hosting

POST `/v1/private-network/devices`

Enrol a device and return its configuration once.

Authentication

Send an API key as a bearer token. The key must carry the network.private.manage permission; a key without it is refused with 403, not 404.

This endpoint takes no organisation id. Your key already identifies the organisation it belongs to, and the response is scoped to it.

Try it

Replace anything in angle brackets with your own values, and the key placeholder with a key from your dashboard.

curl -X POST https://api.zinndigital.com/v1/private-network/devices \
  -H "Authorization: Bearer zdk_live_…" \
  -H "Content-Type: application/json" \
  -d '{ "label": <string> }'

Signed in? The API console in your dashboard fills in your real organisation id and your own key, and runs the request against the live API so you can see the actual response. Open this endpoint in the API console

Details

Gated on network.private.manage in addition to sites.view. ⛔⛔ The config in the response is shown ONCE and can never be retrieved again. The private key is generated in memory and is never stored — not in the database and not in Vault — so there is no endpoint that could return it a second time. A customer who loses it rotates the device, which is the correct handling of a lost secret. 422 when the device allowance is spent, when the label is blank, or when the organisation's dedicated address has not finished being assigned.

Request body

Name	Type	Required	What it is
`label`	`string`	Yes	—

Response

Name	Type	Required	What it is
`seat`	`PrivateNetworkDevice`	Yes	—
`config`	`string`	Yes	The complete WireGuard configuration file. ⛔⛔ Returned ONCE, on this response only. It contains the device's private key, which is generated in memory and never stored anywhere by…

Errors this endpoint can return

401 · 403 · 404 · 422

POST /v1/private-network/devices