Agent bootstrap - Autotouch AI

This page documents the canonical HTTP contract for this endpoint.

This is an unauthenticated signup route. It rate-limits attempts by request IP and normalized email; configured thresholds use SIGNUP_RATE_LIMIT_PER_IP_PER_MINUTE and SIGNUP_RATE_LIMIT_PER_EMAIL_PER_HOUR; failures currently pass through the route's generic 500 handler.

Omitting scopes, or supplying no recognized scopes, selects the default key scopes: tables:read, tables:write, columns:write, columns:run, and jobs:read. Unsupported scope strings are discarded. The raw apiKey is returned in this response; store it securely.

Signup creates the user, organization, and developer key; it starts registration-sync work and sends confirmation email for an unconfirmed account. If AGENT_BOOTSTRAP_WEBHOOK_URL is configured, webhook delivery is started asynchronously. Credit values come from created records and are not fixed in the response contract.

Body parameters

first_namerequired
string
User first name.
last_namerequired
string
User last name.
emailrequired
email string
Signup email parsed as an email address; stored lowercase.
passwordrequired
string
User password. The request model declares no length constraint.
organization_namerequired
string
Organization display name.
keyName · optional
string
Developer key label; defaults to "Agent bootstrap key". The model also accepts key_name.
scopes · optional
string[]
Optional developer-key scopes. Unsupported entries are discarded; an empty recognized set falls back to default scopes.
expiresAt · optional
datetime
Optional ISO datetime for API key expiry; the model also accepts expires_at.
utm_source · optional
string
Optional signup attribution.
utm_medium · optional
string
Optional signup attribution.
utm_campaign · optional
string
Optional signup attribution.
utm_term · optional
string
Optional signup attribution.
utm_content · optional
string
Optional signup attribution.

Name	Type	Description
first_namerequired	string	User first name.
last_namerequired	string	User last name.
emailrequired	email string	Signup email parsed as an email address; stored lowercase.
passwordrequired	string	User password. The request model declares no length constraint.
organization_namerequired	string	Organization display name.
keyName	string	Developer key label; defaults to "Agent bootstrap key". The model also accepts key_name.
scopes	string[]	Optional developer-key scopes. Unsupported entries are discarded; an empty recognized set falls back to default scopes.
expiresAt	datetime	Optional ISO datetime for API key expiry; the model also accepts expires_at.
utm_source	string	Optional signup attribution.
utm_medium	string	Optional signup attribution.
utm_campaign	string	Optional signup attribution.
utm_term	string	Optional signup attribution.
utm_content	string	Optional signup attribution.

Errors

Status	Meaning
400	Registration validation failed, such as a blocked disposable email domain.
422	Request body validation failed.
409	User already exists for this email.
500	Internal server error.

Example

bash

curl -X POST "https://app.autotouch.ai/api/auth/agent-bootstrap" \
    -H "Content-Type: application/json" \
    -d '{
      "first_name": "Ada",
      "last_name": "Lovelace",
      "email": "ada@yourcompany.com",
      "password": "use-a-strong-random-password",
      "organization_name": "Your Company",
      "keyName": "Agent bootstrap key"
    }'

Request body

json

{
    "first_name": "Ada",
    "last_name": "Lovelace",
    "email": "ada@yourcompany.com",
    "password": "use-a-strong-random-password",
    "organization_name": "Your Company",
    "keyName": "Agent bootstrap key",
    "scopes": ["tables:read", "jobs:read"],
    "expiresAt": "2027-01-01T00:00:00Z",
    "utm_source": "docs"
  }

Response example

json

{
    "success": true,
    "message": "Agent bootstrap completed",
    "userData": {
      "email": "ada@yourcompany.com",
      "firstName": "Ada",
      "lastName": "Lovelace",
      "organizationId": "uuid-here",
      "organizationName": "Your Company",
      "confirmed": false
    },
    "key": {
      "key_id": "6a7b8c9d0e1f2345",
      "name": "Agent bootstrap key",
      "scopes": ["tables:read", "jobs:read"],
      "active": true,
      "masked_key": "stk_6a7b8c9d0e1f2345.****",
      "created_by_user_id": "65d7a841c9e2b0f43a110001",
      "created_by_email": "ada@yourcompany.com",
      "created_at": "2026-09-27T12:00:00Z",
      "updated_at": "2026-09-27T12:00:00Z",
      "last_used_at": null,
      "last_used_ip": null,
      "expires_at": "2027-01-01T00:00:00Z",
      "revoked_at": null
    },
    "apiKey": "stk_6a7b8c9d0e1f2345.<secret>",
    "credits": {
      "organization_credits": 50,
      "organization_credits_monthly_quota": 50,
      "user_allowance": 50,
      "user_monthly_quota": 50
    }
  }