": "object",
  "properties": {
    "id": {
      "description": "The credential ID (UUID).",
      "type": "string",
      "format": "uuid",
      "example": "5333cc5b-c7c4-48cf-8248-9c184ac72b65"
    },
    "name": {
      "description": "User-provided name for the credential.",
      "type": "string",
      "example": "iCloud Keychain"
    },
    "public_key": {
      "description": "The base64-encoded public key.",
      "type": "string"
    },
    "attestation_type": {
      "description": "The WebAuthn attestation type used during registration.",
      "type": "string",
      "example": "packed"
    },
    "aaguid": {
      "description": "Authenticator AAGUID identifying the authenticator model.",
      "type": "string",
      "format": "uuid",
      "example": "01020304-0506-0708-0102-030405060708"
    },
    "transports": {
      "description": "Transport mechanisms supported by the authenticator.",
      "type": "array",
      "items": {
        "type": "string",
        "enum": ["usb", "nfc", "ble", "internal", "hybrid", "cable"]
      }
    },
    "backup_eligible": {
      "description": "Whether the credential is eligible for cloud backup.",
      "type": "boolean"
    },
    "backup_state": {
      "description": "Whether the credential is currently backed up.",
      "type": "boolean"
    },
    "mfa_only": {
      "description": "If true, the credential can only be used as a second factor.",
      "type": "boolean"
    },
    "created_at": {
      "type": "string",
      "format": "date-time"
    },
    "last_used_at": {
      "type": "string",
      "format": "date-time"
    }
  },
  "required": ["id", "public_key", "attestation_type", "aaguid", "backup_eligible", "backup_state", "mfa_only", "created_at"]
}