Removing a strong factor is itself a sensitive action, so deletion is a two-step SCA ceremony. This call binds a deletion challenge to the named credentialId (the id returned by /business/passkey/list) and opens every factor the subject can confirm with: passkey (any passkey enrolled on the account, including the one being removed), totp when an authenticator is enrolled, and sms when a mobile number is on file (an OTP is dispatched). The WebAuthn assertion request for the passkey option is returned here directly — no separate approval ceremony is needed. The challenge expires after 10 minutes. Nothing is deleted by this call; complete the removal with /business/passkey/delete/confirm.