Passkey

Passkey for passwordless sign-in to the account.

This object can be configured from the WebUI under Account › Credentials › Passkeys

Fields

registration

Type: PasskeyRegistration? · read-only

WebAuthn registration response produced by the authenticator, only accepted on creation

description

Type: String · required · max length: 64

Name of the passkey

createdAt

Type: UTCDateTime · read-only · server-set

Creation date of the passkey

JMAP API

The Passkey object is available via the urn:stalwart:jmap capability.

x:Passkey/get

This is a standard Foo/get method as defined in RFC 8620, Section 5.1.

This method requires the sysPasskeyGet permission.

curl -X POST https://mail.example.com/jmap/ \
  -H 'Authorization: Bearer $TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{
      "methodCalls": [
        [
          "x:Passkey/get",
          {
            "ids": [
              "id1"
            ]
          },
          "c1"
        ]
      ],
      "using": [
        "urn:ietf:params:jmap:core",
        "urn:stalwart:jmap"
      ]
    }'

x:Passkey/set

This is a standard Foo/set method as defined in RFC 8620, Section 5.3.

Supports the following operations in a single call: create, update, destroy.

Create

This operation requires the sysPasskeyCreate permission.

curl -X POST https://mail.example.com/jmap/ \
  -H 'Authorization: Bearer $TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{
      "methodCalls": [
        [
          "x:Passkey/set",
          {
            "create": {
              "new1": {
                "description": "Example"
              }
            }
          },
          "c1"
        ]
      ],
      "using": [
        "urn:ietf:params:jmap:core",
        "urn:stalwart:jmap"
      ]
    }'

Update

This operation requires the sysPasskeyUpdate permission.

curl -X POST https://mail.example.com/jmap/ \
  -H 'Authorization: Bearer $TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{
      "methodCalls": [
        [
          "x:Passkey/set",
          {
            "update": {
              "id1": {
                "description": "updated value"
              }
            }
          },
          "c1"
        ]
      ],
      "using": [
        "urn:ietf:params:jmap:core",
        "urn:stalwart:jmap"
      ]
    }'

Destroy

This operation requires the sysPasskeyDestroy permission.

curl -X POST https://mail.example.com/jmap/ \
  -H 'Authorization: Bearer $TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{
      "methodCalls": [
        [
          "x:Passkey/set",
          {
            "destroy": [
              "id1"
            ]
          },
          "c1"
        ]
      ],
      "using": [
        "urn:ietf:params:jmap:core",
        "urn:stalwart:jmap"
      ]
    }'

x:Passkey/query

This is a standard Foo/query method as defined in RFC 8620, Section 5.5.

This method requires the sysPasskeyQuery permission.

curl -X POST https://mail.example.com/jmap/ \
  -H 'Authorization: Bearer $TOKEN' \
  -H 'Content-Type: application/json' \
  -d '{
      "methodCalls": [
        [
          "x:Passkey/query",
          {
            "filter": {
              "createdAt": "2026-01-01T00:00:00Z"
            }
          },
          "c1"
        ]
      ],
      "using": [
        "urn:ietf:params:jmap:core",
        "urn:stalwart:jmap"
      ]
    }'

The x:Passkey/query filter argument accepts the following conditions (combinable with AnyOf / AllOf / Not per RFC 8620):

Condition	Kind
createdAt	date

CLI

stalwart-cli wraps the same JMAP calls. See the CLI reference for installation, authentication, and general usage.

Fetch

stalwart-cli get Passkey id1

Create

stalwart-cli create Passkey \
  --field description=Example

Query

stalwart-cli query Passkey
stalwart-cli query Passkey --where createdAt=2026-01-01T00:00:00Z

Update

stalwart-cli update Passkey id1 --field description='updated value'

Delete

stalwart-cli delete Passkey --ids id1

Nested types

PasskeyRegistration

WebAuthn registration response produced by the authenticator.

clientDataJson

Type: String · required

Client data JSON returned by the authenticator, base64url encoded

attestationObject

Type: String · required

Attestation object returned by the authenticator, base64url encoded