Get the rpId migration of a connection

GET /v1/connections/{connection_id}/rp-id-migration · permission connections:read

Returns the latest rpId migration of a passkey connection, whether it is still running or already closed (see Change the passkey rpId). The counts are written when the migration closes and are null while it is active. Reads are not audited.

Request

Field	Type	Required	Description
`connection_id`	path	yes	Passkey connection ID (`conn_…`).

Response

200 OK:

{
  "id": "rpm_01j9xr4a6b8c0d2e4f6g8h0j2k",
  "connection_id": "conn_01j9xp6q0r1s5t7v9w1x3y5z7b",
  "previous_rp_id": null,
  "new_rp_id": "login.example.com",
  "status": "completed_early",
  "started_at": "2026-10-27T10:00:00Z",
  "ends_at": "2027-01-25T10:00:00Z",
  "completed_at": "2026-12-01T09:00:00Z",
  "revoked_count": 12,
  "new_registration_count": 340,
  "fallback_enabled_by_migration": false
}

Field	Description
`status`	`active`, `completed` (the window ended) or `completed_early`.
`revoked_count`	Passkeys on the previous rpId that were revoked when the migration closed.
`new_registration_count`	Passkeys registered on the new rpId during the window.

Errors

HTTP	code	When
404	`not_found`	The connection does not exist in this environment, is not a passkey connection, or has never had an rpId migration.
401	`unauthenticated`	The credential is missing, invalid or revoked.
403	`insufficient_permissions`	The credential lacks the required permission.
429	`rate_limited`	The rate limit was exceeded; retry after the `Retry-After` period.
503	`service_unavailable`	A dependency is temporarily unavailable; retry after the `Retry-After` period.

Example

curl "https://api.eu.keenauth.com/v1/connections/conn_01j9xp6q0r1s5t7v9w1x3y5z7b/rp-id-migration" \
  -H "Authorization: Bearer $KEENAUTH_SECRET_KEY"

keenauth connections rp-id-migration conn_01j9xp6q0r1s5t7v9w1x3y5z7b