Skip to content
StratumStratum Docs

Trade the node's install automation key for a short-lived admin session.

POST
/v1/iam/automation-session
Code sample: Shell / cURL
curl --request POST \
  --url https://stratum.example.com/v1/iam/automation-session \
  --header 'Content-Type: application/json' \
  --data '{ "key": "example" }'

. For the installer’s own steps (smoke checks, selfcheck, the node’s CLI profile) that run before any human has chosen the admin password. The key is STRATUM_IAM_AUTOMATION_KEY in the node’s root-only controlplane.env: each node has its own, never printed or logged, and a control plane accepts only its own. The session belongs to the bootstrap admin, lasts one hour, and is exempt from the password-change gate. Audited Critical (iam.auth.automation_session).

404 AUTOMATION_DISABLED when this node has no key.

Request Bodyrequired

Section titled “Request Bodyrequired”
Media typeapplication/json
object
key
required
string

Example generated

{
  "key": "example"
}

Responses

Section titled “Responses”

200

Section titled “200”

Session issued.

Media typeapplication/json
object
token
required
string
user
required
object
id
required
string
/^u-[a-z0-9-]+$/
email
required
string format: email
displayName
required
string
state
required
string
Allowed values: pending active suspended deleted
lastLoginAt
string format: date-time
nullable
createdAt
required
string format: date-time
updatedAt
required
string format: date-time
createdBy
required
string
mfaEnabled

Whether the user has an active TOTP MFA enrollment..

boolean
passwordChangeRequired

. Present (true) on the login response and GET /v1/iam/me while the user still has the install-time password.

boolean
mfaEnrollmentRequired

. Present (true) on the login response and GET /v1/iam/me while a TOTP enrollment is owed after a node MFA recovery.

boolean
passwordChangeRequired

. The user still has the install-time password (a one-time credential). Until POST /v1/iam/users/{userId}/password sets a new one, this session may only call GET /v1/iam/me, POST /v1/iam/logout and that endpoint; everything else answers 403 PASSWORD_CHANGE_REQUIRED.

boolean
mfaEnrollmentRequired

. A node recovery (stratum-bootstrap recover admin-mfa) removed the user’s TOTP. Until a new one is enrolled and verified (POST /v1/iam/users/{userId}/mfa/totp/enroll, then .../verify), this session may only call those two, GET /v1/iam/me and POST /v1/iam/logout; everything else answers 403 MFA_ENROLLMENT_REQUIRED. When a password change is owed too, it comes first.

boolean

Example 

{
  "user": {
    "state": "pending"
  }
}

400

Section titled “400”

Bad request.

Media typeapplication/problem+json
object
type
required
string format: uri
title
required
string
status
required
integer
>= 400 <= 599
detail
string
instance
string format: uri-reference
requestId
required
string
code
required
string
issues

The findings of a rejected IAM policy document (custom and resource policies).

Array<object>

One finding of a rejected IAM policy document. A rejection lists every finding, so the author fixes the document in one round trip.

object
code
required

The finding, e.g. INVALID_DOCUMENT, UNKNOWN_ACTION, ACTION_NOT_APPLICABLE.

string
statement
required

Index of the statement at fault; -1 for the document as a whole.

integer
>= -1
detail
required
string
action

The offending action, where one is at fault (ACTION_NOT_APPLICABLE).

string
errors

Field errors, for codes that carry them: each problem at its field (see FieldError). Documented on the responses that set it, e.g. approveNodeJoin’s INVALID_INPUT and JOIN_APPROVAL_REFUSED. Absent otherwise.

Array<object>

One field’s problem, the stage-2 installer API’s shape. field is the field’s path, message what is wrong with it.

object
field
required

The field’s path, e.g. links[0].interface, disks[1].confirm, mgmt.address or role; empty for the whole request.

string
message
required
string
details

Structured facts about the refusal, for codes that carry them. The shape is fixed per code and documented on the response that answers it, e.g. IMAGE_POOL_MISMATCH (see ImagePoolMismatchDetails) and IMAGE_IN_USE. Absent for codes that carry none.

object
key
additional properties
any

Example 

{
  "issues": [
    {
      "code": "ACTION_NOT_APPLICABLE",
      "action": "compute:CreateVpc"
    }
  ]
}

401

Section titled “401”

Missing or invalid token.

Media typeapplication/problem+json
object
type
required
string format: uri
title
required
string
status
required
integer
>= 400 <= 599
detail
string
instance
string format: uri-reference
requestId
required
string
code
required
string
issues

The findings of a rejected IAM policy document (custom and resource policies).

Array<object>

One finding of a rejected IAM policy document. A rejection lists every finding, so the author fixes the document in one round trip.

object
code
required

The finding, e.g. INVALID_DOCUMENT, UNKNOWN_ACTION, ACTION_NOT_APPLICABLE.

string
statement
required

Index of the statement at fault; -1 for the document as a whole.

integer
>= -1
detail
required
string
action

The offending action, where one is at fault (ACTION_NOT_APPLICABLE).

string
errors

Field errors, for codes that carry them: each problem at its field (see FieldError). Documented on the responses that set it, e.g. approveNodeJoin’s INVALID_INPUT and JOIN_APPROVAL_REFUSED. Absent otherwise.

Array<object>

One field’s problem, the stage-2 installer API’s shape. field is the field’s path, message what is wrong with it.

object
field
required

The field’s path, e.g. links[0].interface, disks[1].confirm, mgmt.address or role; empty for the whole request.

string
message
required
string
details

Structured facts about the refusal, for codes that carry them. The shape is fixed per code and documented on the response that answers it, e.g. IMAGE_POOL_MISMATCH (see ImagePoolMismatchDetails) and IMAGE_IN_USE. Absent for codes that carry none.

object
key
additional properties
any

Example 

{
  "issues": [
    {
      "code": "ACTION_NOT_APPLICABLE",
      "action": "compute:CreateVpc"
    }
  ]
}

Headers

Section titled “Headers”
WWW-Authenticate
string

404

Section titled “404”

Resource not found.

Media typeapplication/problem+json
object
type
required
string format: uri
title
required
string
status
required
integer
>= 400 <= 599
detail
string
instance
string format: uri-reference
requestId
required
string
code
required
string
issues

The findings of a rejected IAM policy document (custom and resource policies).

Array<object>

One finding of a rejected IAM policy document. A rejection lists every finding, so the author fixes the document in one round trip.

object
code
required

The finding, e.g. INVALID_DOCUMENT, UNKNOWN_ACTION, ACTION_NOT_APPLICABLE.

string
statement
required

Index of the statement at fault; -1 for the document as a whole.

integer
>= -1
detail
required
string
action

The offending action, where one is at fault (ACTION_NOT_APPLICABLE).

string
errors

Field errors, for codes that carry them: each problem at its field (see FieldError). Documented on the responses that set it, e.g. approveNodeJoin’s INVALID_INPUT and JOIN_APPROVAL_REFUSED. Absent otherwise.

Array<object>

One field’s problem, the stage-2 installer API’s shape. field is the field’s path, message what is wrong with it.

object
field
required

The field’s path, e.g. links[0].interface, disks[1].confirm, mgmt.address or role; empty for the whole request.

string
message
required
string
details

Structured facts about the refusal, for codes that carry them. The shape is fixed per code and documented on the response that answers it, e.g. IMAGE_POOL_MISMATCH (see ImagePoolMismatchDetails) and IMAGE_IN_USE. Absent for codes that carry none.

object
key
additional properties
any

Example 

{
  "issues": [
    {
      "code": "ACTION_NOT_APPLICABLE",
      "action": "compute:CreateVpc"
    }
  ]
}