Sign in
auth

Consume a credential-establishment authority and set an initial credential.

Changed on

The named — and only — exception to "a new credential may never authorize its own enrolment" (human-auth ADR § Credential-establishment authority). The authority is target-bound, purpose-bound, single-use, expiring, and issued only by the bootstrap path, credential-reset, a member invitation, local break-glass, or recovery.

Consuming it establishes exactly one initial credential, atomically, and nothing more: no session is created, no assurance is carried, no reauthentication window opens. The holder authenticates afterwards with the credential they just set, like anyone else.

Every refusal — unknown authority, expired, already consumed, wrong epoch, weak password — answers the same 401 so presentation reveals nothing about which authorities exist.

post/api/v1/auth/credential/establish

Request

  • Base URL: / (relative, and the document was published on a file host, not at the API’s origin)
  • URL: /api/v1/auth/credential/establish
  • Auth: none required

Request body

authoritystring required

The single-use credential-establishment authority, exactly as delivered. Never logged, never audited, never echoed.

passwordstring required

The initial credential. Minimum length 12, no composition rules, no forced rotation (NIST SP 800-63B shape); checked against a bundled common-password list at set time only, never at login.

Response

Credential established. No session, no assurance.

Changes

  • 54b2780eec85Revision changes
    • info

      added the optional property / to the response with the status

    • info

      added the optional property / to the response with the status

    • info

      added the optional property / to the response with the status

    • info

      added the optional property / to the response with the status

    • info

      added the optional property / to the response with the status

  • f84a1cd8a05aRevision changes
    • warning

      added the new payload_too_large enum value to the / response property for the response status

    • warning

      added the new payload_too_large enum value to the / response property for the response status

    • warning

      added the new payload_too_large enum value to the / response property for the response status

    • warning

      added the new payload_too_large enum value to the / response property for the response status

    • warning

      added the new payload_too_large enum value to the / response property for the response status

    • warning

      added the new unprocessable enum value to the / response property for the response status

    • warning

      added the new unprocessable enum value to the / response property for the response status

    • warning

      added the new unprocessable enum value to the / response property for the response status

    • warning

      added the new unprocessable enum value to the / response property for the response status

    • warning

      added the new unprocessable enum value to the / response property for the response status