---
title: "Bootstrap Agent Identity from Kubernetes"
method: POST
path: "/auth/bootstrap/kubernetes"
tags: ["Bootstrap"]
---

# Bootstrap Agent Identity from Kubernetes

`POST /auth/bootstrap/kubernetes`

Bootstrap an agent identity using a Kubernetes Service Account Token (SAT).
This allows agents running in Kubernetes to automatically obtain cryptographic identities.

## Request body

- KubernetesBootstrapRequest
  - `sat` string, required — Kubernetes Service Account Token

## Response `200`

Agent identity bootstrapped successfully

- BootstrapResponse
  - `agent_id` string
  - `private_key_b64` string, base64 — Base64 encoded private key (returned only once)
  - `public_key_b64` string, base64 — Base64 encoded public key

## Other responses

- `400` — Bad Request - Invalid input parameters
- `401` — Token validation failed
- `403` — Policy not found for this workload
- `500` — Internal Server Error - Unexpected server error

---

[API](https://skmtc.net/deeptrail/apis/deepsecure-api-dual-service-architecture.md) · [All operations](https://skmtc.net/deeptrail/apis/deepsecure-api-dual-service-architecture/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/deeptrail/deepsecure-api-dual-service-architecture/versions/78627360c082/schema)