MetriBeacon
Menu

POST Create a local plugin ownership challenge

/api/v1/auth/plugin/bootstrap/challenge

Create a five-minute challenge bound to the current machine account, recovery key, management credential and registered client. No rights are granted.

On this page

Access and permissions

Create a five-minute challenge bound to the current machine account, recovery key, management credential and registered client. No rights are granted.

Machine management credentials in Authorization: Bearer. Check the permissions (scopes) required by the operation.

Parameters and headers

No path, query or additional request-header parameters.

Request body

FieldType and limitsRequiredMeaning
$object; {"additionalProperties":false}Yes—
$.public_keystringYes—
$.client_idstringYes—

Responses

application/json

FieldType and limitsRequiredMeaning
$objectYes—

application/json

FieldType and limitsRequiredMeaning
$objectYes—

application/json

FieldType and limitsRequiredMeaning
$objectYes—
Stable error codes
plugin_identity_required
plugin_identity_required

application/json

FieldType and limitsRequiredMeaning
$objectYes—

application/json

FieldType and limitsRequiredMeaning
$objectYes—

application/json

FieldType and limitsRequiredMeaning
$objectYes—
Stable error codes
invalid_request
invalid_request

application/json

FieldType and limitsRequiredMeaning
$objectYes—
Stable error codes
plugin_request_rate

application/json

FieldType and limitsRequiredMeaning
$objectYes—

application/json

FieldType and limitsRequiredMeaning
$objectYes—

Retries and asynchronous work

This change does not have a general retry guarantee. If the response is unclear, read the affected resource before trying again. Follow Retry-After waiting times and request new sign-in or action codes when they expire.

Request examples

Replace demo IDs, timestamps and placeholders with your own values. For a retry, keep the same IDs, time and content. These examples do not run requests on this page.

Keep login links, codes, cookies and keys private. Do not print them in logs or share them in support requests.

shell
curl --silent --show-error --output /dev/null --write-out "%{http_code}\n" \
  --request POST \
  --header @"$HOME/.config/metribeacon/headers.txt" \
  "https://metribeacon.com/api/v1/auth/plugin/bootstrap/challenge"
python
import json
from pathlib import Path
from urllib.request import Request, HTTPRedirectHandler, build_opener
from urllib.error import HTTPError

headers = json.loads((Path.home() / ".config/metribeacon/headers.json").read_text())
request = Request("https://metribeacon.com/api/v1/auth/plugin/bootstrap/challenge", data=None, headers=headers, method="POST")
class NoRedirect(HTTPRedirectHandler):
    def redirect_request(self, request, fp, code, message, headers, target):
        return None

opener = build_opener(NoRedirect())
try:
    with opener.open(request, timeout=10) as response:
        print(response.status)
except HTTPError as error:
    print(error.code)
    error.close()
javascript
import { readFile } from "node:fs/promises";
import { homedir } from "node:os";
import { join } from "node:path";

const headers = JSON.parse(await readFile(join(homedir(), ".config/metribeacon/headers.json"), "utf8"));
const response = await fetch("https://metribeacon.com/api/v1/auth/plugin/bootstrap/challenge", {
  method: "POST", headers, redirect: "manual",
  signal: AbortSignal.timeout(10000),
});
console.log(response.status);
await response.body?.cancel();
go
package main

import (
  "fmt"
  "net/http"
  "time"
  "encoding/json"
  "os"
  "path/filepath"
)

func main() {
  home, err := os.UserHomeDir(); if err != nil { panic("request failed; credentials and response omitted") }
  raw, err := os.ReadFile(filepath.Join(home, ".config/metribeacon/headers.json")); if err != nil { panic("request failed; credentials and response omitted") }
  var headers map[string]string
  if json.Unmarshal(raw, &headers) != nil { panic("invalid local headers") }
  request, err := http.NewRequest("POST", "https://metribeacon.com/api/v1/auth/plugin/bootstrap/challenge", nil)
  if err != nil { panic("request failed; credentials and response omitted") }
  for name, value := range headers { request.Header.Set(name, value) }
  client := &http.Client{Timeout: 10*time.Second, CheckRedirect: func(*http.Request, []*http.Request) error { return http.ErrUseLastResponse }}
  response, err := client.Do(request)
  if err != nil { panic("request failed; credentials and response omitted") }
  defer response.Body.Close()
  fmt.Println(response.StatusCode)
}
  • HTTP API, OAuth and MCP

    Find the user API endpoints, their permissions, fields, examples and response formats.

  • POST Authenticate the local plugin identity

    Verify a signed ownership challenge. Initial access is restricted to catalog read scopes; revoked or expired connections require browser approval. Tokens returned here are private helper state and must never be shown in chat.

  • GET Read the current plugin connection

    Read the connection, scopes, permission revision and email verification state identified by this catalog OAuth token.

  • POST Request email verification or plugin rights

    Create a ten-minute browser request for this token’s own connection. Email verification never merges accounts; rights proposals are restricted to the five catalog scopes and cannot approve themselves.