curl --request POST \
--url https://app.stockshift.io/api/v1/apps/signatures \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"action": "devices.wipe",
"assertion": "eyJ0eXAiOiJkZXZpY2Utc2lnbmF0dXJlK2p3dCIsImFsZyI6IkVTMjU2In0.eyJzdWIiOiI3In0.c2lnbmF0dXJl"
}
'import requests
url = "https://app.stockshift.io/api/v1/apps/signatures"
payload = {
"action": "devices.wipe",
"assertion": "eyJ0eXAiOiJkZXZpY2Utc2lnbmF0dXJlK2p3dCIsImFsZyI6IkVTMjU2In0.eyJzdWIiOiI3In0.c2lnbmF0dXJl"
}
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://app.stockshift.io/api/v1/apps/signatures",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'action' => 'devices.wipe',
'assertion' => 'eyJ0eXAiOiJkZXZpY2Utc2lnbmF0dXJlK2p3dCIsImFsZyI6IkVTMjU2In0.eyJzdWIiOiI3In0.c2lnbmF0dXJl'
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://app.stockshift.io/api/v1/apps/signatures"
payload := strings.NewReader("{\n \"action\": \"devices.wipe\",\n \"assertion\": \"eyJ0eXAiOiJkZXZpY2Utc2lnbmF0dXJlK2p3dCIsImFsZyI6IkVTMjU2In0.eyJzdWIiOiI3In0.c2lnbmF0dXJl\"\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}{
"data": {
"token": "<string>",
"expires_at": "<string>",
"method": "device_pin"
}
}{
"type": "<string>",
"title": "<string>",
"status": 123,
"code": "<string>",
"detail": "<string>",
"errors": {},
"feature": "<string>",
"reason": "<string>",
"attempts_left": 123,
"rule_ids": [
"<string>"
],
"witness": "<string>",
"blind_recount": true,
"flags": [
{
"flag": "<string>",
"facts": {},
"choices": [
"<string>"
]
}
]
}{
"type": "<string>",
"title": "<string>",
"status": 123,
"code": "<string>",
"detail": "<string>",
"errors": {},
"feature": "<string>",
"reason": "<string>",
"attempts_left": 123,
"rule_ids": [
"<string>"
],
"witness": "<string>",
"blind_recount": true,
"flags": [
{
"flag": "<string>",
"facts": {},
"choices": [
"<string>"
]
}
]
}{
"type": "<string>",
"title": "<string>",
"status": 123,
"code": "<string>",
"detail": "<string>",
"errors": {},
"feature": "<string>",
"reason": "<string>",
"attempts_left": 123,
"rule_ids": [
"<string>"
],
"witness": "<string>",
"blind_recount": true,
"flags": [
{
"flag": "<string>",
"facts": {},
"choices": [
"<string>"
]
}
]
}{
"type": "<string>",
"title": "<string>",
"status": 123,
"code": "<string>",
"detail": "<string>",
"errors": {},
"feature": "<string>",
"reason": "<string>",
"attempts_left": 123,
"rule_ids": [
"<string>"
],
"witness": "<string>",
"blind_recount": true,
"flags": [
{
"flag": "<string>",
"facts": {},
"choices": [
"<string>"
]
}
]
}{
"type": "<string>",
"title": "<string>",
"status": 123,
"code": "<string>",
"detail": "<string>",
"errors": {},
"feature": "<string>",
"reason": "<string>",
"attempts_left": 123,
"rule_ids": [
"<string>"
],
"witness": "<string>",
"blind_recount": true,
"flags": [
{
"flag": "<string>",
"facts": {},
"choices": [
"<string>"
]
}
]
}{
"type": "<string>",
"title": "<string>",
"status": 123,
"code": "<string>",
"detail": "<string>",
"errors": {},
"feature": "<string>",
"reason": "<string>",
"attempts_left": 123,
"rule_ids": [
"<string>"
],
"witness": "<string>",
"blind_recount": true,
"flags": [
{
"flag": "<string>",
"facts": {},
"choices": [
"<string>"
]
}
]
}{
"type": "<string>",
"title": "<string>",
"status": 123,
"code": "<string>",
"detail": "<string>",
"errors": {},
"feature": "<string>",
"reason": "<string>",
"attempts_left": 123,
"rule_ids": [
"<string>"
],
"witness": "<string>",
"blind_recount": true,
"flags": [
{
"flag": "<string>",
"facts": {},
"choices": [
"<string>"
]
}
]
}Sign with a PIN on a device
The pin signing level: the member picks their own name on
the device, with nothing preselected, and enters their signing PIN.
The app checks it against the member’s verifier on the device. The
PIN never reaches the server. The app then calls this with that
member’s own access token from this device. It adds a DPoP proof from
the device key carrying the server’s nonce and an assertion the device
key signed. The answer is a signing token for the Action, good for five
minutes and once, with the method device_pin. Send it as the
Signature-Token header of the signed request, with the same access
token. The answer carries a fresh DPoP-Nonce for the next signature.
Refusals: use_dpop_nonce (400) when the proof lacks the current
nonce, with the nonce to sign again with. invalid_dpop_proof (400)
when the proof is not valid or not signed by this device’s key.
session_expired (401) when the member has no live session on the
device. device_revoked (401) and device_wiped (410) for a device
that may no longer be used. 422 when the action is no signed Action.
404 for a token that was not issued to an app. A refused assertion is
signature_assertion_invalid (400) with attempts_left. It is
audited and counts toward the member’s lock on the device like a
wrong PIN. The fifth in a row ends the member’s sessions on the device
(pin_locked), so they sign in on the web again. A signature that
succeeds starts the count again. Each refusal, and the lock, alerts
the people who review signatures.
curl --request POST \
--url https://app.stockshift.io/api/v1/apps/signatures \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"action": "devices.wipe",
"assertion": "eyJ0eXAiOiJkZXZpY2Utc2lnbmF0dXJlK2p3dCIsImFsZyI6IkVTMjU2In0.eyJzdWIiOiI3In0.c2lnbmF0dXJl"
}
'import requests
url = "https://app.stockshift.io/api/v1/apps/signatures"
payload = {
"action": "devices.wipe",
"assertion": "eyJ0eXAiOiJkZXZpY2Utc2lnbmF0dXJlK2p3dCIsImFsZyI6IkVTMjU2In0.eyJzdWIiOiI3In0.c2lnbmF0dXJl"
}
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://app.stockshift.io/api/v1/apps/signatures",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'action' => 'devices.wipe',
'assertion' => 'eyJ0eXAiOiJkZXZpY2Utc2lnbmF0dXJlK2p3dCIsImFsZyI6IkVTMjU2In0.eyJzdWIiOiI3In0.c2lnbmF0dXJl'
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://app.stockshift.io/api/v1/apps/signatures"
payload := strings.NewReader("{\n \"action\": \"devices.wipe\",\n \"assertion\": \"eyJ0eXAiOiJkZXZpY2Utc2lnbmF0dXJlK2p3dCIsImFsZyI6IkVTMjU2In0.eyJzdWIiOiI3In0.c2lnbmF0dXJl\"\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}{
"data": {
"token": "<string>",
"expires_at": "<string>",
"method": "device_pin"
}
}{
"type": "<string>",
"title": "<string>",
"status": 123,
"code": "<string>",
"detail": "<string>",
"errors": {},
"feature": "<string>",
"reason": "<string>",
"attempts_left": 123,
"rule_ids": [
"<string>"
],
"witness": "<string>",
"blind_recount": true,
"flags": [
{
"flag": "<string>",
"facts": {},
"choices": [
"<string>"
]
}
]
}{
"type": "<string>",
"title": "<string>",
"status": 123,
"code": "<string>",
"detail": "<string>",
"errors": {},
"feature": "<string>",
"reason": "<string>",
"attempts_left": 123,
"rule_ids": [
"<string>"
],
"witness": "<string>",
"blind_recount": true,
"flags": [
{
"flag": "<string>",
"facts": {},
"choices": [
"<string>"
]
}
]
}{
"type": "<string>",
"title": "<string>",
"status": 123,
"code": "<string>",
"detail": "<string>",
"errors": {},
"feature": "<string>",
"reason": "<string>",
"attempts_left": 123,
"rule_ids": [
"<string>"
],
"witness": "<string>",
"blind_recount": true,
"flags": [
{
"flag": "<string>",
"facts": {},
"choices": [
"<string>"
]
}
]
}{
"type": "<string>",
"title": "<string>",
"status": 123,
"code": "<string>",
"detail": "<string>",
"errors": {},
"feature": "<string>",
"reason": "<string>",
"attempts_left": 123,
"rule_ids": [
"<string>"
],
"witness": "<string>",
"blind_recount": true,
"flags": [
{
"flag": "<string>",
"facts": {},
"choices": [
"<string>"
]
}
]
}{
"type": "<string>",
"title": "<string>",
"status": 123,
"code": "<string>",
"detail": "<string>",
"errors": {},
"feature": "<string>",
"reason": "<string>",
"attempts_left": 123,
"rule_ids": [
"<string>"
],
"witness": "<string>",
"blind_recount": true,
"flags": [
{
"flag": "<string>",
"facts": {},
"choices": [
"<string>"
]
}
]
}{
"type": "<string>",
"title": "<string>",
"status": 123,
"code": "<string>",
"detail": "<string>",
"errors": {},
"feature": "<string>",
"reason": "<string>",
"attempts_left": 123,
"rule_ids": [
"<string>"
],
"witness": "<string>",
"blind_recount": true,
"flags": [
{
"flag": "<string>",
"facts": {},
"choices": [
"<string>"
]
}
]
}{
"type": "<string>",
"title": "<string>",
"status": 123,
"code": "<string>",
"detail": "<string>",
"errors": {},
"feature": "<string>",
"reason": "<string>",
"attempts_left": 123,
"rule_ids": [
"<string>"
],
"witness": "<string>",
"blind_recount": true,
"flags": [
{
"flag": "<string>",
"facts": {},
"choices": [
"<string>"
]
}
]
}Authorizations
How the StockShift apps sign in. The app opens /apps/authorize in the system browser with a PKCE S256 challenge and the thumbprint of its device key. The member signs in there, with every check the web enforces. The browser returns a code to the app, which trades it at POST /apps/token with the PKCE verifier and a DPoP proof (RFC 9449) signed by the device key. The answer holds an access token of one hour, which is sent as a bearer token on every call, and a rotating refresh token of 30 days. A refresh needs a DPoP proof with the server's latest nonce, so a stolen refresh token is useless without the device key. A session ends 180 days after sign-in at most. Every app request carries StockShift-Client: / (), such as ios/1.4.2 (311). Below the minimum of GET /apps/version-policy a call is answered 426 client_upgrade_required with the minimum and the store link. Below the deprecated-below version it works and the response adds StockShift-Client-Deprecated: sunset=; minimum=. Signing in and out, the device status, wipe receipt and PIN lock calls and the version policy answer every version.
Body
A PIN signature from a device: the signed Action and the assertion the device key signed, with a DPoP proof in the DPoP header.
The Action to sign, by its public name, as named to POST /api/v1/access/signatures/start.
devices.wipe, engineering.ecos.approve, inventory.periods.reopen, inventory.verifications.request, inventory.verifications.witness, sales.certificates.sign, sales.shipments.post-certified "devices.wipe"
The device-signature+jwt the device key signed once the PIN was checked: sub, device, act, meaning, digest, pin, iat and jti.
8192"eyJ0eXAiOiJkZXZpY2Utc2lnbmF0dXJlK2p3dCIsImFsZyI6IkVTMjU2In0.eyJzdWIiOiI3In0.c2lnbmF0dXJl"
Response
DeviceSignatureResource
Show child attributes
Show child attributes
Was this page helpful?