---
title: "Register the runtime's sidecar as a share holder"
method: POST
path: "/v1/runtimes/{runtime_id}/tss/holder"
tags: ["Key Custody"]
---

# Register the runtime's sidecar as a share holder

`POST /v1/runtimes/{runtime_id}/tss/holder`

## Request

- Base URL: `https://api.1claw.co`
- URL: `https://api.1claw.co/v1/runtimes/{runtime_id}/tss/holder`
- Auth: HTTP bearer

Called by the runtime's agent (the Shroud sidecar, at boot) with the P-256
public key it generated. The owner can then provision a threshold-key
share to this runtime, letting the agent co-sign below-cap sends
unattended. Re-registering replaces the key; deleting the runtime revokes
every share held by it.

## Request body

- object
  - `public_key` string, required: Base64 SEC1 uncompressed P-256 point (65 bytes).

## Response `201`

Registered

- TssHolder
  - `holder_id` string, uuid
  - `runtime_id` string, uuid
  - `agent_id` string, uuid
  - `public_key` string
  - `registered_at` string, date-time
  - `last_seen_at` string, date-time

## Other responses

- `400`: Invalid request
- `401`: Authentication required or invalid
- `403`: Insufficient permissions
- `404`: Resource not found

---

[API](https://skmtc.dev/1claw/apis/1claw-api.md) · [All operations](https://skmtc.dev/1claw/apis/1claw-api/llms.txt) · [OpenAPI document](https://skmtc.dev/1claw/apis/1claw-api/revisions/5fa0918f3b41?raw)