[{"data":1,"prerenderedAt":1154},["ShallowReactive",2],{"docs:\u002Fdocs\u002Fapi\u002Fonboarding-sessions":3},{"id":4,"title":5,"body":6,"description":1144,"extension":1145,"meta":1146,"navigation":1147,"path":1150,"seo":1151,"stem":1152,"__hash__":1153},"docs\u002Fdocs\u002Fapi\u002Fonboarding-sessions.md","Onboarding sessions API",{"type":7,"value":8,"toc":1132},"minimark",[9,24,27,32,79,85,88,93,147,154,159,201,206,212,219,223,232,236,271,281,292,298,301,305,423,427,450,456,461,468,585,591,596,600,609,613,675,678,684,687,692,728,760,767,777,817,834,839,846,904,907,912,967,970,1003,1010,1016,1020,1026,1104,1108,1128],[10,11,12,13,17,18,23],"p",{},"The ",[14,15,16],"code",{},"\u002Fonboarding\u002F*"," endpoints are the public, unauthenticated surface a coding agent uses to walk a developer through Iqrar setup. They exist so a developer can paste ",[19,20,22],"a",{"href":21},"\u002Fdocs\u002Fcoding-agents","the prompt",", watch their session populate live, and only authenticate at the moment they want to convert their session into a real Iqrar org.",[10,25,26],{},"This page is the wire format. The same endpoints power the prompt's behaviour, but you can call them directly from any HTTP client.",[28,29,31],"h2",{"id":30},"trust-model","Trust model",[33,34,35,44,55,66,73],"ul",{},[36,37,38,39,43],"li",{},"The agent's side is ",[40,41,42],"strong",{},"write-only and unauthenticated",". Anyone can open a session.",[36,45,46,47,50,51,54],{},"The viewer URL embedded in ",[14,48,49],{},"view_url"," is ",[40,52,53],{},"read-only and signed",". It carries an opaque token; presenting the token reads the session. Sharing the URL shares read access — treat it like a Google Doc share link.",[36,56,57,58,61,62,65],{},"Session events are tagged ",[14,59,60],{},"source: \"onboarding\""," in the audit chain. They are ",[40,63,64],{},"operator-asserted",", not agent-signed — no Ed25519 identity exists yet at this stage.",[36,67,68,69,72],{},"A session that's never claimed expires after ",[40,70,71],{},"30 days",". Events written to it are deleted at expiry.",[36,74,75,76,78],{},"A session converts into an Iqrar org via the magic-link claim flow. After claim, the session events stay attached to the session — they're operator-asserted, not agent-bound, so they don't migrate into the per-agent audit chain. The session view remains accessible at ",[14,77,49],{}," for the lifetime of the org as a record of how it onboarded.",[28,80,82],{"id":81},"post-onboardingsessions",[14,83,84],{},"POST \u002Fonboarding\u002Fsessions",[10,86,87],{},"Open a new onboarding session.",[10,89,90],{},[40,91,92],{},"Request",[94,95,100],"pre",{"className":96,"code":97,"language":98,"meta":99,"style":99},"language-http shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","POST \u002Fonboarding\u002Fsessions\nContent-Type: application\u002Fjson\n\n{\n  \"user_agent\": \"claude-code\u002F0.5.0\",\n  \"project_hint\": \"github.com\u002Facme\u002Fagents\"\n}\n","http","",[14,101,102,110,116,123,129,135,141],{"__ignoreMap":99},[103,104,107],"span",{"class":105,"line":106},"line",1,[103,108,109],{},"POST \u002Fonboarding\u002Fsessions\n",[103,111,113],{"class":105,"line":112},2,[103,114,115],{},"Content-Type: application\u002Fjson\n",[103,117,119],{"class":105,"line":118},3,[103,120,122],{"emptyLinePlaceholder":121},true,"\n",[103,124,126],{"class":105,"line":125},4,[103,127,128],{},"{\n",[103,130,132],{"class":105,"line":131},5,[103,133,134],{},"  \"user_agent\": \"claude-code\u002F0.5.0\",\n",[103,136,138],{"class":105,"line":137},6,[103,139,140],{},"  \"project_hint\": \"github.com\u002Facme\u002Fagents\"\n",[103,142,144],{"class":105,"line":143},7,[103,145,146],{},"}\n",[10,148,149,150,153],{},"Both fields are optional. ",[14,151,152],{},"project_hint"," is a free-form string the coding agent can use to tag the session — typically the git remote URL. The server doesn't act on it; it's surfaced in the dashboard so the developer can find their session.",[10,155,156],{},[40,157,158],{},"Response",[94,160,162],{"className":96,"code":161,"language":98,"meta":99,"style":99},"200 OK\nContent-Type: application\u002Fjson\n\n{\n  \"session_id\": \"ses_01HRX9...\",\n  \"view_url\": \"https:\u002F\u002Fiqrar.io\u002Fonboarding\u002Fses_01HRX9...?t=...\",\n  \"expires_at\": 1749146291000\n}\n",[14,163,164,169,173,177,181,186,191,196],{"__ignoreMap":99},[103,165,166],{"class":105,"line":106},[103,167,168],{},"200 OK\n",[103,170,171],{"class":105,"line":112},[103,172,115],{},[103,174,175],{"class":105,"line":118},[103,176,122],{"emptyLinePlaceholder":121},[103,178,179],{"class":105,"line":125},[103,180,128],{},[103,182,183],{"class":105,"line":131},[103,184,185],{},"  \"session_id\": \"ses_01HRX9...\",\n",[103,187,188],{"class":105,"line":137},[103,189,190],{},"  \"view_url\": \"https:\u002F\u002Fiqrar.io\u002Fonboarding\u002Fses_01HRX9...?t=...\",\n",[103,192,193],{"class":105,"line":143},[103,194,195],{},"  \"expires_at\": 1749146291000\n",[103,197,199],{"class":105,"line":198},8,[103,200,146],{},[10,202,203,205],{},[14,204,49],{}," is what you hand back to the developer. They open it in a browser to watch the chain populate. The token in the query string is single-use-per-fetch and rotates on every refresh.",[28,207,209],{"id":208},"get-onboardinglookupdomain",[14,210,211],{},"GET \u002Fonboarding\u002Flookup?domain=...",[10,213,214,215,218],{},"Check whether an Iqrar org already exists for a given email domain. ",[40,216,217],{},"Privacy-aware"," — does not enumerate; rate-limited; returns an opaque response.",[10,220,221],{},[40,222,92],{},[94,224,226],{"className":96,"code":225,"language":98,"meta":99,"style":99},"GET \u002Fonboarding\u002Flookup?domain=acme.com\n",[14,227,228],{"__ignoreMap":99},[103,229,230],{"class":105,"line":106},[103,231,225],{},[10,233,234],{},[40,235,158],{},[94,237,239],{"className":96,"code":238,"language":98,"meta":99,"style":99},"200 OK\nContent-Type: application\u002Fjson\n\n{\n  \"claimed\": true,\n  \"claim_hint\": \"magic-link sent to the existing admin\"\n}\n",[14,240,241,245,249,253,257,262,267],{"__ignoreMap":99},[103,242,243],{"class":105,"line":106},[103,244,168],{},[103,246,247],{"class":105,"line":112},[103,248,115],{},[103,250,251],{"class":105,"line":118},[103,252,122],{"emptyLinePlaceholder":121},[103,254,255],{"class":105,"line":125},[103,256,128],{},[103,258,259],{"class":105,"line":131},[103,260,261],{},"  \"claimed\": true,\n",[103,263,264],{"class":105,"line":137},[103,265,266],{},"  \"claim_hint\": \"magic-link sent to the existing admin\"\n",[103,268,269],{"class":105,"line":143},[103,270,146],{},[10,272,273,274,277,278,280],{},"When ",[14,275,276],{},"claimed"," is true, the coding agent should prompt the developer to claim via the existing admin's email rather than re-registering. When ",[14,279,276],{}," is false, registration proceeds normally.",[10,282,283,284,287,288,291],{},"The endpoint returns ",[14,285,286],{},"200"," for every well-formed query regardless of result. There is no ",[14,289,290],{},"404",".",[28,293,295],{"id":294},"post-onboardingsessionssession_idevents",[14,296,297],{},"POST \u002Fonboarding\u002Fsessions\u002F:session_id\u002Fevents",[10,299,300],{},"Append events to a session. The agent calls this throughout the prompt — once for each Q&A answer, once for the repo-scan report, once after SDK install, etc.",[10,302,303],{},[40,304,92],{},[94,306,308],{"className":96,"code":307,"language":98,"meta":99,"style":99},"POST \u002Fonboarding\u002Fsessions\u002Fses_01HRX9...\u002Fevents\nContent-Type: application\u002Fjson\n\n{\n  \"events\": [\n    {\n      \"type\": \"onboarding.jurisdiction_selected\",\n      \"ts\": 1746478291000,\n      \"payload\": { \"jurisdiction\": \"AE\" }\n    },\n    {\n      \"type\": \"onboarding.capabilities_inferred\",\n      \"ts\": 1746478295000,\n      \"payload\": {\n        \"input\": \"customer support chat for our SaaS\",\n        \"capabilities\": [\"consumer_chatbot\"],\n        \"inferred_tier\": \"limited\"\n      }\n    }\n  ]\n}\n",[14,309,310,315,319,323,327,332,337,342,347,353,359,364,370,376,382,388,394,400,406,412,418],{"__ignoreMap":99},[103,311,312],{"class":105,"line":106},[103,313,314],{},"POST \u002Fonboarding\u002Fsessions\u002Fses_01HRX9...\u002Fevents\n",[103,316,317],{"class":105,"line":112},[103,318,115],{},[103,320,321],{"class":105,"line":118},[103,322,122],{"emptyLinePlaceholder":121},[103,324,325],{"class":105,"line":125},[103,326,128],{},[103,328,329],{"class":105,"line":131},[103,330,331],{},"  \"events\": [\n",[103,333,334],{"class":105,"line":137},[103,335,336],{},"    {\n",[103,338,339],{"class":105,"line":143},[103,340,341],{},"      \"type\": \"onboarding.jurisdiction_selected\",\n",[103,343,344],{"class":105,"line":198},[103,345,346],{},"      \"ts\": 1746478291000,\n",[103,348,350],{"class":105,"line":349},9,[103,351,352],{},"      \"payload\": { \"jurisdiction\": \"AE\" }\n",[103,354,356],{"class":105,"line":355},10,[103,357,358],{},"    },\n",[103,360,362],{"class":105,"line":361},11,[103,363,336],{},[103,365,367],{"class":105,"line":366},12,[103,368,369],{},"      \"type\": \"onboarding.capabilities_inferred\",\n",[103,371,373],{"class":105,"line":372},13,[103,374,375],{},"      \"ts\": 1746478295000,\n",[103,377,379],{"class":105,"line":378},14,[103,380,381],{},"      \"payload\": {\n",[103,383,385],{"class":105,"line":384},15,[103,386,387],{},"        \"input\": \"customer support chat for our SaaS\",\n",[103,389,391],{"class":105,"line":390},16,[103,392,393],{},"        \"capabilities\": [\"consumer_chatbot\"],\n",[103,395,397],{"class":105,"line":396},17,[103,398,399],{},"        \"inferred_tier\": \"limited\"\n",[103,401,403],{"class":105,"line":402},18,[103,404,405],{},"      }\n",[103,407,409],{"class":105,"line":408},19,[103,410,411],{},"    }\n",[103,413,415],{"class":105,"line":414},20,[103,416,417],{},"  ]\n",[103,419,421],{"class":105,"line":420},21,[103,422,146],{},[10,424,425],{},[40,426,158],{},[94,428,430],{"className":96,"code":429,"language":98,"meta":99,"style":99},"202 Accepted\nContent-Type: application\u002Fjson\n\n{ \"accepted\": 2 }\n",[14,431,432,437,441,445],{"__ignoreMap":99},[103,433,434],{"class":105,"line":106},[103,435,436],{},"202 Accepted\n",[103,438,439],{"class":105,"line":112},[103,440,115],{},[103,442,443],{"class":105,"line":118},[103,444,122],{"emptyLinePlaceholder":121},[103,446,447],{"class":105,"line":125},[103,448,449],{},"{ \"accepted\": 2 }\n",[10,451,452,453,455],{},"Events are durably enqueued. The viewer at ",[14,454,49],{}," polls for changes and renders new events within ~1s.",[457,458,460],"h3",{"id":459},"canonical-event-types","Canonical event types",[10,462,463,464,467],{},"The viewer renders these specially. Custom ",[14,465,466],{},"onboarding.*"," types are accepted and shown as raw JSON.",[469,470,471,487],"table",{},[472,473,474],"thead",{},[475,476,477,481,484],"tr",{},[478,479,480],"th",{},"Type",[478,482,483],{},"When to emit",[478,485,486],{},"Required payload",[488,489,490,506,521,536,551,566],"tbody",{},[475,491,492,498,501],{},[493,494,495],"td",{},[14,496,497],{},"onboarding.session_opened",[493,499,500],{},"Once, on session creation. The server emits this automatically.",[493,502,503],{},[14,504,505],{},"{ user_agent?, project_hint? }",[475,507,508,513,516],{},[493,509,510],{},[14,511,512],{},"onboarding.jurisdiction_selected",[493,514,515],{},"After Q1.",[493,517,518],{},[14,519,520],{},"{ jurisdiction: \"AE\" }",[475,522,523,528,531],{},[493,524,525],{},[14,526,527],{},"onboarding.capabilities_inferred",[493,529,530],{},"After Q2.",[493,532,533],{},[14,534,535],{},"{ input: string, capabilities: string[], inferred_tier: \"minimal\"|\"limited\"|\"high\"|\"critical\" }",[475,537,538,543,546],{},[493,539,540],{},[14,541,542],{},"onboarding.repo_scanned",[493,544,545],{},"After the agent scans the repo and the developer authorises sending the report.",[493,547,548],{},[14,549,550],{},"{ frameworks: string[], agents: Array\u003C{ path, framework, model?, capabilities, tier }> }",[475,552,553,558,561],{},[493,554,555],{},[14,556,557],{},"onboarding.sdk_installed",[493,559,560],{},"After SDK install + wrap is complete.",[493,562,563],{},[14,564,565],{},"{ language: \"ts\"|\"py\", agent_count: number }",[475,567,568,573,580],{},[493,569,570],{},[14,571,572],{},"onboarding.first_telemetry",[493,574,575,576,579],{},"When the dev server fires its first wrapped invocation. Emitted by the SDK in ",[14,577,578],{},"IQRAR_ENV=dev"," mode against this session, if linked.",[493,581,582],{},[14,583,584],{},"{ agent_id: string }",[28,586,588],{"id":587},"get-onboardingsessionssession_id",[14,589,590],{},"GET \u002Fonboarding\u002Fsessions\u002F:session_id",[10,592,593,594,291],{},"The endpoint the viewer page hits. Returns session metadata and the event chain. Requires the token from ",[14,595,49],{},[10,597,598],{},[40,599,92],{},[94,601,603],{"className":96,"code":602,"language":98,"meta":99,"style":99},"GET \u002Fonboarding\u002Fsessions\u002Fses_01HRX9...?t=\u003Ctoken>\n",[14,604,605],{"__ignoreMap":99},[103,606,607],{"class":105,"line":106},[103,608,602],{},[10,610,611],{},[40,612,158],{},[94,614,616],{"className":96,"code":615,"language":98,"meta":99,"style":99},"200 OK\nContent-Type: application\u002Fjson\n\n{\n  \"session_id\": \"ses_01HRX9...\",\n  \"opened_at\": 1746478290000,\n  \"expires_at\": 1749146291000,\n  \"claimed\": false,\n  \"events\": [\n    { \"type\": \"onboarding.session_opened\", \"ts\": 1746478290000, \"payload\": {...} },\n    { \"type\": \"onboarding.jurisdiction_selected\", \"ts\": 1746478291000, \"payload\": {...} }\n  ]\n}\n",[14,617,618,622,626,630,634,638,643,648,653,657,662,667,671],{"__ignoreMap":99},[103,619,620],{"class":105,"line":106},[103,621,168],{},[103,623,624],{"class":105,"line":112},[103,625,115],{},[103,627,628],{"class":105,"line":118},[103,629,122],{"emptyLinePlaceholder":121},[103,631,632],{"class":105,"line":125},[103,633,128],{},[103,635,636],{"class":105,"line":131},[103,637,185],{},[103,639,640],{"class":105,"line":137},[103,641,642],{},"  \"opened_at\": 1746478290000,\n",[103,644,645],{"class":105,"line":143},[103,646,647],{},"  \"expires_at\": 1749146291000,\n",[103,649,650],{"class":105,"line":198},[103,651,652],{},"  \"claimed\": false,\n",[103,654,655],{"class":105,"line":349},[103,656,331],{},[103,658,659],{"class":105,"line":355},[103,660,661],{},"    { \"type\": \"onboarding.session_opened\", \"ts\": 1746478290000, \"payload\": {...} },\n",[103,663,664],{"class":105,"line":361},[103,665,666],{},"    { \"type\": \"onboarding.jurisdiction_selected\", \"ts\": 1746478291000, \"payload\": {...} }\n",[103,668,669],{"class":105,"line":366},[103,670,417],{},[103,672,673],{"class":105,"line":372},[103,674,146],{},[10,676,677],{},"Polling cadence: the viewer page polls every 1s while the tab is visible, every 30s when hidden.",[28,679,681],{"id":680},"post-onboardingsessionssession_idclaim",[14,682,683],{},"POST \u002Fonboarding\u002Fsessions\u002F:session_id\u002Fclaim",[10,685,686],{},"Convert an unauthenticated session into a real Iqrar org. The flow is two-step: request a claim, then confirm via magic link.",[10,688,689],{},[40,690,691],{},"Step 1 — request",[94,693,695],{"className":96,"code":694,"language":98,"meta":99,"style":99},"POST \u002Fonboarding\u002Fsessions\u002Fses_01HRX9...\u002Fclaim\nContent-Type: application\u002Fjson\n\n{\n  \"email\": \"leonard@acme.com\",\n  \"org_slug\": \"acme\"\n}\n",[14,696,697,702,706,710,714,719,724],{"__ignoreMap":99},[103,698,699],{"class":105,"line":106},[103,700,701],{},"POST \u002Fonboarding\u002Fsessions\u002Fses_01HRX9...\u002Fclaim\n",[103,703,704],{"class":105,"line":112},[103,705,115],{},[103,707,708],{"class":105,"line":118},[103,709,122],{"emptyLinePlaceholder":121},[103,711,712],{"class":105,"line":125},[103,713,128],{},[103,715,716],{"class":105,"line":131},[103,717,718],{},"  \"email\": \"leonard@acme.com\",\n",[103,720,721],{"class":105,"line":137},[103,722,723],{},"  \"org_slug\": \"acme\"\n",[103,725,726],{"class":105,"line":143},[103,727,146],{},[94,729,731],{"className":96,"code":730,"language":98,"meta":99,"style":99},"202 Accepted\n{\n  \"claim_id\": \"clm_01HRX9...\",\n  \"magic_link_sent_to\": \"leonard@acme.com\",\n  \"delivery\": \"email\"\n}\n",[14,732,733,737,741,746,751,756],{"__ignoreMap":99},[103,734,735],{"class":105,"line":106},[103,736,436],{},[103,738,739],{"class":105,"line":112},[103,740,128],{},[103,742,743],{"class":105,"line":118},[103,744,745],{},"  \"claim_id\": \"clm_01HRX9...\",\n",[103,747,748],{"class":105,"line":125},[103,749,750],{},"  \"magic_link_sent_to\": \"leonard@acme.com\",\n",[103,752,753],{"class":105,"line":131},[103,754,755],{},"  \"delivery\": \"email\"\n",[103,757,758],{"class":105,"line":137},[103,759,146],{},[10,761,762,763,766],{},"A one-time magic link is sent to the email via Resend. The link's destination is ",[14,764,765],{},"\u002Fonboarding\u002Fclaim\u002F:claim_id?t=\u003Ctoken>"," on the web app.",[10,768,769,772,773,776],{},[40,770,771],{},"Dev fallback."," When the API isn't configured with a ",[14,774,775],{},"RESEND_API_KEY",", the link is not delivered by email. The response is augmented with the link inline so local development still works:",[94,778,780],{"className":96,"code":779,"language":98,"meta":99,"style":99},"202 Accepted\n{\n  \"claim_id\": \"clm_01HRX9...\",\n  \"magic_link_sent_to\": \"leonard@acme.com\",\n  \"delivery\": \"fallback\",\n  \"delivery_reason\": \"not_configured\",\n  \"magic_link_preview\": \"https:\u002F\u002Fiqrar.io\u002Fonboarding\u002Fclaim\u002Fclm_01HRX9...?t=...\"\n}\n",[14,781,782,786,790,794,798,803,808,813],{"__ignoreMap":99},[103,783,784],{"class":105,"line":106},[103,785,436],{},[103,787,788],{"class":105,"line":112},[103,789,128],{},[103,791,792],{"class":105,"line":118},[103,793,745],{},[103,795,796],{"class":105,"line":125},[103,797,750],{},[103,799,800],{"class":105,"line":131},[103,801,802],{},"  \"delivery\": \"fallback\",\n",[103,804,805],{"class":105,"line":137},[103,806,807],{},"  \"delivery_reason\": \"not_configured\",\n",[103,809,810],{"class":105,"line":143},[103,811,812],{},"  \"magic_link_preview\": \"https:\u002F\u002Fiqrar.io\u002Fonboarding\u002Fclaim\u002Fclm_01HRX9...?t=...\"\n",[103,814,815],{"class":105,"line":198},[103,816,146],{},[10,818,819,50,822,825,826,829,830,833],{},[14,820,821],{},"delivery_reason",[14,823,824],{},"\"not_configured\""," when the mailer isn't set up, or ",[14,827,828],{},"\"send_failed\""," when Resend rejected the request — in both cases ",[14,831,832],{},"magic_link_preview"," is available as a recovery path. Production deployments configured with Resend should never see the fallback shape.",[10,835,836],{},[40,837,838],{},"Step 2a — preview (idempotent, link-safe)",[10,840,841,842,845],{},"The magic link itself points at a web page on ",[14,843,844],{},"iqrar.io"," that loads claim metadata before any mutation. The page hits:",[94,847,849],{"className":96,"code":848,"language":98,"meta":99,"style":99},"GET \u002Fonboarding\u002Fclaim\u002Fclm_01HRX9...?t=\u003Ctoken>\n\n200 OK\n{\n  \"claim_id\": \"clm_01HRX9...\",\n  \"session_id\": \"ses_01HRX9...\",\n  \"email\": \"leonard@acme.com\",\n  \"org_slug\": \"acme\",\n  \"expires_at\": 1746480091000,\n  \"expired\": false,\n  \"confirmed\": false\n}\n",[14,850,851,856,860,864,868,872,876,880,885,890,895,900],{"__ignoreMap":99},[103,852,853],{"class":105,"line":106},[103,854,855],{},"GET \u002Fonboarding\u002Fclaim\u002Fclm_01HRX9...?t=\u003Ctoken>\n",[103,857,858],{"class":105,"line":112},[103,859,122],{"emptyLinePlaceholder":121},[103,861,862],{"class":105,"line":118},[103,863,168],{},[103,865,866],{"class":105,"line":125},[103,867,128],{},[103,869,870],{"class":105,"line":131},[103,871,745],{},[103,873,874],{"class":105,"line":137},[103,875,185],{},[103,877,878],{"class":105,"line":143},[103,879,718],{},[103,881,882],{"class":105,"line":198},[103,883,884],{},"  \"org_slug\": \"acme\",\n",[103,886,887],{"class":105,"line":349},[103,888,889],{},"  \"expires_at\": 1746480091000,\n",[103,891,892],{"class":105,"line":355},[103,893,894],{},"  \"expired\": false,\n",[103,896,897],{"class":105,"line":361},[103,898,899],{},"  \"confirmed\": false\n",[103,901,902],{"class":105,"line":366},[103,903,146],{},[10,905,906],{},"This endpoint never mutates state, so email previewers and link scanners that prefetch the URL cannot consume the claim. The web page renders a \"Confirm and reveal API key\" button.",[10,908,909],{},[40,910,911],{},"Step 2b — confirm (mutating, requires user click)",[94,913,915],{"className":96,"code":914,"language":98,"meta":99,"style":99},"POST \u002Fonboarding\u002Fclaim\u002Fclm_01HRX9...?t=\u003Ctoken>\n\n200 OK\n{\n  \"ok\": true,\n  \"org\": \"acme\",\n  \"session_id\": \"ses_01HRX9...\",\n  \"api_key\": \"iqr_a1b2c3...\",\n  \"api_key_id\": \"key_01HRX9...\",\n  \"api_key_prefix\": \"iqr_a1b2\"\n}\n",[14,916,917,922,926,930,934,939,944,948,953,958,963],{"__ignoreMap":99},[103,918,919],{"class":105,"line":106},[103,920,921],{},"POST \u002Fonboarding\u002Fclaim\u002Fclm_01HRX9...?t=\u003Ctoken>\n",[103,923,924],{"class":105,"line":112},[103,925,122],{"emptyLinePlaceholder":121},[103,927,928],{"class":105,"line":118},[103,929,168],{},[103,931,932],{"class":105,"line":125},[103,933,128],{},[103,935,936],{"class":105,"line":131},[103,937,938],{},"  \"ok\": true,\n",[103,940,941],{"class":105,"line":137},[103,942,943],{},"  \"org\": \"acme\",\n",[103,945,946],{"class":105,"line":143},[103,947,185],{},[103,949,950],{"class":105,"line":198},[103,951,952],{},"  \"api_key\": \"iqr_a1b2c3...\",\n",[103,954,955],{"class":105,"line":349},[103,956,957],{},"  \"api_key_id\": \"key_01HRX9...\",\n",[103,959,960],{"class":105,"line":355},[103,961,962],{},"  \"api_key_prefix\": \"iqr_a1b2\"\n",[103,964,965],{"class":105,"line":361},[103,966,146],{},[10,968,969],{},"The POST:",[971,972,973,976,983,986,993],"ol",{},[36,974,975],{},"Verifies the token.",[36,977,978,979,982],{},"Creates the ",[14,980,981],{},"orgs.acme"," row if not already claimed.",[36,984,985],{},"Issues an API key, storing only its SHA-256 hash. Plaintext is returned exactly once in this response.",[36,987,988,989,992],{},"Marks the session claimed; binds the email's domain to the org for future ",[14,990,991],{},"\u002Fonboarding\u002Flookup"," calls.",[36,994,995,996,999,1000,1002],{},"Appends ",[14,997,998],{},"onboarding.claimed"," to the session event chain. The session itself is preserved — ",[14,1001,49],{}," continues to work as a record of how the org was onboarded.",[10,1004,1005,1006,1009],{},"Subsequent POSTs return ",[14,1007,1008],{},"409 already_confirmed",". The plaintext API key is never recoverable from the database — if lost, the developer must rotate via the dashboard.",[10,1011,1012,1013,1015],{},"After successful claim, the session view at ",[14,1014,49],{}," flips to a \"claimed by acme\" banner.",[28,1017,1019],{"id":1018},"errors","Errors",[10,1021,1022,1023,291],{},"All endpoints return JSON errors with shape ",[14,1024,1025],{},"{ error: string, code: string }",[469,1027,1028,1038],{},[472,1029,1030],{},[475,1031,1032,1035],{},[478,1033,1034],{},"Code",[478,1036,1037],{},"Meaning",[488,1039,1040,1050,1060,1070,1084,1094],{},[475,1041,1042,1047],{},[493,1043,1044],{},[14,1045,1046],{},"session_not_found",[493,1048,1049],{},"The session ID doesn't exist or has expired.",[475,1051,1052,1057],{},[493,1053,1054],{},[14,1055,1056],{},"session_expired",[493,1058,1059],{},"The session passed its 30-day expiry.",[475,1061,1062,1067],{},[493,1063,1064],{},[14,1065,1066],{},"token_invalid",[493,1068,1069],{},"The viewer or claim token is wrong, expired, or revoked.",[475,1071,1072,1077],{},[493,1073,1074],{},[14,1075,1076],{},"domain_already_claimed",[493,1078,1079,1080,1083],{},"The email domain in a claim request already has an Iqrar org. The response includes ",[14,1081,1082],{},"claim_hint"," for the existing-admin recovery flow.",[475,1085,1086,1091],{},[493,1087,1088],{},[14,1089,1090],{},"rate_limited",[493,1092,1093],{},"Too many requests from the same IP. The lookup and claim endpoints have stricter limits than events.",[475,1095,1096,1101],{},[493,1097,1098],{},[14,1099,1100],{},"event_too_large",[493,1102,1103],{},"A single event payload exceeded 64 KB. Truncate or summarise before retrying.",[28,1105,1107],{"id":1106},"once-youre-claimed","Once you're claimed",[10,1109,1110,1111,1114,1115,1118,1119,1123,1124,1127],{},"The onboarding endpoints stop being relevant after claim. The agent moves to the authenticated ",[14,1112,1113],{},"\u002Fregister"," and ",[14,1116,1117],{},"\u002Ftelemetry"," endpoints documented in the ",[19,1120,1122],{"href":1121},"\u002Fdocs\u002Fintegrations\u002Fhttp","HTTP integration guide",", using the ",[14,1125,1126],{},"IQRAR_API_KEY"," issued at claim time.",[1129,1130,1131],"style",{},"html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"title":99,"searchDepth":112,"depth":112,"links":1133},[1134,1135,1136,1137,1140,1141,1142,1143],{"id":30,"depth":112,"text":31},{"id":81,"depth":112,"text":84},{"id":208,"depth":112,"text":211},{"id":294,"depth":112,"text":297,"children":1138},[1139],{"id":459,"depth":118,"text":460},{"id":587,"depth":112,"text":590},{"id":680,"depth":112,"text":683},{"id":1018,"depth":112,"text":1019},{"id":1106,"depth":112,"text":1107},"Public unauthenticated wire format that lets a coding agent open a session, stream onboarding events, present a live dashboard URL, and convert into a claimed Iqrar org.","md",{},{"title":1148,"order":1149},"Onboarding sessions",50,"\u002Fdocs\u002Fapi\u002Fonboarding-sessions",{"title":5,"description":1144},"docs\u002Fapi\u002Fonboarding-sessions","dYYkTi3DS89B5ggVRxEp2LKl0oGsDCkExKqns465LyA",1778064965624]