Bind a session to a device key

POST

/provision/databases/{id}/passwordless/{sessionId}/bind

prorm klock upgrade: the owner's call, carrying the holder's new
public keys and the seal binding that proves the holder has the
signing key. A service session (kind service, holding only
passwordless:use) is opened for the key, and from then on the
session takes device-signed requests — beside its v1 secret
(v1+v2, the default) or instead of it (v2).

Binding again with the same key answers the service session with a
fresh grant (200) and may tighten to v2; another key is refused
(already_bound). A database holds a limited number of bound
sessions (session_limit).

Checked in the controller, in every mode: an account session holding
access:write.

Capability: access:write (area resource, on the database).

Request

Path Params

Body Params application/jsonRequired

Examples

Responses

🟢200

application/json

Already bound to this key; its grant, fresh (rebound is true, and there is no keyset)

Bodyapplication/json

🟢201

🟠400

🟠403

🟠404

🟠409

🔴502

🟠401KlockUnauthorized

🔴503KlockUnavailable

Request Example

Shell

JavaScript

Java

Swift

curl --location 'https://api.prod-orm.io/provision/databases//passwordless//bind' \
--header 'Content-Type: application/json' \
--data '{
    "devicePub": "string",
    "signPub": "string",
    "thumbprint": "string",
    "sealPub": "string",
    "sealBinding": "string",
    "hostname": "string",
    "platform": "string",
    "label": "string",
    "rotateBy": 0,
    "rotateEverySec": 3600,
    "protocol": "v1+v2"
}'

Response Example

200 - Example 1

{
    "id": 0,
    "sessionId": "ks_…",
    "kind": "service",
    "grant": "string",
    "grantSeq": 0,
    "deviceId": "string",
    "deviceCert": "string",
    "keyset": {},
    "keysetSeq": 0,
    "tier": "string",
    "caps": [
        "string"
    ],
    "limits": {},
    "checkInBy": 0,
    "exp": 0,
    "resource": {
        "kind": "database",
        "id": "string"
    },
    "rotateBy": "2019-08-24T14:15:22.123Z",
    "rebound": true,
    "passwordless": {
        "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
        "protocol": "v1+v2"
    }
}

Modified at 2026-10-05 14:01:12

Revoke a passwordless session

Issue a v2 session for a host to bind