Complete human-user enrollment

Exchanges a one-time enrollment credential for the human's initial self-owned API key. This endpoint does not use ordinary API-key authentication. Omit both optional key fields for server generation; a fresh response discloses the raw key exactly once and cannot be safely retried after an ambiguous outcome. Supply and retain both fields for client mode, where only an exact tuple retry is safe and raw material is never echoed. Status precedence is request-shape errors (400), then the same generic authentication failure for every nonblank unusable enrollment (401); key conflicts or concurrent lifecycle winners return 409, rate limits return 429, and unexpected failures return 500.

Request Body

enrollmentTokenstring

Required one-time enrollment credential. Never log or persist it.

Example"gme_mzxw6ytboiww6z3foj2xezltoqxxezltoqxxezltoqxxezltoqxa"

Match^gme_[a-z2-7]{52}$

Length56 <= length <= 56

apiKeyId?string | null

Optional client-generated API-key UUID retained for exact retries. Must be supplied together with rawApiKey, or both fields must be omitted.

Example"550e8400-e29b-41d4-a716-446655440000"

Formatuuid

rawApiKey?string | null

Optional canonical client-generated API key. Must be supplied together with apiKeyId, never logged, and retained for exact retries; omit both fields for server generation.

Example"gm_mzxw6ytboiww6z3foj2xezltoq"

Match^gm_[a-z2-7]{26}$

Length29 <= length <= 29

Response Body

curl -X POST "https://loading/v1/user-enrollments:complete" \
  -H "Content-Type: application/json" \
  -d '{
    "enrollmentToken": "gme_mzxw6ytboiww6z3foj2xezltoqxxezltoqxxezltoqxxezltoqxa",
    "apiKeyId": "550e8400-e29b-41d4-a716-446655440000",
    "rawApiKey": "gm_mzxw6ytboiww6z3foj2xezltoq"
  }'

curl -X POST "https://loading/v1/user-enrollments:complete" \  -H "Content-Type: application/json" \  -d '{    "enrollmentToken": "gme_mzxw6ytboiww6z3foj2xezltoqxxezltoqxxezltoqxxezltoqxa",    "apiKeyId": "550e8400-e29b-41d4-a716-446655440000",    "rawApiKey": "gm_mzxw6ytboiww6z3foj2xezltoq"  }'

{
  "apiKey": {
    "apiKeyId": "550e8400-e29b-41d4-a716-446655440000",
    "subjectPrincipalId": "70e025f6-76ca-4cbe-b8fc-7dab8e84590a",
    "ownerPrincipalId": "b3303d0a-1a4a-493f-b9bf-38e37153b5a2",
    "authorityMode": "INHERIT_SUBJECT",
    "ceiling": [
      {
        "assignedResource": {
          "resourceId": "550e8400-e29b-41d4-a716-446655440000"
        }
      }
    ],
    "ceilingOmitted": true,
    "keyPrefix": "gm_12345...",
    "status": "ACTIVE",
    "lifecycleState": "NOT_YET_VALID",
    "labels": {
      "purpose": "production",
      "service": "recommendation-engine"
    },
    "expiresAt": 1672531200000,
    "validFrom": 1640908800000,
    "revokedAt": 1640995200000,
    "revokedById": "b3303d0a-1a4a-493f-b9bf-38e37153b5a2",
    "lastUsedAt": 1640995200000,
    "createdAt": 1640908800000,
    "updatedAt": 1640908800000,
    "createdById": "b3303d0a-1a4a-493f-b9bf-38e37153b5a2",
    "updatedById": "b3303d0a-1a4a-493f-b9bf-38e37153b5a2"
  },
  "alreadyCompleted": true,
  "rawApiKey": "gm_mzxw6ytboiww6z3foj2xezltoq"
}

Empty