Redeem an enrolment ticket on the host

POST

/provision/databases/{id}/passwordless/redeem

prorm klock init --service. No account session: the ticket from
POST …/passwordless/enrol is the owner's approval, and the seal
binding proves the host holds the key it binds. The ticket is spent
only by a request that could bind. The account that issued it must
still reach the database with access:write.

Answers the service session: its grant, device id and certificate.

Capability: none from the table; the credential is its own (see above). A single-use enrolment ticket (and the device key it binds).

Request

Path Params

Body Params application/jsonRequired

Examples

Responses

🟢201

application/json

Bound

Bodyapplication/json

🟠400

🟠401

🟠403

🟠404

🟠409

🔴502

🔴503KlockUnavailable

Request Example

Shell

JavaScript

Java

Swift

curl --location 'https://api.prod-orm.io/provision/databases//passwordless/redeem' \
--header 'Content-Type: application/json' \
--data '{
    "devicePub": "string",
    "signPub": "string",
    "thumbprint": "string",
    "sealPub": "string",
    "sealBinding": "string",
    "hostname": "string",
    "platform": "string",
    "label": "string",
    "rotateBy": 0,
    "rotateEverySec": 3600,
    "ticket": "string"
}'

Response Example

201 - Example 1

{
    "id": 0,
    "sessionId": "ks_…",
    "kind": "service",
    "grant": "string",
    "grantSeq": 0,
    "deviceId": "string",
    "deviceCert": "string",
    "keyset": {},
    "keysetSeq": 0,
    "tier": "string",
    "caps": [
        "string"
    ],
    "limits": {},
    "checkInBy": 0,
    "exp": 0,
    "resource": {
        "kind": "database",
        "id": "string"
    },
    "rotateBy": "2019-08-24T14:15:22.123Z",
    "passwordless": {
        "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
        "role": "string",
        "entId": "string",
        "scope": {
            "ops": [
                "read"
            ],
            "tables": [
                "string"
            ],
            "columns": {
                "property1": [
                    "string"
                ],
                "property2": [
                    "string"
                ]
            }
        },
        "label": "string",
        "auth": "secret",
        "principal": "string",
        "tlsFingerprint": "string",
        "poolId": 0,
        "lastUsedAt": "2019-08-24T14:15:22.123Z",
        "expiresAt": "2019-08-24T14:15:22.123Z",
        "revokedAt": "2019-08-24T14:15:22.123Z",
        "createdAt": "2019-08-24T14:15:22.123Z",
        "protocol": "v2",
        "bound": true
    },
    "databaseId": 0,
    "database": "df8eac19-d158-497f-ac84-447e3d8cf906",
    "role": "string"
}

Modified at 2026-10-05 14:01:12

Issue a v2 session for a host to bind

Check a passwordless credential