# Reactivate a flagged authenticator

`POST /v1/users/{user_id}/authenticators/{authenticator_id}:reactivate` · permission `user-credentials:write`

Returns an authenticator in status `clone_suspected` (passkey signature-counter anomaly) to `active` by an administrator's decision; the counter is aligned to the latest value and an audit record is written. If the authenticator is not `clone_suspected` the call fails with `409`. The request takes no body.

## Request

| Parameter | In | Required | Description |
|---|---|---|---|
| `user_id` | path | yes | User id, prefixed `usr_`. |
| `authenticator_id` | path | yes | Authenticator id, prefixed `cred_`. |

The request takes no body.

## Response

`200 OK`. The body is the updated authenticator.

When the key lacks the `users:read_pii` permission, `label` is reduced to initials (`A. L.`).

```json
{
  "id": "cred_0a1b2c3d4e5f6g7h8j9k0m1n2p",
  "type": "webauthn",
  "role": "both",
  "label": "Laptop",
  "status": "active",
  "synced": true,
  "created_at": "2026-01-15T09:30:00Z",
  "last_used_at": "2026-02-01T08:00:00Z",
  "revoked_at": null,
  "revoked_by": null,
  "revoke_reason": null
}
```

`type`: `webauthn`, `totp`, `sms`, `email`, `push` · `role`: `first_factor`, `second_factor`, `both` · `status`: `pending`, `active`, `revoked`, `clone_suspected`

## Errors

Every error is an `application/problem+json` body with a stable `code`.

| HTTP | `code` | When |
|---|---|---|
| 409 | `conflict` | The authenticator is not in status `clone_suspected`. |
| 404 | `not_found` | The user or the authenticator does not exist in this environment, the authenticator does not belong to this user, or an id is malformed. |
| 401 | `unauthenticated` | The API key is missing, invalid or revoked. |
| 403 | `insufficient_permissions` | The key lacks the `user-credentials:write` permission. |
| 429 | `rate_limited` | The rate limit was exceeded; honor `Retry-After`. |
| 503 | `service_unavailable` | A dependency is temporarily unavailable; retry later. |

## Example

```bash
curl -X POST https://api.eu.keenauth.com/v1/users/usr_0a1b2c3d4e5f6g7h8j9k0m1n2p/authenticators/cred_0a1b2c3d4e5f6g7h8j9k0m1n2p:reactivate \
  -H "Authorization: Bearer $KEENAUTH_SECRET_KEY" \
  -H "Idempotency-Key: $(uuidgen)"
```

## Personal data

This endpoint carries personal data: credentials. [Personal data in the KeenAuth APIs](/docs/policies/personal-data) describes what is stored, how long it is kept and how it is deleted. Do not send special categories of personal data (health, biometric data, religion, political opinions, sexual orientation) in any field.