> For the complete documentation index, see [llms.txt](https://docs.otari.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.otari.ai/api-reference/bootstrap.md). # Bootstrap ## Get Bootstrap > Return the deployment context the dashboard shell renders from.\ > \ > Public: the shell fetches this before it knows whether it can authenticate.\ > That is also why \`\`sign\_in\_methods\`\` is answered here rather than behind a\ > credential, and it publishes nothing an unauthenticated caller could not\ > already learn by trying both credentials against the sign-in endpoint.\ > \ > The database read is two primary-key lookups: the \`\`tenancy\_bootstrap\_user\_id\`\`\ > marker, and the identity it names, to answer whether \*that\* identity holds a\ > password (#702). ```json {"openapi":"3.1.0","info":{"title":"otari","version":"0.33.0"},"paths":{"/api/v1/bootstrap":{"get":{"description":"Return the deployment context the dashboard shell renders from.\n\nPublic: the shell fetches this before it knows whether it can authenticate.\nThat is also why ``sign_in_methods`` is answered here rather than behind a\ncredential, and it publishes nothing an unauthenticated caller could not\nalready learn by trying both credentials against the sign-in endpoint.\n\nThe database read is two primary-key lookups: the ``tenancy_bootstrap_user_id``\nmarker, and the identity it names, to answer whether *that* identity holds a\npassword (#702).","operationId":"bootstrap-get_bootstrap","responses":{"200":{"content":{"application/json":{"schema":{"$ref":"#/components/schemas/DeploymentBootstrap"}}},"description":"Successful Response"}},"summary":"Get Bootstrap","tags":["bootstrap"]}}},"components":{"schemas":{"DeploymentBootstrap":{"description":"What the dashboard shell needs before it can render anything.","properties":{"docs_url":{"anyOf":[{"type":"string"},{"type":"null"}],"description":"Where this deployment's documentation lives, when it is not docs.otari.ai. Set, the dashboard's Documentation links open it in a new tab; null, they open https://docs.otari.ai/. A link target an operator configured, validated at startup as an absolute http(s) URL carrying no credential, since this response is unauthenticated.","title":"Docs Url"},"federation_member_rules":{"description":"Whether an organization's owners and admins may give their own API keys federation rules (the federation_member_rules setting), so the dashboard offers workload identity on their keys.","title":"Federation Member Rules","type":"boolean"},"feedback_enabled":{"description":"Whether this deployment accepts deliberate feedback submissions.","title":"Feedback Enabled","type":"boolean"},"mail_ready":{"description":"Whether this deployment can deliver a message carrying a link back to itself (an invitation's accept link, and the verification and reset links to come), not merely whether a transport is configured: it also needs to know its own public URL to put in one. Lets the dashboard disable or hide a mail-dependent affordance instead of offering one that would fail at send time. Every message this deployment sends carries such a link, which is why this is one flag and not one per feature.","title":"Mail Ready","type":"boolean"},"maintenance_mode":{"description":"Whether this deployment is refusing new dashboard sign-ins while an operator redeploys it. The sign-in screen says so rather than presenting a form whose only outcome is a 503. Sessions already issued keep working, and the API is unaffected.","title":"Maintenance Mode","type":"boolean"},"oauth_providers":{"description":"OAuth providers this deployment can sign somebody in with, sorted, one entry per provider with a client ID, a client secret and a public_base_url to build a redirect URI from. The sign-in screen renders a button per entry and none at all when the list is empty, so a provider nobody configured is absent rather than offered and then refused. Additive to sign_in_methods rather than part of it: an OAuth sign-in coexists with whichever typed credential is current, the way a passkey does.","items":{"type":"string"},"title":"Oauth Providers","type":"array"},"open_signup":{"description":"Whether POST /api/v1/auth/signup creates an account for an address nobody has added yet, each with an organization of its own, or only lets an address an admin already put on the roster set its password. The signup page reads as registration or as claiming an invitation accordingly, and the sign-in screen links to it with the wording that matches.","title":"Open Signup","type":"boolean"},"passkeys_enabled":{"description":"Whether this deployment offers passkeys at all (the passkeys_enabled setting). False means the passkey routes are not mounted and the dashboard hides its passkey page, which is a different answer from passkeys_ready: a deployment that merely has not configured a relying party is ready for nobody yet but still shows the page that says so.","title":"Passkeys Enabled","type":"boolean"},"passkeys_ready":{"description":"Whether this deployment can run a passkey ceremony at all: it has a relying-party ID (webauthn_rp_id, or derived from public_base_url) and an origin to serve one from. Distinct from 'passkey' in sign_in_methods, which is narrower and answers whether a registered passkey could sign somebody in *right now*: an operator with none yet needs this one, or the page that registers the first would be hidden from them.","title":"Passkeys Ready","type":"boolean"},"privacy_url":{"anyOf":[{"type":"string"},{"type":"null"}],"description":"Where this deployment's privacy notice lives. Set, the account menu's Data & Privacy row links to it; null, no address is configured and that row stays disabled, carrying the standing note that there is nothing to configure there yet. A link target an operator configured, validated at startup as an absolute http(s) URL carrying no credential, since this response is unauthenticated.","title":"Privacy Url"},"public_catalog":{"default":false,"description":"Whether the model catalog is served to a visitor with no session: GET /api/v1/catalog/models answers anonymously and the dashboard renders Models ahead of sign-in.","title":"Public Catalog","type":"boolean"},"sign_in_methods":{"description":"How POST /api/v1/auth/session may be authenticated right now, sorted. 'master_key' is the first-boot credential and is offered until the operator identity has a password, which is what claiming the deployment means; past that it stays the credential for the management API but is no longer a dashboard login. 'password' is offered while any active identity holds one, which is not the same question and not always the later half of it: a member can hold a password on a deployment whose operator never claimed it, so both typed credentials can appear together. 'passkey' appears alongside either when this deployment is configured for WebAuthn and holds at least one passkey that its current relying-party ID can assert. The login page renders from this rather than trying a credential to find out.","items":{"enum":["master_key","password","passkey"],"type":"string"},"title":"Sign In Methods","type":"array"},"site_url":{"anyOf":[{"type":"string"},{"type":"null"}],"description":"Where this deployment's public website lives. Set, the logo on the pages a visitor reaches without an account links to it; null, it links to the public catalog where public_catalog is true, and is not a link otherwise. A link target an operator configured, validated at startup as an absolute http(s) URL carrying no credential, since this response is unauthenticated.","title":"Site Url"},"surfaces":{"description":"Management API groups this deployment serves, sorted, which is what its dashboard pages gate on: a fixed set plus one for each enabled feature. Named surfaces, not capabilities: capability is otari.ai's word for the entitlement (licensing) axis.","items":{"type":"string"},"title":"Surfaces","type":"array"},"terms_url":{"anyOf":[{"type":"string"},{"type":"null"}],"description":"Where this deployment's terms of service live. Set, the account menu carries a Terms of service row pointing at them; null, no address is configured and the menu carries no such row. A link target an operator configured, validated at startup as an absolute http(s) URL carrying no credential, since this response is unauthenticated.","title":"Terms Url"}},"required":["surfaces","docs_url","terms_url","privacy_url","site_url","sign_in_methods","maintenance_mode","passkeys_enabled","passkeys_ready","oauth_providers","open_signup","feedback_enabled","federation_member_rules","mail_ready"],"title":"DeploymentBootstrap","type":"object"}}}} ``` --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.otari.ai/api-reference/bootstrap.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.