> ## Documentation Index > Fetch the complete documentation index at: https://docs.checkfu.com/llms.txt > Use this file to discover all available pages before exploring further. # Create a BootstrapRequest > Open one agent-native onboarding attempt (Plan 901). Takes the pinned Starter identity, the CLI's client challenge and ephemeral encryption public key, and a safe project fingerprint; returns the bootstrap id, activation URI, short user code, and the once-issued poll token. The user code and poll token exist exactly once — the create response is their only delivery, and the stored record carries digests only. This route serves the deliberately narrow pre-authentication CLI audience and is rollout-fenced: the deployment's BOOTSTRAP_REQUESTS_SURFACE fence must be enabled or the request is denied. Checkfu support posture: preview; rollout_fenced. No release evidence journey applies to this operation. ## OpenAPI ````yaml /openapi.json post /v1/bootstrap-requests openapi: 3.1.0 info: title: Checkfu API version: '2026-08-31' description: >- Authentication is declared per operation: API-key, runtime, or connector bearer; Automation signature; or credential-free pairing redemption. Every general Checkfu REST request requires the dated `Checkfu-Version` header (one of: 2026-08-31); the three MCP JSON-RPC transports use `MCP-Protocol-Version`, A2A uses `A2A-Version`, and the provider OAuth callback carries neither Checkfu header. API keys resolve one Workspace without a request selector; authenticated responses identify it with `Checkfu-Workspace-Id`. servers: - url: https://api.checkfu.com security: - bearerAuth: [] tags: - name: organizations - name: sourceRepositories - name: tenants - name: workspaces - name: principals - name: principalGroups - name: principalAccessCredentials - name: apiKeys - name: agents - name: harnesses - name: harnessRuntime - name: computerProfiles - name: permissionAssignments - name: actionPolicies - name: files - name: memoryStores - name: dreams - name: modelCredentials - name: modelRoutingProfiles - name: blueprintInstallations - name: toolSources - name: skills - name: skillSources - name: agentSources - name: skillProposals - name: instructionProposals - name: catalog - name: concepts - name: support - name: bootstrapRequests - name: connections - name: connectionVaults - name: connectionAssignments - name: connectedRuntimes - name: fileTrees - name: collaboration - name: automationGraphs - name: automations - name: actionApprovals - name: standingApprovals - name: usage - name: models - name: outcomes - name: budgets - name: billing - name: sessions - name: audit - name: sessionExports - name: runs - name: runnerPools - name: transcripts - name: sessionWatches - name: sessionHandoffs - name: sessionCapsules - name: sessionTrajectories - name: webhookEndpoints - name: integrationGateway - name: workEnvironments - name: computers - name: computerScreens - name: computerBrowserObservations - name: computerBrowserActions - name: environments - name: vaults - name: apiMcp - name: a2a paths: /v1/bootstrap-requests: post: tags: - bootstrapRequests summary: Create a BootstrapRequest description: >- Open one agent-native onboarding attempt (Plan 901). Takes the pinned Starter identity, the CLI's client challenge and ephemeral encryption public key, and a safe project fingerprint; returns the bootstrap id, activation URI, short user code, and the once-issued poll token. The user code and poll token exist exactly once — the create response is their only delivery, and the stored record carries digests only. This route serves the deliberately narrow pre-authentication CLI audience and is rollout-fenced: the deployment's BOOTSTRAP_REQUESTS_SURFACE fence must be enabled or the request is denied. Checkfu support posture: preview; rollout_fenced. No release evidence journey applies to this operation. operationId: bootstrapRequests.createBootstrapRequest parameters: - name: checkfu-version in: header schema: type: string enum: - '2026-08-31' required: true requestBody: content: application/json: schema: type: object properties: starter: type: object properties: starter_id: type: string allOf: - minLength: 3 - maxLength: 96 - pattern: ^[a-z][a-z0-9-]{0,31}\/[a-z][a-z0-9-]{0,63}$ starter_version: type: string allOf: - pattern: ^\d+\.\d+\.\d+$ starter_digest: type: string allOf: - pattern: ^sha256:[0-9a-f]{64}$ required: - starter_id - starter_version - starter_digest additionalProperties: false cli_version: type: string allOf: - pattern: ^\d+\.\d+\.\d+$ - maxLength: 32 client_challenge: type: string allOf: - pattern: ^sha256:[0-9a-f]{64}$ client_encryption_public_key: type: string allOf: - pattern: ^[A-Za-z0-9_-]{43}$ safe_project_fingerprint: $ref: '#/components/schemas/BootstrapSafeProjectFingerprint' requested_capability_ids: $ref: '#/components/schemas/BootstrapRequestedCapabilityIds' requested_connection_requirements: type: array items: type: object properties: logical_name: type: string allOf: - pattern: ^[a-z][a-z0-9_]{0,63}$ offering: type: string allOf: - pattern: ^[a-z][a-z0-9-]{0,31}$ required: - logical_name - offering additionalProperties: false allOf: - maxItems: 8 required: - starter - cli_version - client_challenge - client_encryption_public_key - safe_project_fingerprint - requested_capability_ids - requested_connection_requirements additionalProperties: false required: true responses: '201': description: Success content: application/json: schema: type: object properties: bootstrap_id: $ref: '#/components/schemas/BootstrapRequestId' verification_uri: type: string allOf: - pattern: ^https:\/\/[a-z0-9.-]+\/activate$ verification_uri_complete: type: string allOf: - minLength: 24 - maxLength: 512 user_code: type: string allOf: - pattern: ^[A-Z2-9]{4}-[A-Z2-9]{4}$ poll_token: type: string allOf: - minLength: 32 - maxLength: 128 - pattern: ^[A-Za-z0-9_-]+$ expires_at: $ref: '#/components/schemas/CurrentTimestamp' poll_interval_seconds: type: integer allOf: - minimum: 1 - maximum: 60 required: - bootstrap_id - verification_uri - verification_uri_complete - user_code - poll_token - expires_at - poll_interval_seconds additionalProperties: false headers: checkfu-workspace-id: description: The Workspace resolved from the authenticated bearer credential. required: true schema: $ref: '#/components/schemas/WorkspaceId' '400': description: Typed Checkfu wire error content: application/json: schema: $ref: '#/components/schemas/ValidationMalformedError' '401': description: Typed Checkfu wire error content: application/json: schema: type: object required: - error properties: error: type: object required: - type - message - more properties: type: type: string enum: - auth.invalid_key message: type: string more: type: string enum: - >- https://docs.checkfu.com/reference/errors#auth-invalid-key description: >- Stable public documentation and remedy for this error type. additionalProperties: false additionalProperties: false '403': description: >- The organization, tenant, or workspace backing this key is administratively disabled. | Deployment governance or retention policy denied the request. content: application/json: schema: anyOf: - type: object required: - error properties: error: type: object properties: type: type: string enum: - auth.disabled_tenancy message: type: string more: type: string enum: - >- https://docs.checkfu.com/reference/errors#auth-disabled-tenancy description: >- Stable public documentation and remedy for this error type. required: - type - message - more additionalProperties: false additionalProperties: false - $ref: '#/components/schemas/PolicyDeniedError' '429': description: Typed Checkfu wire error headers: retry-after: description: >- Delay in seconds for rate limits or deployment quotas with a known release or UTC reset boundary required: false schema: type: integer minimum: 1 content: application/json: schema: type: object required: - error properties: error: type: object required: - type - message - more properties: type: type: string enum: - budget.exceeded message: type: string more: type: string enum: - >- https://docs.checkfu.com/reference/errors#budget-exceeded description: >- Stable public documentation and remedy for this error type. additionalProperties: false additionalProperties: false '500': description: >- An unexpected internal failure occurred; the message contains an opaque incident reference. content: application/json: schema: $ref: '#/components/schemas/RuntimeInternalError' security: - bearerAuth: [] components: schemas: BootstrapSafeProjectFingerprint: type: string allOf: - minLength: 8 - maxLength: 128 - pattern: ^[a-z0-9][a-z0-9._-]{7,127}$ BootstrapRequestedCapabilityIds: type: array items: type: string allOf: - minLength: 1 - maxLength: 64 - pattern: ^[a-z][a-z0-9_-]{0,63}$ allOf: - maxItems: 16 BootstrapRequestId: type: string allOf: - pattern: ^bst_[0-9a-f]{32}$ CurrentTimestamp: type: string allOf: - maxLength: 24 - pattern: ^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$ description: A canonical UTC ISO-8601 timestamp with millisecond precision. WorkspaceId: type: string allOf: - pattern: ^wrkspc_[0-9a-f]{32}$ ValidationMalformedError: type: object properties: error: type: object properties: type: type: string enum: - validation.malformed message: type: string more: type: string enum: - https://docs.checkfu.com/reference/errors#validation-malformed description: Stable public documentation and remedy for this error type. required: - type - message - more additionalProperties: false required: - error additionalProperties: false description: >- The request could not be decoded or violated a declared input constraint. PolicyDeniedError: type: object properties: error: type: object properties: type: type: string enum: - policy.denied message: type: string more: type: string enum: - https://docs.checkfu.com/reference/errors#policy-denied description: Stable public documentation and remedy for this error type. required: - type - message - more additionalProperties: false required: - error additionalProperties: false description: Deployment governance or retention policy denied the request. RuntimeInternalError: type: object properties: error: type: object properties: type: type: string enum: - runtime.internal message: type: string more: type: string enum: - https://docs.checkfu.com/reference/errors#runtime-internal description: Stable public documentation and remedy for this error type. required: - type - message - more additionalProperties: false required: - error additionalProperties: false description: >- An unexpected internal failure occurred; the message contains an opaque incident reference. securitySchemes: bearerAuth: type: http scheme: bearer ````