Skip to content
StratumStratum Docs

Whether this node's configured bootstrap-admin password matches the shared cluster hash.

GET
/v1/admin/iam/bootstrap-password-status
Code sample: Shell / cURL
curl --request GET \
  --url https://stratum.example.com/v1/admin/iam/bootstrap-password-status \
  --header 'Authorization: Bearer <token>'

Bootstrap-admin endpoint. Reports, for THIS node, whether the bootstrap-admin password configured in its environment (STRATUM_IAM_ADMIN_PASSWORD) still verifies against the shared cluster IAM hash in Postgres.

HA installs share ONE IAM hash, so a per-node environment drift means the admin login only works against whichever node last set the hash the desync that repeatedly bit installs. stratumctl admin selfcheck calls this on EVERY cluster node to catch a drifted node before it locks an operator out. The response reveals only a boolean match plus who last rotated the hash; it never returns any secret.

Authorizations

Section titled “Authorizations”

Responses

Section titled “Responses”

200

Section titled “200”

This node’s bootstrap-admin password consistency.

Media typeapplication/json

Per-node report of whether the bootstrap-admin password configured in a node’s environment matches the shared cluster IAM hash (self-check).

object
nodeId
required

The node answering this probe.

string
email
required

The bootstrap-admin email whose hash was checked.

string
configured
required

Whether this node has a bootstrap-admin password set in its environment to check. False (e.g. a random auto-generated password that was never captured back into the env) means the match isn’t assertable — treat as not-applicable, not a failure.

boolean
matches
required

Whether the configured password verifies against the shared cluster IAM hash. False on a configured node is the desync: the admin login won’t authenticate against this node’s environment.

boolean
rotatedBy

Who last set the shared hash: stratum-bootstrap = still system-managed; a user id = an operator changed it via the API.

string

Example 

{
  "nodeId": "n-msst0001",
  "email": "admin@cloud.internal",
  "rotatedBy": "stratum-bootstrap"
}

403

Section titled “403”

Authenticated but not authorized.

Media typeapplication/problem+json
object
type
required
string format: uri
title
required
string
status
required
integer
>= 400 <= 599
detail
string
instance
string format: uri-reference
requestId
required
string
code
required
string
issues

The findings of a rejected IAM policy document (custom and resource policies).

Array<object>

One finding of a rejected IAM policy document. A rejection lists every finding, so the author fixes the document in one round trip.

object
code
required

The finding, e.g. INVALID_DOCUMENT, UNKNOWN_ACTION, ACTION_NOT_APPLICABLE.

string
statement
required

Index of the statement at fault; -1 for the document as a whole.

integer
>= -1
detail
required
string
action

The offending action, where one is at fault (ACTION_NOT_APPLICABLE).

string
errors

Field errors, for codes that carry them: each problem at its field (see FieldError). Documented on the responses that set it, e.g. approveNodeJoin’s INVALID_INPUT and JOIN_APPROVAL_REFUSED. Absent otherwise.

Array<object>

One field’s problem, the stage-2 installer API’s shape. field is the field’s path, message what is wrong with it.

object
field
required

The field’s path, e.g. links[0].interface, disks[1].confirm, mgmt.address or role; empty for the whole request.

string
message
required
string
details

Structured facts about the refusal, for codes that carry them. The shape is fixed per code and documented on the response that answers it, e.g. IMAGE_POOL_MISMATCH (see ImagePoolMismatchDetails) and IMAGE_IN_USE. Absent for codes that carry none.

object
key
additional properties
any

Example 

{
  "issues": [
    {
      "code": "ACTION_NOT_APPLICABLE",
      "action": "compute:CreateVpc"
    }
  ]
}