MetriBeacon
Menu

POST Authenticate the local plugin identity

/api/v1/auth/plugin/bootstrap

Verify a signed ownership challenge. Initial access is restricted to catalog read scopes; revoked or expired connections require browser approval. Tokens returned here are private helper state and must never be shown in chat.

On this page

Access and permissions

Verify a signed ownership challenge. Initial access is restricted to catalog read scopes; revoked or expired connections require browser approval. Tokens returned here are private helper state and must never be shown in chat.

Machine management credentials in Authorization: Bearer. Check the permissions (scopes) required by the operation.

Parameters and headers

No path, query or additional request-header parameters.

Request body

FieldType and limitsRequiredMeaning
$object; {"additionalProperties":false}Yes—
$.proofobject; {"additionalProperties":false}Yes—
$.proof.challenge_idstring; {"format":"uuid"}Yes—
$.proof.noncestringYes—
$.proof.public_keystringYes—
$.proof.client_idstringYes—
$.proof.actionstring; {"enum":["bootstrap","permissions","email","status"]}Yes—
$.proof.desired_scopesarray<string; {"enum":["account:read","config:read","config:write","telemetry:read","telemetry:write","enterprise:read","notifications:manage"]}>; {"maxItems":7}No—
$.proof.desired_scopes[]string; {"enum":["account:read","config:read","config:write","telemetry:read","telemetry:write","enterprise:read","notifications:manage"]}Yes—
$.proof.expected_revisioninteger; {"minimum":0}No—
$.proof.reasonstring; {"maxLength":600}No—
$.proof.request_idstringNo—
$.signaturestringYes—

Responses

application/json

FieldType and limitsRequiredMeaning
$objectYes—

application/json

FieldType and limitsRequiredMeaning
$objectYes—

application/json

FieldType and limitsRequiredMeaning
$objectYes—
Stable error codes
plugin_identity_required
plugin_identity_revoked
plugin_identity_revoked

application/json

FieldType and limitsRequiredMeaning
$objectYes—

application/json

FieldType and limitsRequiredMeaning
$objectYes—
Stable error codes
plugin_setup_required

application/json

FieldType and limitsRequiredMeaning
$objectYes—
Stable error codes
invalid_request
invalid_proof
invalid_proof
invalid_request
invalid_request

application/json

FieldType and limitsRequiredMeaning
$objectYes—

application/json

FieldType and limitsRequiredMeaning
$objectYes—

application/json

FieldType and limitsRequiredMeaning
$objectYes—

Retries and asynchronous work

This change does not have a general retry guarantee. If the response is unclear, read the affected resource before trying again. Follow Retry-After waiting times and request new sign-in or action codes when they expire.

Request examples

Replace demo IDs, timestamps and placeholders with your own values. For a retry, keep the same IDs, time and content. These examples do not run requests on this page.

Keep login links, codes, cookies and keys private. Do not print them in logs or share them in support requests.

shell
curl --silent --show-error --output /dev/null --write-out "%{http_code}\n" \
  --request POST \
  --header @"$HOME/.config/metribeacon/headers.txt" \
  "https://metribeacon.com/api/v1/auth/plugin/bootstrap"
python
import json
from pathlib import Path
from urllib.request import Request, HTTPRedirectHandler, build_opener
from urllib.error import HTTPError

headers = json.loads((Path.home() / ".config/metribeacon/headers.json").read_text())
request = Request("https://metribeacon.com/api/v1/auth/plugin/bootstrap", data=None, headers=headers, method="POST")
class NoRedirect(HTTPRedirectHandler):
    def redirect_request(self, request, fp, code, message, headers, target):
        return None

opener = build_opener(NoRedirect())
try:
    with opener.open(request, timeout=10) as response:
        print(response.status)
except HTTPError as error:
    print(error.code)
    error.close()
javascript
import { readFile } from "node:fs/promises";
import { homedir } from "node:os";
import { join } from "node:path";

const headers = JSON.parse(await readFile(join(homedir(), ".config/metribeacon/headers.json"), "utf8"));
const response = await fetch("https://metribeacon.com/api/v1/auth/plugin/bootstrap", {
  method: "POST", headers, redirect: "manual",
  signal: AbortSignal.timeout(10000),
});
console.log(response.status);
await response.body?.cancel();
go
package main

import (
  "fmt"
  "net/http"
  "time"
  "encoding/json"
  "os"
  "path/filepath"
)

func main() {
  home, err := os.UserHomeDir(); if err != nil { panic("request failed; credentials and response omitted") }
  raw, err := os.ReadFile(filepath.Join(home, ".config/metribeacon/headers.json")); if err != nil { panic("request failed; credentials and response omitted") }
  var headers map[string]string
  if json.Unmarshal(raw, &headers) != nil { panic("invalid local headers") }
  request, err := http.NewRequest("POST", "https://metribeacon.com/api/v1/auth/plugin/bootstrap", nil)
  if err != nil { panic("request failed; credentials and response omitted") }
  for name, value := range headers { request.Header.Set(name, value) }
  client := &http.Client{Timeout: 10*time.Second, CheckRedirect: func(*http.Request, []*http.Request) error { return http.ErrUseLastResponse }}
  response, err := client.Do(request)
  if err != nil { panic("request failed; credentials and response omitted") }
  defer response.Body.Close()
  fmt.Println(response.StatusCode)
}