Removing a strong factor is itself a sensitive action, so deletion is a two-step SCA ceremony proven with the passkey being removed. This call binds a deletion challenge to the named credentialId (the id returned by /business/passkey/list) and returns the WebAuthn assertion request for that credential alone: allowCredentials lists only the passkey being removed, and no other factor is accepted — a user who no longer holds the key goes through the liveness-gated 2FA reset. An unknown credentialId is refused with 999998. The challenge expires after 10 minutes. Nothing is deleted by this call; complete the removal with /business/passkey/delete/confirm.