API reference

Beacons

The device bridge: enroll devices with a signed challenge, list, rename and revoke them, and manage fleets, peers and admission policy.

Operations: 13
Base path: https://os.one.ml/api/v1/beacons
Scopes: beacons:device:enroll beacons:read beacons:write
API keys: 2 need a signed-in session · 8 refused to API keys · 3 not yet tested
SDK: genesis.call('beacons_issueBridgeDeviceChallenge', …) · helpers under genesis.beacons
CLI: genesis beacons
MCP: 13 tools

Operations

Operation	Endpoint	API key
Issue a five-minute device proof challenge	POST`/bridge/device-challenges`	Signed-in session
Admit a device using its signed one-time challenge	POST`/bridge/device-enrollments`	Signed-in session
List bridge devices	GET`/bridge/devices`	API keys refused
Revoke bridge device	DELETE`/bridge/devices/{id}`	—
Update bridge device (name, nicknames)	PATCH`/bridge/devices/{id}`	—
Poll durable teardown commands for the enrolled device owner	GET`/bridge/devices/{id}/revocations`	API keys refused
Acknowledge an applied transport teardown action	POST`/bridge/devices/{id}/revocations/{version}/ack`	—
Create or reuse first-fleet metadata in the verified Beacons selection	POST`/bridge/fleets/provision`	API keys refused
List actual fleets in the current human-authorized Sandbox selection	GET`/dashboard/fleets`	API keys refused
Rename the actual fleet in the current authorized selection	PATCH`/dashboard/fleets/{fleet_id}`	API keys refused
List actual peers and durable revocation state for an authorized fleet	GET`/dashboard/fleets/{fleet_id}/peers`	API keys refused
Read actual admission policy, including whether it has ever been saved	GET`/dashboard/fleets/{fleet_id}/policy`	API keys refused
Save the closed fleet policy enforced by future device admissions	PUT`/dashboard/fleets/{fleet_id}/policy`	API keys refused

Bridge

Issue a five-minute device proof challenge

POST/v1/beacons/bridge/device-challenges

beacons:device:enrollSigned-in sessionbeacons_issueBridgeDeviceChallenge

Requires explicit beacons:write and beacons:device:enroll under a verified human identity and provisioned canonical fleet scope.

Request body application/json

fleet_idstring (uuid)required
proof_keystringrequired
Base64url unpadded Ed25519 public key, 32 bytes
tunnel_keystringrequired
Base64url unpadded WireGuard public key, 32 bytes
transport"t1_full" | "t2_sandboxed"required

Responses

201Created
Response fields
- version1required
- idstringrequired
- noncestringrequired
- issuerstringrequired
- organizationstringrequired
- principalstringrequired
- workspacestringrequired
- projectstringrequired
- environmentstringrequired
- binding_revisionstringrequired
- transportstringrequired
- fleet_idstringrequired
- proof_keystringrequired
- tunnel_keystringrequired
- issued_atinteger (int64)required
- expires_atinteger (int64)required
403Forbidden
404Not found
409Scope not provisioned or device key already admitted
4xx 5xxThe error envelope.

curl -X POST "https://os.one.ml/api/v1/beacons/bridge/device-challenges" \
  -H "Authorization: Bearer $GENESIS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "fleet_id": "00000000-0000-4000-8000-000000000000",
    "proof_key": "string",
    "tunnel_key": "string",
    "transport": "t1_full"
  }'

import { Genesis } from '@lifesi/genesis'

const genesis = new Genesis({ apiKey: process.env.GENESIS_API_KEY })
const result = await genesis.call('beacons_issueBridgeDeviceChallenge', {
  body: {
    fleet_id: '00000000-0000-4000-8000-000000000000',
    proof_key: 'string',
    tunnel_key: 'string',
    transport: 't1_full',
  },
})

{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "beacons_issueBridgeDeviceChallenge",
    "arguments": {
      "body": {
        "fleet_id": "00000000-0000-4000-8000-000000000000",
        "proof_key": "string",
        "tunnel_key": "string",
        "transport": "t1_full"
      }
    }
  }
}

Admit a device using its signed one-time challenge

POST/v1/beacons/bridge/device-enrollments

beacons:device:enrollSigned-in sessionbeacons_enrollBridgeDevice

Requires explicit beacons:write and beacons:device:enroll under a verified human identity and provisioned canonical fleet scope.

Request body application/json

challengeobjectrequired
challenge.version1required
challenge.idstringrequired
challenge.noncestringrequired
challenge.issuerstringrequired
challenge.organizationstringrequired
challenge.principalstringrequired
challenge.workspacestringrequired
challenge.projectstringrequired
challenge.environmentstringrequired
challenge.binding_revisionstringrequired
challenge.transportstringrequired
challenge.fleet_idstringrequired
challenge.proof_keystringrequired
challenge.tunnel_keystringrequired
challenge.issued_atinteger (int64)required
challenge.expires_atinteger (int64)required
signaturestringrequired
Base64url unpadded Ed25519 signature over the domain-prefixed canonical challenge JSON

Responses

201Created
Response fields
- device_idstring (uuid)required
- fleet_idstring (uuid)required
- meshobjectrequired
403Forbidden
404Not found
409Scope not provisioned or device key already admitted
4xx 5xxThe error envelope.

curl -X POST "https://os.one.ml/api/v1/beacons/bridge/device-enrollments" \
  -H "Authorization: Bearer $GENESIS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "challenge": {
      "version": 1,
      "id": "string",
      "nonce": "string",
      "issuer": "string",
      "organization": "string",
      "principal": "string",
      "workspace": "string",
      "project": "string",
      "environment": "string",
      "binding_revision": "string",
      "transport": "string",
      "fleet_id": "string",
      "proof_key": "string",
      "tunnel_key": "string",
      "issued_at": 1,
      "expires_at": 1
    },
    "signature": "string"
  }'

import { Genesis } from '@lifesi/genesis'

const genesis = new Genesis({ apiKey: process.env.GENESIS_API_KEY })
const result = await genesis.call('beacons_enrollBridgeDevice', {
  body: {
    challenge: {
      version: 1,
      id: 'string',
      nonce: 'string',
      issuer: 'string',
      organization: 'string',
      principal: 'string',
      workspace: 'string',
      project: 'string',
      environment: 'string',
      binding_revision: 'string',
      transport: 'string',
      fleet_id: 'string',
      proof_key: 'string',
      tunnel_key: 'string',
      issued_at: 1,
      expires_at: 1,
    },
    signature: 'string',
  },
})

{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "beacons_enrollBridgeDevice",
    "arguments": {
      "body": {
        "challenge": {
          "version": 1,
          "id": "string",
          "nonce": "string",
          "issuer": "string",
          "organization": "string",
          "principal": "string",
          "workspace": "string",
          "project": "string",
          "environment": "string",
          "binding_revision": "string",
          "transport": "string",
          "fleet_id": "string",
          "proof_key": "string",
          "tunnel_key": "string",
          "issued_at": 1,
          "expires_at": 1
        },
        "signature": "string"
      }
    }
  }
}

List bridge devices

GET/v1/beacons/bridge/devices

beacons:readAPI keys refusedbeacons_listBridgeDevices

Responses

200List of bridge devices
Response fields
- dataobject[]
- data[].[].idstringrequired
  Device ID
- data[].[].org_idstringrequired
  Organization ID
- data[].[].namestringrequired
  Device name
- data[].[].nicknamesstring[]required
  Device nicknames
- data[].[].created_atstring (date-time)required
  Creation timestamp
- data[].[].statusstringrequired
  Persisted peer state, or revoking/revoked from durable teardown
401Unauthorized
403Forbidden
4xx 5xxThe error envelope.

curl "https://os.one.ml/api/v1/beacons/bridge/devices" \
  -H "Authorization: Bearer $GENESIS_API_KEY"

import { Genesis } from '@lifesi/genesis'

const genesis = new Genesis({ apiKey: process.env.GENESIS_API_KEY })
const result = await genesis.call('beacons_listBridgeDevices')

{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "beacons_listBridgeDevices",
    "arguments": {}
  }
}

Revoke bridge device

DELETE/v1/beacons/bridge/devices/{id}

beacons:writebeacons_revokeBridgeDevice

Parameters

idpath · stringrequired
Device ID

Responses

202Durable teardown requested; peer acknowledgements are pending
Response fields
- idstringrequired
- status"revoking"required
204Device teardown acknowledged and complete
401Unauthorized
403Forbidden
404Not found
4xx 5xxThe error envelope.

curl -X DELETE "https://os.one.ml/api/v1/beacons/bridge/devices/$ID" \
  -H "Authorization: Bearer $GENESIS_API_KEY"

import { Genesis } from '@lifesi/genesis'

const genesis = new Genesis({ apiKey: process.env.GENESIS_API_KEY })
const result = await genesis.call('beacons_revokeBridgeDevice', {
  id: '<id>',
})

{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "beacons_revokeBridgeDevice",
    "arguments": {
      "id": "<id>"
    }
  }
}

Update bridge device (name, nicknames)

PATCH/v1/beacons/bridge/devices/{id}

beacons:writebeacons_updateBridgeDevice

Parameters

idpath · stringrequired
Device ID

Request body application/json

namestring
Device name
nicknamesstring[]
Device nicknames

Responses

200Updated device
Response fields
- idstringrequired
  Device ID
- org_idstringrequired
  Organization ID
- namestringrequired
  Device name
- nicknamesstring[]required
  Device nicknames
- created_atstring (date-time)required
  Creation timestamp
- statusstringrequired
  Persisted peer state, or revoking/revoked from durable teardown
401Unauthorized
403Forbidden
404Not found
4xx 5xxThe error envelope.

curl -X PATCH "https://os.one.ml/api/v1/beacons/bridge/devices/$ID" \
  -H "Authorization: Bearer $GENESIS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{}'

import { Genesis } from '@lifesi/genesis'

const genesis = new Genesis({ apiKey: process.env.GENESIS_API_KEY })
const result = await genesis.call('beacons_updateBridgeDevice', {
  id: '<id>',
  body: {},
})

{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "beacons_updateBridgeDevice",
    "arguments": {
      "id": "<id>",
      "body": {}
    }
  }
}

Poll durable teardown commands for the enrolled device owner

GET/v1/beacons/bridge/devices/{id}/revocations

beacons:readAPI keys refusedbeacons_listBridgeDeviceRevocations

Parameters

idpath · string (uuid)required

Responses

200Durable commands
Response fields
- dataobject[]required
- data[].[].versioninteger (int64)required
- data[].[].fleet_idstringrequired
- data[].[].target_peer_idstringrequired
- data[].[].target_didstringrequired
- data[].[].target_public_keyinteger[]required
- data[].[].required_ack_peer_idsstring[]required
- data[].[].acknowledgementsobject[]required
- data[].[].acknowledgements[].[].acknowledging_peer_idstringrequired
- data[].[].acknowledgements[].[].action"interface_torn_down" | "peer_key_removed"required
- data[].[].acknowledgements[].[].acknowledged_atstringrequired
- data[].[].requested_atstringrequired
- data[].[].completed_atstring | null
- data[].[].finalized_atstring | null
404Not found
4xx 5xxThe error envelope.

curl "https://os.one.ml/api/v1/beacons/bridge/devices/$ID/revocations" \
  -H "Authorization: Bearer $GENESIS_API_KEY"

import { Genesis } from '@lifesi/genesis'

const genesis = new Genesis({ apiKey: process.env.GENESIS_API_KEY })
const result = await genesis.call('beacons_listBridgeDeviceRevocations', {
  id: '<id>',
})

{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "beacons_listBridgeDeviceRevocations",
    "arguments": {
      "id": "<id>"
    }
  }
}

Acknowledge an applied transport teardown action

POST/v1/beacons/bridge/devices/{id}/revocations/{version}/ack

beacons:writebeacons_acknowledgeBridgeDeviceRevocation

The enrolled owner must apply the actual interface or peer-key change before acknowledgement. Complete mesh state removal requires every peer in the durable barrier.

Parameters

idpath · string (uuid)required
versionpath · integerrequired

Request body application/json

action"interface_torn_down" | "peer_key_removed"required

Responses

200Persisted acknowledgement
Response fields
- dataobjectrequired
- data.versioninteger (int64)required
- data.fleet_idstringrequired
- data.target_peer_idstringrequired
- data.target_didstringrequired
- data.target_public_keyinteger[]required
- data.required_ack_peer_idsstring[]required
- data.acknowledgementsobject[]required
- data.acknowledgements[].[].acknowledging_peer_idstringrequired
- data.acknowledgements[].[].action"interface_torn_down" | "peer_key_removed"required
- data.acknowledgements[].[].acknowledged_atstringrequired
- data.requested_atstringrequired
- data.completed_atstring | null
- data.finalized_atstring | null
404Not found
409Peer or transport action does not match the command
4xx 5xxThe error envelope.

curl -X POST "https://os.one.ml/api/v1/beacons/bridge/devices/$ID/revocations/$VERSION/ack" \
  -H "Authorization: Bearer $GENESIS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "action": "interface_torn_down"
  }'

import { Genesis } from '@lifesi/genesis'

const genesis = new Genesis({ apiKey: process.env.GENESIS_API_KEY })
const result = await genesis.call('beacons_acknowledgeBridgeDeviceRevocation', {
  id: '<id>',
  version: '<version>',
  body: {
    action: 'interface_torn_down',
  },
})

{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "beacons_acknowledgeBridgeDeviceRevocation",
    "arguments": {
      "id": "<id>",
      "version": "<version>",
      "body": {
        "action": "interface_torn_down"
      }
    }
  }
}

Create or reuse first-fleet metadata in the verified Beacons selection

POST/v1/beacons/bridge/fleets/provision

beacons:writeAPI keys refusedIdempotency-Key requiredbeacons_provisionBridgeFleet

Requires a fresh human Beacons write decision and operator-provisioned standing. Creates fleet and scope metadata only; does not enroll a device or establish a billing entitlement. Reuse the same Idempotency-Key and name on retry. Body and scope conflicts return 409.

Parameters

Idempotency-Keyheader · string (uuid)required
One nonzero UUID, reused for an identical retry.

Request body application/json

namestring
Nonempty name, at most 256 UTF-8 bytes; defaults to Beacons Bridge. max length 256

Responses

200Persisted metadata receipt
Response fields
- dataobjectrequired
- data.fleet_idstring (uuid)required
- data.organization_idstring (uuid)required
- data.workspace_idstring (uuid)required
- data.project_idstring (uuid)required
- data.environment_idstring (uuid)required
- data.metadata_onlytruerequired
400Invalid request or idempotency key
401Unauthorized
404Not found
409Existing metadata or receipt conflicts with the request
503Producer or verified standing is unavailable
4xx 5xxThe error envelope.

curl -X POST "https://os.one.ml/api/v1/beacons/bridge/fleets/provision" \
  -H "Authorization: Bearer $GENESIS_API_KEY" \
  -H "Idempotency-Key: $IDEMPOTENCY_KEY" \
  -H "Content-Type: application/json" \
  -d '{}'

import { Genesis } from '@lifesi/genesis'

const genesis = new Genesis({ apiKey: process.env.GENESIS_API_KEY })
const idempotencyKey = '<a stable key per change>'
const result = await genesis.call('beacons_provisionBridgeFleet', {
  body: {},
}, {
  headers: { 'Idempotency-Key': idempotencyKey }, // one key per change, reused on every retry
})

{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "beacons_provisionBridgeFleet",
    "arguments": {
      "body": {},
      "idempotency_key": "<a stable key per change>"
    }
  }
}

Dashboard

List actual fleets in the current human-authorized Sandbox selection

GET/v1/beacons/dashboard/fleets

beacons:readAPI keys refusedbeacons_listDashboardFleets

Uses the original verified Genesis human parent and current server-authorized organization, workspace, project and environment. No query or caller tenant identifiers. Requires current beacons:read; unavailable or unauthorized data is an error, not an invented empty inventory.

Responses

200Persisted fleets in the exact authorized selection
Response fields
- dataobject[]required
- data[].[].idstring (uuid)required
- data[].[].namestringrequired
- data[].[].scopeobjectrequired
- data[].[].scope.platform_id"beacons"required
- data[].[].scope.organization_idstringrequired
  Current canonical One account organization; not a physical storage UUID.
- data[].[].scope.workspace_idstringrequired
  Current server-authorized workspace.
- data[].[].scope.project_idstringrequired
  Current server-authorized project.
- data[].[].scope.environment_id"sandbox"required
- data[].[].created_atstring (date-time)required
401The original current human parent, permission or sealed request admission was refused
503Native admission, standing or backend is unavailable
4xx 5xxThe error envelope.

curl "https://os.one.ml/api/v1/beacons/dashboard/fleets" \
  -H "Authorization: Bearer $GENESIS_API_KEY"

import { Genesis } from '@lifesi/genesis'

const genesis = new Genesis({ apiKey: process.env.GENESIS_API_KEY })
const result = await genesis.call('beacons_listDashboardFleets')

{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "beacons_listDashboardFleets",
    "arguments": {}
  }
}

Rename the actual fleet in the current authorized selection

PATCH/v1/beacons/dashboard/fleets/{fleet_id}

beacons:writeAPI keys refusedbeacons_updateDashboardFleet

Current beacons:write and exact server-side fleet custody are required. This changes only the fleet name; caller scope or membership fields are refused.

Parameters

fleet_idpath · stringrequired

Request body application/json

namestringrequired
Nonempty after trimming; at most 128 UTF-8 bytes and no control characters. min length 1 · max length 128

Responses

200Actual persisted renamed fleet
Response fields
- dataobjectrequired
- data.idstring (uuid)required
- data.namestringrequired
- data.scopeobjectrequired
- data.scope.platform_id"beacons"required
- data.scope.organization_idstringrequired
  Current canonical One account organization; not a physical storage UUID.
- data.scope.workspace_idstringrequired
  Current server-authorized workspace.
- data.scope.project_idstringrequired
  Current server-authorized project.
- data.scope.environment_id"sandbox"required
- data.created_atstring (date-time)required
400Invalid name, body or query
401The original current human parent, permission or sealed request admission was refused
404Fleet is absent or outside the exact authorized selection
503Native admission, standing or backend is unavailable
4xx 5xxThe error envelope.

curl -X PATCH "https://os.one.ml/api/v1/beacons/dashboard/fleets/$FLEET_ID" \
  -H "Authorization: Bearer $GENESIS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "string"
  }'

import { Genesis } from '@lifesi/genesis'

const genesis = new Genesis({ apiKey: process.env.GENESIS_API_KEY })
const result = await genesis.call('beacons_updateDashboardFleet', {
  fleet_id: '<fleet_id>',
  body: {
    name: 'string',
  },
})

{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "beacons_updateDashboardFleet",
    "arguments": {
      "fleet_id": "<fleet_id>",
      "body": {
        "name": "string"
      }
    }
  }
}

List actual peers and durable revocation state for an authorized fleet

GET/v1/beacons/dashboard/fleets/{fleet_id}/peers

beacons:readAPI keys refusedbeacons_listDashboardPeers

Requires current beacons:read and complete fleet/peer custody. Mesh fields are null when no actual mesh state exists. Revoked means both completion and finalization are durable; this is not a live transport probe.

Parameters

fleet_idpath · stringrequired

Responses

200Actual scoped persisted peers
Response fields
- dataobject[]required
- data[].[].idstring (uuid)required
- data[].[].peer_idstring (uuid)required
- data[].[].fleet_idstring (uuid)required
- data[].[].didstringrequired
- data[].[].transportstringrequired
- data[].[].peer_kindstringrequired
- data[].[].principal_idstring | nullrequired
- data[].[].principal_kindstring | nullrequired
- data[].[].owner_idstring | nullrequired
- data[].[].scopeobjectrequired
- data[].[].scope.platform_id"beacons"required
- data[].[].scope.organization_idstringrequired
  Current canonical One account organization; not a physical storage UUID.
- data[].[].scope.workspace_idstringrequired
  Current server-authorized workspace.
- data[].[].scope.project_idstringrequired
  Current server-authorized project.
- data[].[].scope.environment_id"sandbox"required
- data[].[].enrolled_atstring (date-time)required
- data[].[].statusstringrequired
  Actual persisted status; revoking while the durable barrier is pending and revoked after completion and finalization.
- data[].[].assigned_ipstring | nullrequired
- data[].[].public_keystring | nullrequired
  Public tunnel key in canonical unpadded base64url; never a private key.
- data[].[].dns_namestring | nullrequired
- data[].[].coordinator_endpointstring | nullrequired
401The original current human parent, permission or sealed request admission was refused
404Fleet is absent or outside the exact authorized selection
503Native admission, standing or backend is unavailable
4xx 5xxThe error envelope.

curl "https://os.one.ml/api/v1/beacons/dashboard/fleets/$FLEET_ID/peers" \
  -H "Authorization: Bearer $GENESIS_API_KEY"

import { Genesis } from '@lifesi/genesis'

const genesis = new Genesis({ apiKey: process.env.GENESIS_API_KEY })
const result = await genesis.call('beacons_listDashboardPeers', {
  fleet_id: '<fleet_id>',
})

{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "beacons_listDashboardPeers",
    "arguments": {
      "fleet_id": "<fleet_id>"
    }
  }
}

Read actual admission policy, including whether it has ever been saved

GET/v1/beacons/dashboard/fleets/{fleet_id}/policy

beacons:readAPI keys refusedbeacons_getDashboardPolicy

Requires current beacons:read and exact fleet custody. An unsaved policy reports source default and updated_at null. Legacy or invalid stored configuration is refused without exposing it.

Parameters

fleet_idpath · stringrequired

Responses

200Actual policy or explicit unsaved default
Response fields
- dataobjectrequired
- data.fleet_idstring (uuid)required
- data.configobjectrequired
- data.config.device_enrollment"allowed_with_permission" | "paused"required
- data.config.max_devicesinteger
  Optional cap; omit to save without a cap. Null is refused. min 1 · max 10000
- data.source"default" | "persisted"required
- data.updated_atstring | null (date-time)required
  Null for an unsaved default; actual database timestamp for persisted state.
- data.scopeobjectrequired
- data.scope.platform_id"beacons"required
- data.scope.organization_idstringrequired
  Current canonical One account organization; not a physical storage UUID.
- data.scope.workspace_idstringrequired
  Current server-authorized workspace.
- data.scope.project_idstringrequired
  Current server-authorized project.
- data.scope.environment_id"sandbox"required
401The original current human parent, permission or sealed request admission was refused
404Fleet is absent or outside the exact authorized selection
409Existing stored policy is invalid
503Native admission, standing or backend is unavailable
4xx 5xxThe error envelope.

curl "https://os.one.ml/api/v1/beacons/dashboard/fleets/$FLEET_ID/policy" \
  -H "Authorization: Bearer $GENESIS_API_KEY"

import { Genesis } from '@lifesi/genesis'

const genesis = new Genesis({ apiKey: process.env.GENESIS_API_KEY })
const result = await genesis.call('beacons_getDashboardPolicy', {
  fleet_id: '<fleet_id>',
})

{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "beacons_getDashboardPolicy",
    "arguments": {
      "fleet_id": "<fleet_id>"
    }
  }
}

Save the closed fleet policy enforced by future device admissions

PUT/v1/beacons/dashboard/fleets/{fleet_id}/policy

beacons:writeAPI keys refusedbeacons_updateDashboardPolicy

Requires current beacons:write and exact fleet custody. Replaces the complete admission policy under the fleet lock. Omit max_devices to remove the device cap. Pausing never revokes an existing device or grants IAM rights; enrollment still requires independent current WRITE plus ENROLL.

Parameters

fleet_idpath · stringrequired

Request body application/json

configobjectrequired
config.device_enrollment"allowed_with_permission" | "paused"required
config.max_devicesinteger
Optional cap; omit to save without a cap. Null is refused. min 1 · max 10000

Responses

200Re-read persisted policy with actual saved timestamp
Response fields
- dataobjectrequired
- data.fleet_idstring (uuid)required
- data.configobjectrequired
- data.config.device_enrollment"allowed_with_permission" | "paused"required
- data.config.max_devicesinteger
  Optional cap; omit to save without a cap. Null is refused. min 1 · max 10000
- data.source"default" | "persisted"required
- data.updated_atstring | null (date-time)required
  Null for an unsaved default; actual database timestamp for persisted state.
- data.scopeobjectrequired
- data.scope.platform_id"beacons"required
- data.scope.organization_idstringrequired
  Current canonical One account organization; not a physical storage UUID.
- data.scope.workspace_idstringrequired
  Current server-authorized workspace.
- data.scope.project_idstringrequired
  Current server-authorized project.
- data.scope.environment_id"sandbox"required
400Unknown or duplicate fields, invalid enum, null or non-integer/out-of-range device limit, or query
401The original current human parent, permission or sealed request admission was refused
404Fleet is absent or outside the exact authorized selection
409Current receipt, custody or stored policy conflicts
503Native admission, standing or backend is unavailable
4xx 5xxThe error envelope.

curl -X PUT "https://os.one.ml/api/v1/beacons/dashboard/fleets/$FLEET_ID/policy" \
  -H "Authorization: Bearer $GENESIS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "config": {
      "device_enrollment": "allowed_with_permission"
    }
  }'

import { Genesis } from '@lifesi/genesis'

const genesis = new Genesis({ apiKey: process.env.GENESIS_API_KEY })
const result = await genesis.call('beacons_updateDashboardPolicy', {
  fleet_id: '<fleet_id>',
  body: {
    config: {
      device_enrollment: 'allowed_with_permission',
    },
  },
})

{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "beacons_updateDashboardPolicy",
    "arguments": {
      "fleet_id": "<fleet_id>",
      "body": {
        "config": {
          "device_enrollment": "allowed_with_permission"
        }
      }
    }
  }
}

One Superintelligence, Inc. · Built from Genesis 0.1.12 and the live gateway on 2026-10-20. Support