# Exchange Device Assertion

> Exchange a signed device assertion for a short-lived runtime session.

Canonical URL: https://docs.botyard.io/docs/api/device-enrollment/exchange_device_assertion_v1_public_device_assertion_exchange_post

`POST /v1/public/device-assertion/exchange`

Exchange a signed device assertion for a short-lived runtime session.

The device registry is read live on every call and a device that is not
active is refused here, before its signature is even examined. There is no
cache, no TTL and no memoised lookup between that row and this decision,
and there must never be one: it is the only reason a credential that never
expires can still be revoked.

## Request body

`application/json`: DeviceAssertionExchangeRequest (required)

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `assertion` | string | yes | A compact JWS (private_key_jwt shape), alg ES256, signed by the device's long-lived P-256 private key. 'kid' is the device id; 'aud' is 'botyard:device-assertion'; 'exp' - 'iat' may not exceed 120 seconds, and the 'jti' may be exchanged exactly once |

## Responses

| Status | Description | Body |
| --- | --- | --- |
| `201` | Successful Response | DeviceAssertionExchangeResponse |
| `default` | RFC 9457 Problem Details error response | ProblemDetails |

Full schemas: operation `exchange_device_assertion_v1_public_device_assertion_exchange_post` in the OpenAPI spec at https://api.botyard.io/openapi.json.