Initialize the first administrator.

POST

/api/admin-init-setup/initialize

Code sample: Shell / cURL

curl --request POST \
  --url https://auth.example.com/api/admin-init-setup/initialize \
  --header 'Content-Type: application/json' \
  --data '{ "setup_token": "setup_123", "email": "[email protected]", "name": "Admin User", "csrf_token": "csrf_123" }'

Validates the one-time setup token and CSRF token, creates the initial administrator, assigns the system admin role, and returns a temporary setup session plus Admin UI setup token.

Request Body ^required

Media type application/json

object

setup_token

required

string

email

required

string format: email

name

string

csrf_token

required

string

Example

{
  "setup_token": "setup_123",
  "email": "[email protected]",
  "name": "Admin User",
  "csrf_token": "csrf_123"
}

Responses

200

Successful JSON response.

Media type application/json

object

success

required

boolean

user_id

required

string

temp_session_token

required

string

setup_token

required

string

admin_ui_url

Any of:

string

string format: uri

null

null

admin_ui_setup_url

Any of:

string

string format: uri

null

null

Example

{
  "success": true,
  "user_id": "admin_123",
  "temp_session_token": "temp_sess_123",
  "setup_token": "admin_setup_token_123",
  "admin_ui_url": "https://admin.example.com",
  "admin_ui_setup_url": "https://admin.example.com/setup/complete?token=admin_setup_token_123"
}

400

Error response.

Media type application/json

object

error

string

error_description

string

message

string

webauthn_signal

Optional browser-side WebAuthn Signal API hint. When unknown_credential is true, clients that just received a WebAuthn credential assertion may call PublicKeyCredential.signalUnknownCredential() for that credential ID.

object

unknown_credential

boolean

key

additional properties

Example ^generated

{
  "error": "example",
  "error_description": "example",
  "message": "example",
  "webauthn_signal": {
    "unknown_credential": true
  }
}

401

Error response.

Media type application/json

object

error

string

error_description

string

message

string

webauthn_signal

Optional browser-side WebAuthn Signal API hint. When unknown_credential is true, clients that just received a WebAuthn credential assertion may call PublicKeyCredential.signalUnknownCredential() for that credential ID.

object

unknown_credential

boolean

key

additional properties

Example ^generated

{
  "error": "example",
  "error_description": "example",
  "message": "example",
  "webauthn_signal": {
    "unknown_credential": true
  }
}

403

Error response.

Media type application/json

object

error

string

error_description

string

message

string

webauthn_signal

Optional browser-side WebAuthn Signal API hint. When unknown_credential is true, clients that just received a WebAuthn credential assertion may call PublicKeyCredential.signalUnknownCredential() for that credential ID.

object

unknown_credential

boolean

key

additional properties

Example ^generated

{
  "error": "example",
  "error_description": "example",
  "message": "example",
  "webauthn_signal": {
    "unknown_credential": true
  }
}