:::endpoint GET /v1/me/passkeys

The passkeys registered through an app, newest first.

Not the same list the account sees in its web settings. A passkey is bound to
the domain it was made on, and a native app may only ask for domains compiled
into its build, so an app has a relying party of our own and these are the
credentials under it. Somebody with a passkey on their firm's website still has
to make one here, once.

## Request

```bash
curl https://api.proppertrading.com/v1/me/passkeys \
  -H "Authorization: Bearer ptat_9f2c1a44_3b8e7d2f5c9a1b4e6d8f0a2c4e6b8d1f"
```

## Response

```json
{
    "data": [
        {
            "id": "890ad7f8-de78-4b88-b4b2-fc52715671e8",
            "object": "passkey",
            "name": "iPhone",
            "is_enabled": true,
            "created_at": "2026-08-20T09:12:44.000000Z",
            "last_used_at": "2026-08-20T11:03:02.000000Z"
        }
    ],
    "meta": { "request_id": "req_01kz4bkr1aj1gv63d8fv3133ey" }
}
```

| Field          | Description                                                                  |
| -------------- | ---------------------------------------------------------------------------- |
| `name`         | What the person called it when they made it                                  |
| `is_enabled`   | A disabled passkey stays listed and cannot sign anybody in                   |
| `last_used_at` | When it last answered a challenge, which is also when its counter last moved |

## Errors

| Status | Code                 | Meaning                             |
| ------ | -------------------- | ----------------------------------- |
| 403    | `insufficient_scope` | This device does not hold `me:read` |