Cotal
DocsAPI Reference

Activate a managed lifecycle

POST
/managed-lifecycle/activate

Activate the exact host-issued lifecycle UID. accountPublicKey must name this authority or the request returns 403 before mutation. Native already-exists is 409. Native refusals preserve code, outcome and optional details. An unexpected failure returns 500 with outcome unknown.

Authorization

HostCapability
headerAuthorizationBearer <token>

Exact exchange capability from the owner-private auth-service discovery record. This is not an IdP JWT or actor bearer.

Request Body

application/json
  1. body
accountPublicKey*string

Assigned account authority public key.

owner*string
Match^u_[a-z2-7]{26}$
actor*string
Match^[A-Za-z0-9_]+$
Length1 <= length
lifecycleUid*string
Match^[a-z0-9]{26,32}$

Response Body

The host decision completed.

application/json
  1. response
accountPublicKey*string

Assigned account authority public key.

owner*string
Match^u_[a-z2-7]{26}$
actor*string
Match^[A-Za-z0-9_]+$
Length1 <= length
lifecycleUid*string
Match^[a-z0-9]{26,32}$
activated*unknown
Example Request
curl -X POST 'http://127.0.0.1:12345/managed-lifecycle/activate' \  -H 'Content-Type: application/json' \  -d '{  "accountPublicKey": "string",  "owner": "string",  "actor": "string",  "lifecycleUid": "string"}'
Example Response
{  "accountPublicKey": "string",  "owner": "string",  "actor": "string",  "lifecycleUid": "string",  "activated": true}

See the HTTP interface overview for authentication and access requirements.

Complete HTTP contract

Endpoint

POST /managed-lifecycle/activate

Activate the exact host-issued lifecycle UID. accountPublicKey must name this authority or the request returns 403 before mutation. Native already-exists is 409. Native refusals preserve code, outcome and optional details. An unexpected failure returns 500 with outcome unknown.

Parameters

No operation parameters.

Request body

The request uses the schema below.

Required: yes.

Content type: application/json.

{
  "$ref": "#/components/schemas/Activation"
}

Responses

HTTP 200

The host decision completed.

Content type: application/json.

{
  "$ref": "#/components/schemas/Activated"
}

HTTP 400

Malformed JSON or invalid request fields.

Content type: application/json.

{
  "$ref": "#/components/schemas/Error"
}

HTTP 401

Missing or invalid loopback capability.

Content type: application/json.

{
  "$ref": "#/components/schemas/Error"
}

HTTP 403

An Origin header or failed authority/proof check is refused.

Content type: application/json.

{
  "$ref": "#/components/schemas/Error"
}

HTTP 405

Only POST is accepted.

Content type: application/json.

{
  "$ref": "#/components/schemas/Error"
}

HTTP 409

The lifecycle already exists or a native conflict was refused.

Content type: application/json.

{
  "$ref": "#/components/schemas/Error"
}

HTTP 413

Request exceeds the 65536-byte body limit.

Content type: application/json.

{
  "$ref": "#/components/schemas/Error"
}

HTTP 415

Content-Type must be application/json.

Content type: application/json.

{
  "$ref": "#/components/schemas/Error"
}

HTTP 429

Invalid-capability attempts exceeded the rolling-minute limit.

Content type: application/json.

{
  "$ref": "#/components/schemas/Error"
}

HTTP 500

Unexpected activation failure; outcome is unknown.

Content type: application/json.

{
  "$ref": "#/components/schemas/Error"
}

HTTP default

Native authority refusal classified by its error code.

Content type: application/json.

{
  "$ref": "#/components/schemas/Error"
}

Authentication and access: Host-only HTTP operations of the stock auth service. These six routes exist only on the loopback listener and return 404 on the public listener. The owner-private auth-service discovery record supplies its port and exchange capability. Every operation requires the exact Authorization bearer capability, application/json and no Origin header. Requests match the exact target, so query strings and trailing slashes return 404. Bodies default to 65536 bytes. More than 30 invalid capability attempts in a rolling minute receive 429.

The loopback listener also serves /health, /jwks, /exchange, /manager-service-authority, /manager-instances, /service-endpoint-authority, /service-endpoint-host and /chat-session/open, /chat-session/bearer, /chat-session/retire. Their public request and response shapes are in the Auth HTTP API. Proof operations additionally require the loopback capability. The loopback /health handler also accepts other methods. Elevated exchange views and operator host operations are loopback-only. Mesh discovery is public-listener-only. This implementation reference does not establish a stable cloud API.

OpenAPI specification contains the referenced response schemas. Complete Markdown reference.

Retire interactive POST

Retire an interactive lifecycle

Retire managed POST

Retire a managed lifecycle