---
title: "Return the data needed to render a machine's install command"
method: POST
path: "/api/get_eyalsec_install_script_data/"
tags: ["Machines"]
---

# Return the data needed to render a machine's install command

`POST /api/get_eyalsec_install_script_data/`

## Request

- Base URL: `https://eyalsec.com`
- URL: `https://eyalsec.com/api/get_eyalsec_install_script_data/`
- Auth: one of:
  - API key in header `X-API-Key`
  - API key in cookie `__Host-es2session`

Mints a fresh single-use install secret for an es-python machine (JSON body) and returns the /install.sh URL, the machine's os_type (auto when its build is detected at install) and expires_in, the seconds the secret has left (it lasts 10 minutes). Requires attested=true (authorized-use attestation; 422 otherwise). You must hold the machine's product (403 otherwise). Needs os_type set (else 422). If the machine is installed, mid-install or failed it is reset to 'created' first (a re-install); the live credential is not rotated until the new install actually starts. With renew=true that reset never happens: a machine that is not 'created' is a 409 and is left alone. Cookie callers must pass CSRF.

This is a **write**: a read-only API key is refused with 403.

## Request body

- object
  - `public_id` string, required: The machine's public id.
  - `attested` boolean, required: Must be true: attests authorized use before a token is issued.
  - `renew` boolean: true: only replace an expiring command; 409 (and no reset) if the machine has started installing.

## Response `200`

OK.

- object

## Other responses

- `401`: The API key is missing, wrong, revoked or expired.
- `429`: A rate limit was hit, or the account is locked after wrong passwords. Retry-After gives the seconds to wait.
- `default`: An error. Check the status first; the body carries a short message, as JSON ({"error": "..."}) on most endpoints and as plain text on some. 400: malformed JSON, an invalid regex, an unreadable cursor or date, or an unknown value. 401: the API key is missing, wrong, revoked or expired. 403: a failed CSRF check, a read-only key trying to write, a product or feature not enabled on your account, a wrong password, or a write on an account limited to reading. 404: not found, including things that belong to another account. 409: conflict with the current state. 422: a field is missing or invalid. 429: a rate limit was hit, or the account is locked after wrong passwords. 500: something failed on our side.

---

[API](https://skmtc.dev/eyalsec/apis/eyalsec-api.md) · [All operations](https://skmtc.dev/eyalsec/apis/eyalsec-api/llms.txt) · [OpenAPI document](https://skmtc.dev/eyalsec/apis/eyalsec-api/revisions/dc7520689cf1?raw)