Passkey Property Not Established

URI: https://docs.ankatech.co/errors/passkey-property-not-established
HTTP Status: 422 Unprocessable Content

When you see this

A person tried to register a passkey for a tenant whose authentication policy requires an attested, hardware-backed or device-bound passkey, and the platform could not establish that property. Nothing was stored.

These properties can only come from the passkey's attestation, verified against the FIDO Metadata Service (MDS3) data this deployment's operator uploaded. A passkey is device-bound when its backup-eligible flag is clear, but the authenticator sets that flag itself, so it counts only under a verified attestation. When the policy requires one of them, the registration options ask the authenticator for direct attestation. Admin API answers with two extension members: extensions.properties, the required properties that are not established (attested, hardware_backed, device_bound), and extensions.reason:

The security self-service operations of the Auth API relay the type, title, status and detail, but not the extension members: the detail names the properties.

Common Causes

• The deployment's FIDO metadata was never uploaded, or has expired.
• The person used a synced passkey (a password manager or a platform account), which is neither hardware-backed nor device-bound and usually carries no attestation.
• The authenticator's model is not listed in the FIDO metadata.

Response Example

{
  "type": "https://docs.ankatech.co/errors/passkey-property-not-established",
  "title": "Passkey Property Not Established",
  "status": 422,
  "detail": "The authenticator's attestation does not establish that the passkey is attested and hardware_backed; register a passkey on an authenticator that meets the policy.",
  "instance": "/api/v3/auth/account/authenticators/passkeys",
  "timestamp": 1730000000
}

Content-Type: application/problem+json — the response follows RFC 9457 Problem Details. This is an Auth API body, so it carries no correlation member: correlate through the X-Correlation-Id response header. See Error Index & Overview.

During a console sign-in, the same condition does not end the sign-in: the transaction asks again for the enrolment of a passkey and names the missing properties.

How to Resolve

1. With metadata-not-loaded, ask the platform operator to upload the current FIDO metadata file (see Passkeys and the Relying Party ID^*).
2. Otherwise, register the passkey on a hardware security key or a device authenticator whose maker is certified in the FIDO metadata, rather than on a synced passkey.

For full schema definitions, examples, and interactive testing, see the Developer Hub Reference.