Docs

Re-arm a demo box

A Roost box watches a sensing mesh around its signing boards. When the mesh is cut, a feedthrough is disturbed or the lid is opened, the box erases the keys that unlock its signing keys. Production boxes stay erased and are reinstalled at the factory.

A demo box can be brought back into service on site. The owner of the organization confirms the re-arm with a passkey seal, and Axowl returns a re-arm ticket that only that box, for that one attempt, accepts.

Re-arm flow

1. Replace the mesh cartridge on the box.
2. On the box controller run rearm_client.py nonce. The box prints its box ID and a one-time number (nonce), plus a link to /dashboard/{slug}/roost-rearm?box=…&nonce=….
3. The organization Owner opens that page and seals. The seal is bound to the organization, the box ID and the nonce.
4. Axowl returns the ticket. Enter it on the box with rearm_client.py apply --ticket <ticket> within 10 minutes.
5. The box checks the ticket signature, its own box ID and the nonce, then creates new keys. Each signing board enrolls again and the new signers are registered.

Endpoints

POST /api/org/{slug}/roost/rearm-ticket

• box — 4 to 40 characters of A–Z, 0–9 and -, exactly as the box prints it.
• nonce — 32 lowercase hex characters, exactly as the box prints it.
• stepUpAssertion — a passkey step-up with purpose roost.rearm and subject StepUpPurpose.RoostRearmSubject(slug, box, nonce) . Request the challenge from POST /api/passkey/stepup/options with that purpose and subject. A seal made for another box or another nonce is rejected.

Response 200:

{
  "ticket": "eyJ2IjoxLCJ0eXAiOi....Qc2NMSUK...",
  "box": "ROOST-0001",
  "nonce": "404142434445464748494a4b4c4d4e4f",
  "expiresAt": "2026-10-18T09:10:00Z",
  "keyFingerprint": "SHA256:…"
}

Every issued ticket is recorded as the audit event roost.rearm.ticket_issued with the box ID, nonce, expiry, key fingerprint and the seal proof (see the Axowl audit reference).