---
name: "fido_dev_get_puat"
section: "3"
platform: "linux"
package: "libfido2"
version: "1.17.0-1"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/fido_dev_get_puat"
---

# fido\_dev\_get\_puat(3)

FIDO2 PIN/UV Auth token management functions

## NAME

**fido\_dev\_get\_puat**, **fido\_dev\_set\_puat**, **fido\_dev\_puat\_ptr**, **fido\_dev\_puat\_len** – FIDO2 PIN/UV Auth token management functions

## SYNOPSIS

**#include \<fido.h\>**

*int*\

**fido\_dev\_get\_puat**(*fido\_dev\_t \*dev*, *unsigned int perm*, *const char \*rpid*, *const char \*pin*);

*int*\

**fido\_dev\_set\_puat**(*fido\_dev\_t \*dev*, *const unsigned char \*ptr*, *size\_t len*);

*const* *unsigned* *char* *\**\

**fido\_dev\_puat\_ptr**(*const fido\_dev\_t \*dev*);

*size\_t*\

**fido\_dev\_puat\_len**(*const fido\_dev\_t \*dev*);

## DESCRIPTION

The **fido\_dev\_get\_puat**() negotiates a FIDO2 PIN/UV Auth token with the permission bitmask specified by *perm* and associates it with *dev*. If *perm* does not require specifying a relying party ID, *rpid* may be NULL. Otherwise *rpid* must point to a NUL-terminated UTF-8 string. If a PIN is not needed to authenticate against *dev*, then *pin* may be NULL. Otherwise *pin* must point to a NUL-terminated UTF-8 string. Supported flags for *perm* are

- FIDO\_PUAT\_MAKECRED

  Permission for **fido\_dev\_make\_cred**(). An *rpid* is required.

- FIDO\_PUAT\_GETASSERT

  Permission for **fido\_dev\_get\_assert**(). An *rpid* is required.

- FIDO\_PUAT\_CREDMAN

  Permission for the credential management API. An *rpid* is optional.

- FIDO\_PUAT\_BIOENROLL

  Permission for the biometric enrollment API. The *rpid* is ignored.

- FIDO\_PUAT\_LARGEBLOB

  Permission for the large blobs API. The *rpid* is ignored.

- FIDO\_PUAT\_CONFIG

  Permission for the authenticator config API. The *rpid* is ignored.

- FIDO\_PUAT\_CREDMAN\_RO

  Persistent read-only permission for the credential management API. The *rpid* is ignored.

The **fido\_dev\_set\_puat**() function can be used to associate a token retrieved out-of-band with *dev*. No references to *ptr* are kept. If *ptr* is NULL or *len* is zero, the token is cleared from *dev*.

The **fido\_dev\_puat\_ptr**() function returns a pointer to the PIN/UV Auth token currently associated with *dev*. The corresponding length can be obtained by calling **fido\_dev\_puat\_len**().

Associating a token with *dev* has the main benefit of reducing the user interaction to a minimum in a sequence of operations where each would require some form of UV. Likewise, if multiple operations in a sequence need to be authenticated by a PIN, using a token avoids the need of caching the PIN for the duration of the whole sequence.

Once a token is associated with *dev*, it will take precedence over the regular PIN/UV Authentication for all operations that support the use of a token, until it is cleared from *dev*. The validity of the token is determined by the authenticator; it may expire and its permissions may be affected by its use. An invalid token is not automatically cleared from *dev*. Applications can call **fido\_dev\_set\_puat**() or **fido\_dev\_get\_puat**() to discard or obtain a new PIN/UV Auth token and retry the failed operation as appropriate.

For further details on token semantics, please refer to the FIDO Client to Authenticator Protocol (CTAP) standard.

## RETURN VALUES

On success, **fido\_dev\_get\_puat**() and **fido\_dev\_set\_puat**() return FIDO\_OK. On error, a different error code defined in ⟨fido/err.h⟩ is returned.

**fido\_dev\_puat\_ptr**() may return NULL if there is no PIN/UV Auth token associated with *dev*. If not NULL, the returned pointer is guaranteed to exist until either **fido\_dev\_get\_puat**() **fido\_dev\_set\_puat**(), or **fido\_dev\_free**() is invoked.

## SEE ALSO

[fido\_dev\_new(3)](/fido_dev_new/3.md)