/api/raida/keys/provision

POST

First-boot key provisioning for a RAIDA. If the Mail wallet already holds a 100,000 CC coin the call answers present and only tidies Mail (any other coin there is moved to Default, same folder). Otherwise the core fetches the manifest from rkeys.php on cloudcoin.org, downloads the three coin files, verifies each one’s size, SHA-256 and denomination with its own coin reader, and only then installs them: the 100,000 CC identity into Mail/Bank (renamed to its address form) and the two encryption coins into Default/Bank. Nothing is written unless all three verify. Finally the three coins are re-keyed to fresh random ANs on all 25 RAIDAs so the copy the website served is dead. The website serves each RAIDA’s set exactly once, keyed by the caller’s public address.

http://localhost:8080/api/raida/keys/provision

Parameters

None. The manifest URL comes from rest_core.conf (rkeys_url, default https://cloudcoin.org/rkeys.php).

Responses

Success Response (200)

Keys were downloaded and installed:

{
    "command": "raida-keys-provision",
    "success": true,
    "status": "installed",
    "raida_id": 11,
    "moved_to_default": [
        { "denomination": 4, "serial_number": 5220, "folder": "Fracked" }
    ],
    "identity": { "denomination": 5, "serial_number": 1523, "wallet": "Mail", "folder": "Bank" },
    "encryption": [
        { "denomination": 2, "serial_number": 33255, "wallet": "Default" },
        { "denomination": 2, "serial_number": 33256, "wallet": "Default" }
    ],
    "encryption_written": 2,
    "rekey": [
        { "denomination": 5, "serial_number": 1523, "raidas_rekeyed": 25, "zero_an_raidas_before": 9, "zero_an_raidas_after": 0, "file_written": true },
        { "denomination": 2, "serial_number": 33255, "raidas_rekeyed": 25, "zero_an_raidas_before": 12, "zero_an_raidas_after": 0, "file_written": true },
        { "denomination": 2, "serial_number": 33256, "raidas_rekeyed": 25, "zero_an_raidas_before": 12, "zero_an_raidas_after": 0, "file_written": true }
    ],
    "rekeyed_on_majority": 3
}

An identity was already there (nothing downloaded):

{
    "command": "raida-keys-provision",
    "success": true,
    "status": "present",
    "denomination": 5,
    "serial_number": 1523,
    "folder": "Bank",
    "moved_to_default": [],
    "moved_count": 0
}
FieldTypeDescription
statusstringinstalled or present.
raida_idintegerSlot the website assigned to the caller’s address (installed only).
moved_to_defaultarrayCoins that were in Mail but are not the identity, now in the Default wallet in the same folder.
identity, encryption[]objectWhat was installed and where.
rekey[], rekeyed_on_majorityarray, integerOutcome of the post-install re-key (see rekey). rekey_error appears instead if it could not run; the coins are still installed.

Error Responses

403 / 410

rkeys.php refused: the caller’s public address is not a RAIDA (403), or this slot’s keys were already served once (410) and an administrator must reload them.

{ "error": true, "message": "rkeys.php refused (410): Keys for this RAIDA were already served; contact the administrator", "code": 410 }

422 Unprocessable

The manifest is malformed, or a downloaded file failed its size, SHA-256, coin-format or denomination check. Wallets are untouched.

500 Internal Server Error

The Mail wallet could not be created, an existing Mail coin could not be moved to Default, or the identity coin could not be written.

502 Bad Gateway

The manifest or a file could not be downloaded.

Examples

cURL Example

curl -X POST "http://localhost:8080/api/raida/keys/provision"

JavaScript Example

fetch(`http://localhost:8080/api/raida/keys/provision`, { method: 'POST' })
    .then(r => r.json())
    .then(d => console.log(d.success ? d.status : `${d.code} ${d.message}`));

Python Example

import requests
d = requests.post('http://localhost:8080/api/raida/keys/provision').json()
print(d.get('status') or d.get('message'))

Notes

  • One shot. The website moves a slot’s files out of reach after the third download. A RAIDA that loses its Mail wallet afterwards needs an administrator to reload the slot.
  • All or nothing. The three files are downloaded and verified in memory first; a failure anywhere leaves the wallets exactly as they were.
  • The caller address seen by cloudcoin.org must be the DNS answer for raida{50+id}.cloudcoin.global. Behind NAT that is the router’s public address, which is what the website sees.
  • Raidax calls this once per boot before attempting DRD registration; a failure means “no registration this boot”, never a refusal to serve coins.