Open a device-bound klock session

Opens a klock v2 session bound to a device key, and hands back its
first grant and the device certificate. From the console (a browser
session) during prorm login — with the state and confirmCode the
terminal printed, both required there — or from an existing klock
session. A legacy CLI token (console_only) or an assumed identity
(assumed_identity) cannot open one.

kind: interactive (the default) — a signed-in CLI.

kind: device — a trusted machine, a lasting credential: needs a
fresh step-up, either already on the caller's session or given here
as stepUp: { totp } (or { password } from a browser on an account
without a second factor).

kind: service — a session standing for one resource: a database
(resource: { kind: database, id }, with role and scope, which
creates a v2 passwordless session; needs access:write on it) or a
local transfer job (resource: { kind: transfer-job, id }; needs
resource:operate). Needs sealPub and sealBinding. Never admin.

One live session per device key and kind: signing in again replaces
it. Past the kind's concurrent limit the least recently seen is
evicted, or — for kinds that refuse — 409 session_limit lists them.
When the klock service is bound it registers the device, and then
sealPub and sealBinding are required for every kind.

curl --location 'https://api.prod-orm.io/security/klock/sessions' \ --header 'Content-Type: application/json' \ --data '{ "kind": "interactive", "devicePub": "string", "sealPub": "string", "sealBinding": "string", "hostname": "string", "platform": "string", "label": "string", "teamUuid": "string", "state": "string", "confirmCode": "string", "stepUp": { "totp": "string", "password": "pa$$word" }, "resource": { "kind": "database", "id": 0 }, "thumbprint": "string", "signPub": "string", "role": "string", "scope": { "ops": [ "read" ], "tables": [ "string" ] }, "entId": "string", "expiresAt": "2019-08-24T14:15:22.123Z", "rotateBy": 0, "rotateEverySec": 3600, "compat": "v1" }'

{ "id": 0, "sessionId": "ks_4f9c0d8e-2a61-4b1f-9c3d-7e5a2b1c0d9e", "kind": "interactive", "grant": "string", "grantSeq": 0, "deviceId": "string", "deviceCert": "string", "keyset": "string", "keysetSeq": 0, "tier": "string", "caps": [ "string" ], "dormant": [ "string" ], "limits": {}, "checkInBy": 0, "exp": 0, "expiresAt": "2019-08-24T14:15:22.123Z", "resource": {}, "rotateBy": "2019-08-24T14:15:22.123Z", "passwordless": {}, "job": {}, "secret": "string", "secretSeenOnce": true }

Open a device-bound klock session

Request

Responses