Signup provisioning. Subject-authenticated — the bearer is a verified human ID token, not a member yet. Creates the org, seals the org master under the deployment KEK, plants the humans row, and writes the Keto owner/member tuples plus the Kratos organization_id stamp. Idempotent; safe to retry. Not MCP.

POST/v1/provision

Authorization

AuthorizationBearer token (JWT) · headerrequired

Hydra JWT. Identity is the bound agent or a Keto member human. The host is not identity.

Responses

200Provisioned principal

subjectstringrequired

org_idstringrequired

401missing or invalid human token

Request

curl -X POST "https://veil.nyc/v1/provision" \
  -H "Authorization: Bearer YOUR_TOKEN"

const response = await fetch("https://veil.nyc/v1/provision", {
  method: "POST",
  headers: {
    "Authorization": "Bearer YOUR_TOKEN"
  }
});

import requests

response = requests.post(
    "https://veil.nyc/v1/provision",
    headers={
        "Authorization": "Bearer YOUR_TOKEN"
    },
)

Response

{
  "subject": "string",
  "org_id": "string"
}