Report a component failure (unenrolled device)

post

https://api.portal.saymine.com/logs/unverified

The D270 token-authenticated mint for a device that holds NO certificate yet — the pre-enrollment
failure-reporting channel (bootstrap/updater/scanner beacons). Anonymous like /enroll: the
enrollmentToken in the body is the credential, and every token failure collapses to one
indistinguishable 401 (the structured outcome is logged server-side by the validator, never
revealed). The minted URL targets the quarantined logs/<tenant>/_unverified/<logId>
key — claimed identity fields (claimedDeviceId/claimedHostname) ride the ops log line
as CLAIMS and are never joined to device rows. Bounds (Q386): the smaller
UnverifiedMaxLogSizeBytes 413 cap, the shared per-tenant rate 429, and the per-tenant daily
unverified cap 429 (the per-device quota keyed on the pseudo-device). Refusal WARNs are gated to
first-per-tenant-per-hour so a flood cannot write its own log storm.

Recent Requests

Time	Status	User Agent
Retrieving recent requests…

Loading…

Body Params

Request body for POST /logs/unverified (D270, strict — unknown fields → 400 like the cert path).
The enrollmentToken is the credential (never logged, never persisted); source widens to the
three shipped components; the remaining fields are the bounded claims the ops log line carries so the
backend never has to open the bundle to answer "what failed where".

logId

string | null

The run-scoped log id, format YYYYMMDDTHHMMSSZ-<uuid> (≤53); the idempotency key and the object-key tail.

sizeBytes

int64 | null

The declared compressed byte size of the bundle to PUT. Required, integer ≥0; over the (smaller) unverified cap → 413.

source

string | null

The reporting component: "bootstrap", "updater", or "scanner".

enrollmentToken

string | null

The fleet enrollment token ({tokenId}.{secret}) — the credential establishing the tenant.

outcome

string | null

The component's structured failure outcome (its own vocabulary, e.g. verify-failed). Required.

stage

string | null

Optional failure stage within the outcome (e.g. signature, hash-pin).

osArch

string | null

Optional platform/arch descriptor (e.g. darwin-arm64).

componentVersion

string | null

Optional reporting component's version (e.g. 1.3.0).

claimedDeviceId

string | null

Optional CLAIMED device id (the scanner derives one pre-enrollment; bootstrap/updater have none). Unproven — never joined to device rows.

claimedHostname

string | null

Optional CLAIMED hostname (the device-context PII posture). Unproven — an ops correlation aid only.

Headers

content-type

string

enum

Defaults to application/json-patch+json

Generated from available request content types

Allowed:

Response

200

Success

Language

Credentials

Header

URL

Loading…

Response

Click Try It! to start a request and see the response here!