POST /v1/auth/ide/enrollments/current/claim-first-owner

Claim first ide owner. Permissions, parameters, responses and examples.

0.1.0 · source bccff29 · Immutable snapshot · Download OpenAPI specification

Read pinned handler: apps/api/kodesec_api/auth.py:2217

Claim first ide owner

Consume the installer bootstrap to approve only a pristine first IDE.

Source preview; no stable third-party integration promise. This page makes no request to a local installation.

Authority

Exact pending IDE capability protocol. Activation and owner-claim/wait have source-defined active-generation reconciliation.

Inspect the authority source · Authentication guide

Parameters and headers

No explicit path, query or header parameters are declared here. The authority boundary still applies.

Request body

JSON body · required · IdeFirstOwnerClaimRequest

Field	Type	Presence
`bootstrap_token`	string	Required
`expected_generation`	integer	Required
`expected_request_id`	string	Required
`expected_revision`	integer	Optional

Complete declared request schema

{
  "additionalProperties": false,
  "properties": {
    "bootstrap_token": {
      "maxLength": 256,
      "minLength": 1,
      "title": "Bootstrap Token",
      "type": "string"
    },
    "expected_generation": {
      "maximum": 2147483647,
      "minimum": 1,
      "title": "Expected Generation",
      "type": "integer"
    },
    "expected_request_id": {
      "pattern": "^ker1_[A-Za-z0-9_-]{24}$",
      "title": "Expected Request Id",
      "type": "string"
    },
    "expected_revision": {
      "const": 1,
      "default": 1,
      "title": "Expected Revision",
      "type": "integer"
    }
  },
  "required": [
    "bootstrap_token",
    "expected_request_id",
    "expected_generation"
  ],
  "title": "IdeFirstOwnerClaimRequest",
  "type": "object"
}

Responses

Status	Meaning and declared shape
`200`	Successful Response application/json · IdeEnrollmentStatusResponse { "additionalProperties": false, "properties": { "activation_expires_at": { "format": "date-time", "title": "Activation Expires At", "type": "string" }, "decision_at": { "anyOf": [ { "format": "date-time", "type": "string" }, { "type": "null" } ], "title": "Decision At" }, "request_id": { "pattern": "^ker1_[A-Za-z0-9_-]{24}$", "title": "Request Id", "type": "string" }, "revision": { "maximum": 2147483647, "minimum": 1, "title": "Revision", "type": "integer" }, "state": { "enum": [ "awaiting_approval", "approved", "rejected", "expired" ], "title": "State", "type": "string" } }, "required": [ "request_id", "state", "revision", "decision_at", "activation_expires_at" ], "title": "IdeEnrollmentStatusResponse", "type": "object" }
`400`	Exact host, malformed request or URL credential refusal application/json · object `{ "properties": { "detail": { "type": "string" } }, "required": [ "detail" ], "type": "object" }`
`401`	Missing or invalid membership application/json · object `{ "properties": { "detail": { "type": "string" } }, "required": [ "detail" ], "type": "object" }`
`403`	Exact origin, CSRF or route authority refusal application/json · object `{ "properties": { "detail": { "type": "string" } }, "required": [ "detail" ], "type": "object" }`
`409`	Refresh current revision and identity. A conflicting command must not be blindly repeated. See source-linked error catalog.
`422`	Validation Error application/json · HTTPValidationError `{ "properties": { "detail": { "items": { "$ref": "#/components/schemas/ValidationError" }, "title": "Detail", "type": "array" } }, "title": "HTTPValidationError", "type": "object" }`
`429`	Authentication rate or connection limit application/json · object `{ "properties": { "detail": { "type": "string" } }, "required": [ "detail" ], "type": "object" }`

An empty or broad schema preserves the source contract. It is not a promise of an empty response.

Source-linked errors

Literal HTTP errors in this handler and same-file helper call graph, plus control middleware. Dynamic and cross-module failures may add other errors; source links are authoritative.

5 source error observations

Status	Source detail	Recovery
401 ↗	`invalid pending IDE capability`	Reconcile the exact browser or IDE membership through the normal owner workflow.
401 ↗	`invalid pending IDE capability`	Reconcile the exact browser or IDE membership through the normal owner workflow.
401 ↗	`invalid one-time credential`	Reconcile the exact browser or IDE membership through the normal owner workflow.
409 ↗	`one-time credential already consumed`	Refresh current revision and identity. A conflicting command must not be blindly repeated.
401 ↗	`IDE capability required`	Reconcile the exact browser or IDE membership through the normal owner workflow.

Read the recovery guide

Synthetic examples

These examples validate declared JSON shapes and formats. They contain no real installation data and do not prove runtime admission, cross-field validation, authority or successful work.

Request JSON

{
  "bootstrap_token": "synthetic",
  "expected_generation": 1,
  "expected_request_id": "ker1_AAAAAAAAAAAAAAAAAAAAAAAA"
}

Response 200 JSON

{
  "activation_expires_at": "2026-01-01T00:00:00Z",
  "decision_at": "2026-01-01T00:00:00Z",
  "request_id": "ker1_AAAAAAAAAAAAAAAAAAAAAAAA",
  "revision": 1,
  "state": "awaiting_approval"
}

Download this service's complete OpenAPI

All referenced models remain in its components section. Browse control model definitions.