---
name: "fido_dev_enable_entattest"
section: "3"
platform: "linux"
package: "libfido2"
version: "1.17.0-1"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/fido_dev_enable_entattest"
---

# fido\_dev\_enable\_entattest(3)

CTAP 2.1 configuration authenticator API

## NAME

**fido\_dev\_enable\_entattest**, **fido\_dev\_toggle\_always\_uv**, **fido\_dev\_force\_pin\_change**, **fido\_dev\_set\_pin\_minlen**, **fido\_dev\_set\_pin\_minlen\_rpid** – CTAP 2.1 configuration authenticator API

## SYNOPSIS

**#include \<fido.h\>**

**#include \<fido/config.h\>**

*int*\

**fido\_dev\_enable\_entattest**(*fido\_dev\_t \*dev*, *const char \*pin*);

*int*\

**fido\_dev\_toggle\_always\_uv**(*fido\_dev\_t \*dev*, *const char \*pin*);

*int*\

**fido\_dev\_force\_pin\_change**(*fido\_dev\_t \*dev*, *const char \*pin*);

*int*\

**fido\_dev\_set\_pin\_minlen**(*fido\_dev\_t \*dev*, *size\_t len*, *const char \*pin*);

*int*\

**fido\_dev\_set\_pin\_minlen\_rpid**(*fido\_dev\_t \*dev*, *const char \* const \*rpid*, *size\_t n*, *const char \*pin*);

## DESCRIPTION

The functions described in this page allow configuration of a CTAP 2.1 authenticator.

The **fido\_dev\_enable\_entattest**() function enables the *Enterprise* *Attestation* feature on *dev*. *Enterprise* *Attestation* instructs the authenticator to include uniquely identifying information in subsequent attestation statements. The *pin* parameter may be NULL if *dev* does not have a PIN set.

The **fido\_dev\_toggle\_always\_uv**() function toggles the “user verification always” feature on *dev*. When set, this toggle enforces user verification at the authenticator level for all known credentials. If *dev* supports U2F (CTAP1) and the user verification methods supported by the authenticator do not allow protection of U2F credentials, the U2F subsystem will be disabled by the authenticator. The *pin* parameter may be NULL if *dev* does not have a PIN set.

The **fido\_dev\_force\_pin\_change**() function instructs *dev* to require a PIN change. Subsequent PIN authentication attempts against *dev* will fail until its PIN is changed.

The **fido\_dev\_set\_pin\_minlen**() function sets the minimum PIN length of *dev* to *len*. Minimum PIN lengths may only be increased.

The **fido\_dev\_set\_pin\_minlen\_rpid**() function sets the list of relying party identifiers (RP IDs) that are allowed to obtain the minimum PIN length of *dev* through the CTAP 2.1 FIDO\_EXT\_MINPINLEN extension. The list of RP identifiers is denoted by *rpid*, a vector of *n* NUL-terminated UTF-8 strings. A copy of *rpid* is made, and no reference to it or its contents is kept. The maximum value of *n* supported by the authenticator can be obtained using [fido\_cbor\_info\_maxrpid\_minpinlen(3)](/fido_cbor_info_maxrpid_minpinlen/3.md).

Configuration settings are reflected in the payload returned by the authenticator in response to a [fido\_dev\_get\_cbor\_info(3)](/fido_dev_get_cbor_info/3.md) call.

## RETURN VALUES

The error codes returned by **fido\_dev\_enable\_entattest**(), **fido\_dev\_toggle\_always\_uv**(), **fido\_dev\_force\_pin\_change**(), **fido\_dev\_set\_pin\_minlen**(), and **fido\_dev\_set\_pin\_minlen\_rpid**() are defined in ⟨fido/err.h⟩. On success, FIDO\_OK is returned.

## SEE ALSO

[fido\_cbor\_info\_maxrpid\_minpinlen(3)](/fido_cbor_info_maxrpid_minpinlen/3.md), [fido\_cred\_pin\_minlen(3)](/fido_cred_pin_minlen/3.md), [fido\_dev\_get\_cbor\_info(3)](/fido_dev_get_cbor_info/3.md), [fido\_dev\_reset(3)](/fido_dev_reset/3.md)