Register an agent
POST/api/v1/certops/agent/register
Outbound-only agent enrollment using a single-use, hashed, expiring bootstrap token (bearer); registration returns the per-agent credential exactly once, together with the active job-signing public key. Request body is the agent-protocol envelope with messageType register (packages/contracts/certops/agent-protocol.schema.json, additionalProperties false); that schema remains authoritative for body shapes. Unknown, expired, used, and revoked bootstrap tokens all return the same generic 401 so callers cannot probe token state. Private key material is audited and rejected with 422 before rollout gating. Hidden with 404 while certops.enabled is disabled.
Request
Responses
- 201
- 400
- 401
- 404
- 409
- 422
- 429
- 500
- 503
Agent registered; the credential is shown exactly once
Message envelope or register body failed agent-protocol validation
Generic bootstrap unauthorized (identical body for unknown, expired, used, and revoked tokens; also returned when the registration lost a single-use race)
CertOps is disabled deployment-wide (route is hidden)
An agent with this agentId already exists
Request rejected because it contained private key material
CertOps machine-token rate limit exceeded
Internal server error
Security audit sink unavailable while rejecting private material