Complete the approved website setup without the dashboard.

1. Start owner enrollment

Choose only the scopes required for this setup. Enrollment does not permit credential management.

curl --fail-with-body https://issueprobe.com/v1/agent-enrollments \
  -H 'Content-Type: application/json' \
  -H 'Idempotency-Key: setup-owner-example-001' \
  -H 'X-IssueProbe-Client: setup-agent-example' \
  --data '{
    "ownerEmail": "[email protected]",
    "accountName": "Example account",
    "agentName": "website-setup-agent",
    "scopes": [
      "websites:write",
      "websites:read",
      "reports:read",
      "reports:write",
      "audit:read",
      "billing:checkout"
    ]
  }'

The neutral response contains an enrollment identifier, one exchange secret, and a seven-day expiry.

2. Preserve the exchange secret

Save the exchange secret in the caller's approved secret location before the process ends. Do not put it in a URL, email, log, commit, or issue.

An exact retry with the same client identifier, idempotency key, and request can recover the same unused secret while the enrollment remains pending or approved. A changed retry fails.

3. Wait for owner approval

IssueProbe emails the owner one authorization link. A link GET cannot approve the request. The owner reviews the account name, agent name, and exact scopes, then uses an explicit POST to approve or reject.

Do not send repeated enrollment requests while you wait. Ask the owner through the existing trusted channel that started the setup.

4. Exchange once for a credential

After approval, exchange the preserved secret once.

curl --fail-with-body https://issueprobe.com/v1/agent-enrollments/ENROLLMENT_ID/exchange \
  -H 'Content-Type: application/json' \
  --data '{"exchangeSecret":"COPY_THE_EXCHANGE_SECRET"}'

The response shows one scoped API credential once. Store it safely. A repeated exchange fails without a second credential. The issued credential expires after 90 days.

5. Register the website, origin, and SSH repository

Use the credential as a bearer value. Register one root origin and one SSH repository location.

curl --fail-with-body https://issueprobe.com/v1/websites \
  -H 'Authorization: Bearer YOUR_API_CREDENTIAL' \
  -H 'Content-Type: application/json' \
  --data '{
    "name": "Example Site",
    "primaryOrigin": "https://www.example.com",
    "position": "right",
    "repository": {
      "sshUrl": "[email protected]:owner/site.git",
      "defaultBranch": "main",
      "hostKeyFingerprint": "SHA256:VERIFIED_HOST_FINGERPRINT"
    }
  }'

Omit deployedRevision to use branch-head mode. Supply one hexadecimal revision only when the owner requires pinned mode.

The response contains the public widget key and the public deploy key. It never contains a private repository key.

6. Add and verify the exact origin

Read the website detail. Each pending origin includes one exact HTTPS verification URL and one 64-character public text value.

curl --fail-with-body https://issueprobe.com/v1/websites/WEBSITE_ID \
  -H 'Authorization: Bearer YOUR_API_CREDENTIAL'

# Publish the returned verification.content as the complete text at verification.url.
# The file can end with one newline. Do not use a redirect.

curl --fail-with-body https://issueprobe.com/v1/websites/WEBSITE_ID/origins/ORIGIN_ID/verify \
  -H 'Authorization: Bearer YOUR_API_CREDENTIAL' \
  -H 'Content-Type: application/json' \
  --data '{"method":"well_known"}'

The verification text is public placement content, not a credential. A widget key or caller-supplied Origin header cannot replace it.

Paths, credentials, query values, fragments, HTTP origins, redirects, and different file content fail verification.

7. Add the public deploy key

Add the returned public key to the registered repository with read-only access. Use one key for this website only. Do not grant write authority.

Keep the verified SHA-256 host fingerprint in the website setup. Remove an old public key after a rotation.

8. Check repository and website readiness

curl --fail-with-body https://issueprobe.com/v1/websites/WEBSITE_ID/repository/check \
  -X POST \
  -H 'Authorization: Bearer YOUR_API_CREDENTIAL' \
  -H 'Content-Type: application/json' \
  --data '{}'

curl --fail-with-body https://issueprobe.com/v1/websites/WEBSITE_ID/readiness \
  -H 'Authorization: Bearer YOUR_API_CREDENTIAL'

Continue only when the origin, repository, and widget checks report ready.

In branch-head mode, run the repository check after each deployment. Each successful check records the current remote branch head. Pinned mode keeps the owner-supplied revision.

9. Install the widget

Set the required evidence categories through the fixed schema. A category can be disabled, but no setting can enable browser-state values.

curl --fail-with-body https://issueprobe.com/v1/websites/WEBSITE_ID/evidence-settings \
  -X PUT \
  -H 'Authorization: Bearer YOUR_API_CREDENTIAL' \
  -H 'Content-Type: application/json' \
  --data '{"screenshot":true,"console":true,"network":true,"browserStateMetadata":true}'

curl --fail-with-body https://issueprobe.com/v1/websites/WEBSITE_ID/install \
  -H 'Authorization: Bearer YOUR_API_CREDENTIAL'

Place the returned script on the verified website. Its public widget key grants no account or repository access.

10. Submit a safe test report

Create a JSON file named test-report.json with no private values.

{
  "websiteKey": "PUBLIC_WIDGET_KEY",
  "type": "problem",
  "description": "The profile save button does not finish.",
  "page": {
    "url": "https://www.example.com/profile",
    "title": "Profile",
    "locale": "en-US",
    "timeZone": "UTC",
    "viewport": {"width": 1440, "height": 900}
  },
  "console": [],
  "network": [],
  "browserState": {"cookies": [], "formFields": [], "localStorage": []},
  "consent": {"screenshot": false, "evidence": true}
}

curl --fail-with-body 'https://issueprobe.com/v1/public/reports?websiteKey=PUBLIC_WIDGET_KEY' \
  -H 'Origin: https://www.example.com' \
  -H 'Idempotency-Key: safe-test-report-001' \
  -H 'X-IssueProbe-Client: setup-agent-example' \
  -F 'payload=<test-report.json'

Cookie, form, and local-storage entries can contain only a name, presence state, and size. Request evidence contains no header, body, credential, query value, or fragment.

11. Read reports and results

curl --fail-with-body 'https://issueprobe.com/v1/reports?limit=25' \
  -H 'Authorization: Bearer YOUR_API_CREDENTIAL'

curl --fail-with-body https://issueprobe.com/v1/reports/REPORT_ID \
  -H 'Authorization: Bearer YOUR_API_CREDENTIAL'

Use reports:read to read customer-safe reports. Use reports:write for a draft, review, archive, or new investigation. A saved draft is not sent to the visitor.

12. Start hosted Checkout when authorized

The credential needs billing:checkout. Use a new idempotency key for one logical upgrade attempt.

curl --fail-with-body https://issueprobe.com/v1/billing/checkout \
  -X POST \
  -H 'Authorization: Bearer YOUR_API_CREDENTIAL' \
  -H 'Idempotency-Key: owner-pro-upgrade-001' \
  -H 'Content-Type: application/json' \
  --data '{}'

Give the hosted URL to the owner. Do not collect card data. A Checkout return does not grant Pro by itself.

13. Handle expiry and revocation safely

The owner authorization and exchange expire after seven days. The issued credential expires after 90 days. Stop on a 401, 403, or expiry error and ask the owner for a new approved enrollment.

Only a human owner can revoke a credential through DELETE /v1/api-credentials/{credentialId}. The agent cannot create or revoke another agent credential. Remove the stored credential after revocation.