Add Privacy Key Credential

Overview

The Add Privacy Key Credential API adds a Privacy Key as a credential to an existing account. It supports two ways of supplying the key:

• Send a facial image - the platform mints the Privacy Key for you, server-side, using Omnifaces image processing. This is the recommended path: the minted key is guaranteed to be compatible with your tenant's duplicate-detection and search features.
• Send a ready-made Privacy Key - a key you already hold (for example, one returned by the 1:1 Privacy Key Matching API) is stored as-is.

In both cases the credential is registered against your tenant's Privacy Key search policy, so accounts enrolled through this API behave the same as accounts enrolled through a live transaction.

Authentication & Authorization

• Requests must include a valid bearer customer token.
• The Customer Create Account FIDO2 Credentials permission (CustomerCreateAccountFido2Credentials) is required to invoke this API.

When to Use

Use this API when you:

• Need to enroll an account with a Privacy Key credential without running an interactive transaction
• Are migrating accounts from another system and hold reference facial images
• Already hold a Privacy Key from a prior workflow and want to attach it to an account

Trust Model

An image supplied through this API is asserted by you, the operator. It does not pass through the injection and presentation attack checks that a live transaction performs, so only submit images whose authenticity your organization has already established. This is why the API requires a dedicated operator permission.

Endpoint

POST /accounts/{accountNumber}/fido2Credentials

Creates a Privacy Key credential for the given account. When an image is supplied, the Privacy Key is minted from it server-side.

Request

The request format depends on which enrollment mode you use.

Path Parameters

Mode 1 - Mint from image

Content-Type: multipart/form-data

Send the facial image as a binary file part. One credential is created per request.

curl -X POST "https://<host>/IDCompleteBackendEngine/Default/AdministrationServiceRest/v1/accounts/<accountNumber>/fido2Credentials" \
  -H "Authorization: Bearer <token>" \
  -F "[email protected]" \
  -F "description=Enrollment key"

Mode 2 - Store a ready-made key

Content-Type: application/json

The body is an array of credential objects, one credential created per entry.

curl -X POST "https://<host>/IDCompleteBackendEngine/Default/AdministrationServiceRest/v1/accounts/<accountNumber>/fido2Credentials" \
  -H "Authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d '[{ "Fido2PublicKey": "<privacy key>", "Description": "Enrollment key" }]'

Behavior by Tenant Search Policy

Your tenant is configured with one of three Privacy Key search policies. The API's behavior depends on the policy and on whether you sent an image or a ready-made key.

Image provided (key minted server-side)

Ready-made key provided (no image)

Response

The response is an array with one entry per created credential.

[
  {
    "Id": "string",
    "CreatedDate": "2026-08-17T12:00:00Z",
    "Description": "Enrollment key",
    "KeyData": "string"
  }
]

Fields

Errors