---
title: "Exchange a capture receipt for an activation token"
method: POST
path: "/vaults/v1/{vault_id}/activation-tokens"
tags: ["vault"]
---

# Exchange a capture receipt for an activation token

`POST /vaults/v1/{vault_id}/activation-tokens`

## Request

- Base URL: `https://api.run402.com`
- URL: `https://api.run402.com/vaults/v1/{vault_id}/activation-tokens`
- Auth: one of:
  - API key in header `SIGN-IN-WITH-X`
  - HTTP bearer
  - HTTP bearer

Mints the `activation_token` an apply commit consumes exactly once inside its activation transaction. The receipt's own service signature is verified first, then every binding is re-checked against the operation and the vault: capture id, canonical plan digest, snapshot commitment, owning vault, and the installed `authorization_epoch`. A generation a repair superseded is refused. An `ISSUED` token for the same operation and head is returned again with `200` and `reissued: true` — minting is idempotent, consumption is not.

## Path parameters

- `vault_id` string, required

## Headers

- `SIGN-IN-WITH-X` string, required

## Request body

- object
  - `operation_id` string, required: The apply operation the token binds to.
  - `capture_receipt` object, required: The signed capture_receipt returned by the admission, verbatim.

## Response `200`

Reissued — an ISSUED token for this operation and head already existed

- object
  - `activation_token` object
  - `object_id` string
  - `reissued` boolean
  - `next_actions` object[]

## Other responses

- `201`: Token minted
- `400`: VALIDATION_FAILED — the receipt is malformed, not signed by this control plane, or issued for another vault
- `403`: VAULT_ACCESS_DENIED
- `404`: OPERATION_NOT_FOUND
- `409`: DEPLOY_BLOCKED_PUSH_FAILED (details.refusal names the cause) / AUTHORIZATION_EPOCH_STALE / REPAIR_FENCE_PENDING
- `503`: SERVICE_UNAVAILABLE — the service signing key is not provisioned

---

[API](https://skmtc.dev/run402/apis/run402-api.md) · [All operations](https://skmtc.dev/run402/apis/run402-api/llms.txt) · [OpenAPI document](https://skmtc.dev/run402/apis/run402-api/revisions/893607557f50?raw)