Skip to content
Kindgi

A site posts its public key with its enrollment code

View as Markdown
POST
/v1/auth/sites/enroll
curl --request POST \
  --url https://example.com/v1/auth/sites/enroll \
  --header 'Content-Type: application/json' \
  --data '{ "code": "example", "publicKey": {} }'

Public: the code is the credential. The site keeps its private key; Kindgi stores the public one, and answers the site’s id (its statements’ iss) and the audience (their aud). A wrong, used or expired code, or one for a paused or unregistered site, gets one answer: 401 site-enrollment-refused. Failures are limited per client (429 rate-limit-exceeded, with Retry-After). The body is at most 4096 bytes.

Request Bodyrequired

Section titled “Request Bodyrequired”
Media typeapplication/json
object
code
required
string
>= 1 characters <= 200 characters
publicKey
required

The site’s Ed25519 public key, a JWK: kty: OKP, crv: Ed25519, x and kid.

object
key
additional properties
any
Examplegenerated
{
  "code": "example",
  "publicKey": {}
}

Responses

Section titled “Responses”

200

Section titled “200”

The site’s id and its statements’ audience.

Media typeapplication/json
object
siteId
required

What the site’s statements carry as iss.

string format: uuid
audience
required

What the site’s statements carry as aud.

string
Examplegenerated
{
  "siteId": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0",
  "audience": "example"
}

400

Section titled “400”

A malformed body, or a public key that isn’t an Ed25519 JWK with a kid, or has a private part (site-key-invalid); it’s checked before the code.

Media typeapplication/json
object
error
required
object
code
required

Stable machine-readable discriminant. Values match domain error codes (see docs/API-ROUTE-CONVENTIONS.md §4.3).

string
message
required
string
details

Optional, kind-specific.

object
key
additional properties
any
requestId
required

Server-assigned request id; also echoed via X-Request-Id header.

string
Examplegenerated
{
  "error": {
    "code": "example",
    "message": "example",
    "details": {},
    "requestId": "example"
  }
}

401

Section titled “401”

The code was refused (site-enrollment-refused).

Media typeapplication/json
object
error
required
object
code
required

Stable machine-readable discriminant. Values match domain error codes (see docs/API-ROUTE-CONVENTIONS.md §4.3).

string
message
required
string
details

Optional, kind-specific.

object
key
additional properties
any
requestId
required

Server-assigned request id; also echoed via X-Request-Id header.

string
Examplegenerated
{
  "error": {
    "code": "example",
    "message": "example",
    "details": {},
    "requestId": "example"
  }
}

413

Section titled “413”

The body is over 4096 bytes (site-request-too-large).

Media typeapplication/json
object
error
required
object
code
required

Stable machine-readable discriminant. Values match domain error codes (see docs/API-ROUTE-CONVENTIONS.md §4.3).

string
message
required
string
details

Optional, kind-specific.

object
key
additional properties
any
requestId
required

Server-assigned request id; also echoed via X-Request-Id header.

string
Examplegenerated
{
  "error": {
    "code": "example",
    "message": "example",
    "details": {},
    "requestId": "example"
  }
}

429

Section titled “429”

Too many failures from this client.

Media typeapplication/json
object
error
required
object
code
required

Stable machine-readable discriminant. Values match domain error codes (see docs/API-ROUTE-CONVENTIONS.md §4.3).

string
message
required
string
details

Optional, kind-specific.

object
key
additional properties
any
requestId
required

Server-assigned request id; also echoed via X-Request-Id header.

string
Examplegenerated
{
  "error": {
    "code": "example",
    "message": "example",
    "details": {},
    "requestId": "example"
  }
}

See also