<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Passwordless Authentication — API Reference

## Azure AD Authentication Methods (Microsoft Graph)

```bash
# List authentication methods for a user
curl -s -H "Authorization: Bearer ${ACCESS_TOKEN}" \
  "https://graph.microsoft.com/v1.0/users/USER_ID/authentication/methods" \
  | jq '.value[] | {id, "@odata.type"}'

# List FIDO2 keys for a user
curl -s -H "Authorization: Bearer ${ACCESS_TOKEN}" \
  "https://graph.microsoft.com/v1.0/users/USER_ID/authentication/fido2Methods" \
  | jq '.value[] | {id, displayName, model, aaGuid, attestationLevel, createdDateTime}'

# List Windows Hello methods
curl -s -H "Authorization: Bearer ${ACCESS_TOKEN}" \
  "https://graph.microsoft.com/v1.0/users/USER_ID/authentication/windowsHelloForBusinessMethods" \
  | jq '.value[] | {id, displayName, createdDateTime, keyStrength}'

# Get authentication method policy
curl -s -H "Authorization: Bearer ${ACCESS_TOKEN}" \
  "https://graph.microsoft.com/v1.0/policies/authenticationMethodsPolicy" | jq .

# Authentication methods activity (registration report)
curl -s -H "Authorization: Bearer ${ACCESS_TOKEN}" \
  "https://graph.microsoft.com/v1.0/reports/authenticationMethods/usersRegisteredByMethod" | jq .
```

## Conditional Access — Authentication Strength

```bash
# List built-in authentication strengths
curl -s -H "Authorization: Bearer ${ACCESS_TOKEN}" \
  "https://graph.microsoft.com/v1.0/identity/conditionalAccess/authenticationStrength/policies" \
  | jq '.value[] | {id, displayName, policyType, allowedCombinations}'

# Built-in strength IDs:
# MFA:                00000000-0000-0000-0000-000000000002
# Passwordless MFA:   00000000-0000-0000-0000-000000000003
# Phishing-resistant: 00000000-0000-0000-0000-000000000004
```

## Okta WebAuthn / FastPass

```bash
# List WebAuthn factors for user
curl -s -H "Authorization: SSWS ${OKTA_API_TOKEN}" \
  "https://${OKTA_DOMAIN}/api/v1/users/USER_ID/factors" | \
  jq '[.[] | select(.factorType == "webauthn") |
    {id, factorType, provider, status, profile}]'

# Enroll WebAuthn factor
curl -s -X POST -H "Authorization: SSWS ${OKTA_API_TOKEN}" \
  -H "Content-Type: application/json" \
  "https://${OKTA_DOMAIN}/api/v1/users/USER_ID/factors" \
  -d '{"factorType": "webauthn", "provider": "FIDO"}'
```

## Key Metrics

| Metric | Target | Alert |
|--------|--------|-------|
| Admin passwordless coverage | 100% | < 95% |
| User passwordless coverage | > 80% | < 50% |
| SMS MFA registrations | 0 | > 10 new/month |
| FIDO2 key attestation rate | 100% | < 90% |
| Fallback auth usage | < 5% | > 15% |
