Skip to content
StratumStratum Docs

List join codes (bootstrap-admin).

GET
/v1/admin/cluster/join-codes
Code sample: Shell / cURL
curl --request GET \
  --url https://stratum.example.com/v1/admin/cluster/join-codes \
  --header 'Authorization: Bearer <token>'

. Every join code with its state and how many machines registered with it. The codes themselves are not stored and never listed. Gates on ha:DescribeJoinCodes.

Authorizations

Section titled “Authorizations”

Responses

Section titled “Responses”

200

Section titled “200”

The codes, newest first.

Media typeapplication/json
object
items
required
Array<object>

A join code: what a joining machine proves to the cluster’s join listener with a PAKE. Only its OPAQUE record is stored; the code itself is shown once, in the response that mints it. Reusable until it expires or is revoked: one code serves every node of a batch, because the approval is the gate, not the code.

object
id
required
string
selector

The code’s first two characters, which pick it among the cluster’s codes. Not secret on its own (10 of the code’s 50 bits); shown so a list can tell codes apart.

string
failedAttempts
required

PAKE exchanges started with this code and not proven. Past 10 the code is burned: revoked by system:too-many-attempts.

integer
endpoint
required

The join listener the code points at, host:port.

string
caFingerprint
required

The SHA-256 of the cluster root CA (DER) the code’s PAKE keys derive from, as hex pairs. A CA rotation ends the code (JOIN_CODE_STALE). A joiner learns the CA through the PAKE and pins it.

string
state
required

live until it expires or is revoked.

string
Allowed values: live expired revoked
createdBy
string
createdAt
required
string format: date-time
expiresAt
required
string format: date-time
revokedAt
string format: date-time
revokedBy

Who revoked it; system:too-many-attempts for a burned code.

string
registrations
required

How many machines registered with this code.

integer

Example 

{
  "items": [
    {
      "id": "jc-4f7k2q9m",
      "selector": "4F",
      "endpoint": "192.0.2.240:9444",
      "caFingerprint": "7D:9F:05:39:12:F6:D4:91:0A:1B:2C:3D:4E:5F:60:71:82:93:A4:B5:C6:D7:E8:F9:0A:1B:2C:3D:4E:5F:60:71",
      "state": "live"
    }
  ]
}

403

Section titled “403”

Authenticated but not authorized.

Media typeapplication/problem+json
object
type
required
string format: uri
title
required
string
status
required
integer
>= 400 <= 599
detail
string
instance
string format: uri-reference
requestId
required
string
code
required
string
issues

The findings of a rejected IAM policy document (custom and resource policies).

Array<object>

One finding of a rejected IAM policy document. A rejection lists every finding, so the author fixes the document in one round trip.

object
code
required

The finding, e.g. INVALID_DOCUMENT, UNKNOWN_ACTION, ACTION_NOT_APPLICABLE.

string
statement
required

Index of the statement at fault; -1 for the document as a whole.

integer
>= -1
detail
required
string
action

The offending action, where one is at fault (ACTION_NOT_APPLICABLE).

string
errors

Field errors, for codes that carry them: each problem at its field (see FieldError). Documented on the responses that set it, e.g. approveNodeJoin’s INVALID_INPUT and JOIN_APPROVAL_REFUSED. Absent otherwise.

Array<object>

One field’s problem, the stage-2 installer API’s shape. field is the field’s path, message what is wrong with it.

object
field
required

The field’s path, e.g. links[0].interface, disks[1].confirm, mgmt.address or role; empty for the whole request.

string
message
required
string
details

Structured facts about the refusal, for codes that carry them. The shape is fixed per code and documented on the response that answers it, e.g. IMAGE_POOL_MISMATCH (see ImagePoolMismatchDetails) and IMAGE_IN_USE. Absent for codes that carry none.

object
key
additional properties
any

Example 

{
  "issues": [
    {
      "code": "ACTION_NOT_APPLICABLE",
      "action": "compute:CreateVpc"
    }
  ]
}