Registration (create) returns an attestation object holding authenticator data (with the new credential's ID and COSE public key) and an attestation statement; authentication (get) returns authenticator data, clientDataJSON and a signature over authenticatorData ‖ SHA-256(clientDataJSON). The relying party verifies the challenge, the origin and type in clientDataJSON, the RP ID hash and flags in the authenticator data, and the signature (WebAuthn Level 3 §7.1 and §7.2).
Level 3 standardized features browsers had already shipped: JSON serialization helpers (toJSON, parseCreationOptionsFromJSON), the Signal API for credential updates, getClientCapabilities(), related origin requests, conditional create and the PRF extension for deriving encryption keys. Level 2 was published in April 2021, Level 1 in March 2019.
WebAuthn is the web half of FIDO2; CTAP connects the browser to external authenticators. The WebAuthn inspector decodes clientDataJSON, authenticator data and attestation objects.