First-run setup
Creates the first super admin once. Public and served before setup; rate limited to 10 per 15 minutes per IP. When the operator set SETUP_TOKEN the body must carry the same setupToken.
Try the REST routes against the public demo at https://demostash.aldyernesto.my.id. Get a read-only token (valid for 60 minutes), then paste it as the Bearer token in the console of any route.
Creates the first super admin once. Public and served before setup; rate limited to 10 per 15 minutes per IP. When the operator set SETUP_TOKEN the body must carry the same setupToken.
application/json- body
name*stringDisplay name, 1 to 80 characters.
email*stringAccount email.
password*stringPassword, 10 to 256 characters.
confirm*stringThe same password again.
setupToken?|Required when the operator set SETUP_TOKEN: the same value.
Super admin created and setup complete
application/json- response
ok*trueAlways true.
truecurl -X POST "https://example.com/api/v1/setup" \ -H "Content-Type: application/json" \ -d '{ "name": "string", "email": "string", "password": "string", "confirm": "string" }'{ "ok": true}Runtime config GET
Public settings the browser needs (app URL and Google client id and feature switches and version and default locale). Public and served before setup; never carries a secret.
Instance status GET
Version and storage and database and cache and search and the processing queue for the status page. Only for accounts that may configure the instance; everyone else gets 404.