Skip to main content

Redeem a setup code for an operator connection credential

POST 
/api/v1/operator/enroll/redeem

The only operator route that takes no connection credential. It takes the single-use setup code as a bearer (ttopg_ prefix), which is accepted here and nowhere else. A cookie or session next to it is refused. The request body is ignored: the code fixes the user, workspace, scopes, role ceiling, name and lifetime, and the issuing person's access is checked again at this moment. On success the credential is returned once with Cache-Control no-store and is not stored or recoverable; if the response is lost, revoke the new connection and create a new setup code. Every failure before the code is proven valid looks the same, so a wrong or unknown code reveals nothing. Rate limited per client address.

Responses​

Connection created; the credential is shown once

Response Headers
    Cache-Control