Bootstrap
instance_id*Instance Iduuidx-download-token?string|nullSuccessful Response
response?unknownapplication/jsoncurl -X GET 'https://example.com/internal/bootstrap/artifacts/497f6eca-6276-4993-bfeb-53cbbbba6f08'nullinstance_id*Instance Iduuidx-download-token?string|nullSuccessful Response
response?unknownapplication/jsoncurl -X GET 'https://example.com/internal/bootstrap/artifacts/497f6eca-6276-4993-bfeb-53cbbbba6f08/website'nullapplication/json- body
message?|nullseq*Seq1 <= value <= 4stage*Stage^(installing|configuring|securing|ready|error)$Successful Response
application/json- response
message*Messagestatus*Statuscurl -X POST 'https://example.com/internal/bootstrap/callback' \ -H 'Content-Type: application/json' \ -d '{ "seq": 1, "stage": "string"}'{ "message": "string", "status": "string"}application/json- body
bootstrap_token*Bootstrap Token^[0-9a-f]{64}$64 <= length <= 64csr_pem*Csr Pem100 <= length <= 10000Successful Response
application/json- response
cert_pem*Cert Pemsession_id*Session Idcurl -X POST 'https://example.com/internal/bootstrap/cert' \ -H 'Content-Type: application/json' \ -d '{ "bootstrap_token": "stringstringstringstringstringstringstringstringstringstringstri", "csr_pem": "stringstringstringstringstringstringstringstringstringstringstringstringstringstringstringstringstri"}'{ "cert_pem": "string", "session_id": "string"}application/json- body
Free-form diagnostic breadcrumb from bootstrap-agent.sh.
Distinct from CallbackRequest: this endpoint does NOT enforce monotonic sequencing or the installing→configuring→securing→ ready stage progression. Bootstrap-agent uses it to ship arbitrary trace messages ("hermes:install_sh:start", "hermes:tail:<200 chars of stderr>") that land in provision_logs without poisoning the strict callback state machine. Same JWT auth as /callback.
label*Label1 <= length <= 80level?Level^(info|warn|error)$"info"message*Messagelength <= 2000Successful Response
application/json- response
message*Messagestatus*Statuscurl -X POST 'https://example.com/internal/bootstrap/diagnostic' \ -H 'Content-Type: application/json' \ -d '{ "label": "string", "message": "string"}'{ "message": "string", "status": "string"}application/json- body
Pre-mTLS diagnostic breadcrumb from bootstrap-agent.sh.
Auths via the per-instance bootstrap_token (already in the script's env from cloud-init Jinja templating, valid before Phase 1 cert exchange). This is the only way to get a phase-by- phase trace from bootstrap-agent before mTLS is established — every regular /callback or /diagnostic request requires the callback_jwt that's only minted at Phase 2.
Kept narrow: log message body only, no other side effects. The bootstrap_token is one-shot and consumed at /secrets, but multiple early-diagnostic calls before /secrets are fine because we only USE the token for hash compare, not consume.
bootstrap_token*Bootstrap Token10 <= length <= 200instance_id*Instance Id1 <= length <= 80label*Label1 <= length <= 80level?Level^(info|warn|error)$"info"message*Messagelength <= 2000Successful Response
application/json- response
message*Messagestatus*Statuscurl -X POST 'https://example.com/internal/bootstrap/early-diagnostic' \ -H 'Content-Type: application/json' \ -d '{ "bootstrap_token": "stringstri", "instance_id": "string", "label": "string", "message": "string"}'{ "message": "string", "status": "string"}application/json- body
session_id*Session IdSuccessful Response
application/json- response
agent_config*agent_secrets*artifact_cipher_hash*Artifact Cipher Hashartifact_download_token*Artifact Download Tokenbundle_plain_hash*Bundle Plain Hashcallback_jwt*Callback Jwtdecryption_key_hex*Decryption Key Hexskill_lockfile*curl -X POST 'https://example.com/internal/bootstrap/secrets' \ -H 'Content-Type: application/json' \ -d '{ "session_id": "string"}'{ "agent_config": {}, "agent_secrets": {}, "artifact_cipher_hash": "string", "artifact_download_token": "string", "bundle_plain_hash": "string", "callback_jwt": "string", "decryption_key_hex": "string", "skill_lockfile": {}}