Redeem Device Enrollment

Redeem an enrollment token, registering this machine as the bot's device. Registering the public key and consuming the token are atomic: the token is spent by a conditional UPDATE that exactly one concurrent caller can win, and the device row is written in the same transaction, so a token is never consumed without producing the device it paid for. No session, assertion or SVID is issued here. The device credential buys only the right to *ask* for one, on every future connection, against a registry that can deny it immediately. *** THERE IS EXACTLY ONE WAY TO LEAVE HERE WITHOUT A DEVICE ROW, AND IT IS AN ERROR. *** A 2xx from this endpoint means the registry holds a live, active device for the caller — either written by this call (``201``, ``newly_enrolled``) or read back within it (``200``, the machine already being that device and offering its key). The caller may therefore treat "this call succeeded" as "a device exists server-side", which is the property an installer needs and the one it cannot establish for itself.

curl -X POST "https://example.com/v1/public/device-enrollment/redeem" \  -H "Content-Type: application/json" \  -d '{    "token": "string",    "public_key": "string",    "custody_tier": "hardware"  }'

{
  "device_id": "string",
  "bot_id": "string",
  "newly_enrolled": true
}

{
  "type": "string",
  "title": "string",
  "status": 0,
  "detail": "string",
  "instance": "string",
  "error_code": "string",
  "errors": [
    {
      "pointer": "string",
      "detail": "string",
      "type": "string"
    }
  ],
  "trace_id": "string"
}