Skip to main content

Bootstrap a CertOps diagnostic agent

POST 
/api/v1/workspaces/:id/certops/agents/diagnostic-bootstrap

Session-authenticated (requires certops.agents.diagnose, admin-only). Atomically consumes a single-use requestId, creates an agent with agent_kind "diagnostic", and creates its protocol_smoke job, all in one transaction. The response's credential is returned exactly once and is not recoverable afterward. Retrying with the same requestId never replays the original agentId/credential/job; it fails with diagnostic_bootstrap_already_consumed. Requests are rate limited per workspace. Diagnostic agents that stay inactive for 24 hours are retired automatically; retirement revokes the credential in the same transaction that marks the agent retired, so a retired diagnostic agent's credential fails authentication immediately, not just authorization.

Request​

Responses​

Diagnostic agent and its protocol_smoke job were created