WebAuthn is what a website calls in the browser; CTAP is how the browser or operating system talks to an external authenticator over USB, NFC or Bluetooth, or to a phone through the hybrid transport. Platform authenticators (Windows Hello, Touch ID, Android) are reached through operating system APIs and do not need CTAP on the wire.
CTAP 2.2 was published in July 2025 and CTAP 2.3 became a Proposed Standard in February 2026; FIDO2 certification is now issued against CTAP 2.3. CTAP1 is the older U2F protocol, which FIDO2 security keys still support for backwards compatibility. Server developers rarely deal with CTAP directly: they implement WebAuthn relying-party verification and treat all authenticators alike.