passkey_removed
This page is auto-generated from
src/auth/stytch-invite.ts. Do not edit by hand — seedocs/dev/docs-auto-sync.md.
Event string
Section titled “Event string”passkey_removed
Emitting helpers
Section titled “Emitting helpers”| Function | Source |
|---|---|
encodePasskeyRemovedV2AuditReason | src/auth/stytch-invite.ts:396 |
Context fields
Section titled “Context fields”| Field | Type | Required | Notes |
|---|---|---|---|
member_id | string | yes | — |
credential_row_id | string | yes | — |
credential_id | string | yes | — |
remaining_methods | number | yes | — |
Documentation
Section titled “Documentation”Emitted from POST /admin/ui/account/passkeys/:id/remove after a successful DELETE. Replaces the deprecated {@link encodePasskeyRemovedAuditReason}; event string unchanged (passkey_removed) so the SIEM wire shape stays stable across the cutover. remaining_methods keeps the post-remove count of OTHER auth methods so an auditor can verify the “at least one method remaining” boundary at row-write time.
This envelope is stored in audit_log.decision_reason (varchar(256)) as a JSON object with the shape { event, ...ctx }. The audit_log row carries tenant_id, actor_user_id, and timestamp as columns alongside — those are not duplicated in the envelope.