const http = require('https'); const options = { method: 'POST', hostname: 'api.hopper.west.prod.govcloud.legion.picogrid.com', port: null, path: '/v3/mesh/machines/:id/renew', headers: { Accept: 'application/json' } }; const req = http.request(options, function (res) { const chunks = []; res.on('data', function (chunk) { chunks.push(chunk); }); res.on('end', function () { const body = Buffer.concat(chunks); console.log(body.toString()); }); }); req.end();

require 'uri' require 'net/http' url = URI("https://api.hopper.west.prod.govcloud.legion.picogrid.com/v3/mesh/machines/:id/renew") http = Net::HTTP.new(url.host, url.port) http.use_ssl = true request = Net::HTTP::Post.new(url) request["Accept"] = 'application/json' response = http.request(request) puts response.read_body

<?php $curl = curl_init(); curl_setopt_array($curl, [ CURLOPT_URL => "https://api.hopper.west.prod.govcloud.legion.picogrid.com/v3/mesh/machines/:id/renew", CURLOPT_RETURNTRANSFER => true, CURLOPT_ENCODING => "", CURLOPT_MAXREDIRS => 10, CURLOPT_TIMEOUT => 30, CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1, CURLOPT_CUSTOMREQUEST => "POST", CURLOPT_HTTPHEADER => [ "Accept: application/json" ], ]); $response = curl_exec($curl); $err = curl_error($curl); curl_close($curl); if ($err) { echo "cURL Error #:" . $err; } else { echo $response; }

import requests url = "https://api.hopper.west.prod.govcloud.legion.picogrid.com/v3/mesh/machines/:id/renew" headers = {"Accept": "application/json"} response = requests.post(url, headers=headers) print(response.text)

CURL *hnd = curl_easy_init(); curl_easy_setopt(hnd, CURLOPT_CUSTOMREQUEST, "POST"); curl_easy_setopt(hnd, CURLOPT_WRITEDATA, stdout); curl_easy_setopt(hnd, CURLOPT_URL, "https://api.hopper.west.prod.govcloud.legion.picogrid.com/v3/mesh/machines/:id/renew"); struct curl_slist *headers = NULL; headers = curl_slist_append(headers, "Accept: application/json"); curl_easy_setopt(hnd, CURLOPT_HTTPHEADER, headers); CURLcode ret = curl_easy_perform(hnd);

using System.Net.Http.Headers; var client = new HttpClient(); var request = new HttpRequestMessage { Method = HttpMethod.Post, RequestUri = new Uri("https://api.hopper.west.prod.govcloud.legion.picogrid.com/v3/mesh/machines/:id/renew"), Headers = { { "Accept", "application/json" }, }, }; using (var response = await client.SendAsync(request)) { response.EnsureSuccessStatusCode(); var body = await response.Content.ReadAsStringAsync(); Console.WriteLine(body); }

require "http/client" url = "https://api.hopper.west.prod.govcloud.legion.picogrid.com/v3/mesh/machines/:id/renew" headers = HTTP::Headers{ "Accept" => "application/json" } response = HTTP::Client.post url, headers: headers puts response.body

package main import ( "fmt" "net/http" "io" ) func main() { url := "https://api.hopper.west.prod.govcloud.legion.picogrid.com/v3/mesh/machines/:id/renew" req, _ := http.NewRequest("POST", url, nil) req.Header.Add("Accept", "application/json") res, _ := http.DefaultClient.Do(req) defer res.Body.Close() body, _ := io.ReadAll(res.Body) fmt.Println(string(body)) }

OkHttpClient client = new OkHttpClient(); Request request = new Request.Builder() .url("https://api.hopper.west.prod.govcloud.legion.picogrid.com/v3/mesh/machines/:id/renew") .post(null) .addHeader("Accept", "application/json") .build(); Response response = client.newCall(request).execute();

const options = {method: 'POST', headers: {Accept: 'application/json'}}; fetch('https://api.hopper.west.prod.govcloud.legion.picogrid.com/v3/mesh/machines/:id/renew', options) .then(res => res.json()) .then(res => console.log(res)) .catch(err => console.error(err));

val client = OkHttpClient() val request = Request.Builder() .url("https://api.hopper.west.prod.govcloud.legion.picogrid.com/v3/mesh/machines/:id/renew") .post(null) .addHeader("Accept", "application/json") .build() val response = client.newCall(request).execute()

#import <Foundation/Foundation.h> NSDictionary *headers = @{ @"Accept": @"application/json" }; NSMutableURLRequest *request = [NSMutableURLRequest requestWithURL:[NSURL URLWithString:@"https://api.hopper.west.prod.govcloud.legion.picogrid.com/v3/mesh/machines/:id/renew"] cachePolicy:NSURLRequestUseProtocolCachePolicy timeoutInterval:10.0]; [request setHTTPMethod:@"POST"]; [request setAllHTTPHeaderFields:headers]; NSURLSession *session = [NSURLSession sharedSession]; NSURLSessionDataTask *dataTask = [session dataTaskWithRequest:request completionHandler:^(NSData *data, NSURLResponse *response, NSError *error) { if (error) { NSLog(@"%@", error); } else { NSHTTPURLResponse *httpResponse = (NSHTTPURLResponse *) response; NSLog(@"%@", httpResponse); } }]; [dataTask resume];

open Cohttp_lwt_unix open Cohttp open Lwt let uri = Uri.of_string "https://api.hopper.west.prod.govcloud.legion.picogrid.com/v3/mesh/machines/:id/renew" in let headers = Header.add (Header.init ()) "Accept" "application/json" in Client.call ~headers `POST uri >>= fun (res, body_stream) -> (* Do stuff with the result *)

$headers=@{} $headers.Add("Accept", "application/json") $response = Invoke-WebRequest -Uri 'https://api.hopper.west.prod.govcloud.legion.picogrid.com/v3/mesh/machines/:id/renew' -Method POST -Headers $headers

library(httr) url <- "https://api.hopper.west.prod.govcloud.legion.picogrid.com/v3/mesh/machines/:id/renew" response <- VERB("POST", url, content_type("application/octet-stream"), accept("application/json")) content(response, "text")

use reqwest; #[tokio::main] pub async fn main() { let url = "https://api.hopper.west.prod.govcloud.legion.picogrid.com/v3/mesh/machines/:id/renew"; let client = reqwest::Client::new(); let response = client.post(url) .header("Accept", "application/json") .send() .await; let results = response.unwrap() .json::<serde_json::Value>() .await .unwrap(); println!("{}", results); }

import Foundation let url = URL(string: "https://api.hopper.west.prod.govcloud.legion.picogrid.com/v3/mesh/machines/:id/renew")! var request = URLRequest(url: url) request.httpMethod = "POST" request.timeoutInterval = 10 request.allHTTPHeaderFields = ["Accept": "application/json"] let (data, _) = try await URLSession.shared.data(for: request) print(String(decoding: data, as: UTF8.self))

{ "cert_not_after": "string", "files": { "property1": "string", "property2": "string" }, "hostname": "string", "ip": "string", "lighthouses": [ { "endpoints": [ "string" ], "ip": "string" } ], "machine_id": "76ca96f6-a9a8-43bf-917c-a176478a33ba" }

Renew a mesh-only machine's certificate

POST

/v3/mesh/machines/{id}/renew

const url = 'https://api.hopper.west.prod.govcloud.legion.picogrid.com/v3/mesh/machines/2489E9AD-2EE2-8E00-8EC9-32D5F69181C0/renew';
const options = {method: 'POST'};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}

curl --request POST \
  --url https://api.hopper.west.prod.govcloud.legion.picogrid.com/v3/mesh/machines/2489E9AD-2EE2-8E00-8EC9-32D5F69181C0/renew

Issues a fresh short-lived Nebula certificate for a mesh-only machine. Requires system admin, but system admin access alone is insufficient: only the identity that joined the machine may renew it, and any other caller (including another system admin) receives 403. Legion machines renew via /v3/federation and 404 here.

Parameters

Path Parameters

required

string format: uuid

Responses

200

Successful response

application/json

object

cert_not_after

required

string

files

required

object

key

additional properties

string

hostname

required

string

required

string

lighthouses

required

Array<object>

object

endpoints

required

Array<string>

required

string

machine_id

required

string format: uuid

Example^generated

{
  "cert_not_after": "example",
  "files": {
    "additionalProperty": "example"
  },
  "hostname": "example",
  "ip": "example",
  "lighthouses": [
    {
      "endpoints": [
        "example"
      ],
      "ip": "example"
    }
  ],
  "machine_id": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0"
}

400

Bad Request

application/json

object

category

required

string

code

required

number

details

Array<object>

object

field

required

string

issue

required

string

message

required

string

status

required

string

timestamp

required

string

trace_id

required

string

Example

{
  "code": 400,
  "details": [
    {
      "Field": "organization_id",
      "Issue": "must be a valid UUID format"
    }
  ],
  "message": "Request cannot be processed due to invalid input",
  "status": "error",
  "timestamp": "2026-01-15T14:32:45Z",
  "trace_id": "req_2J9K8L7M6N5P4Q3R"
}

401

Unauthorized

application/json

object

category

required

string

code

required

number

details

Array<object>

object

field

required

string

issue

required

string

message

required

string

status

required

string

timestamp

required

string

trace_id

required

string

Example

{
  "code": 401,
  "details": [
    {
      "Field": "authorization_header",
      "Issue": "Bearer token is expired or malformed"
    }
  ],
  "message": "Authentication credentials are missing or invalid",
  "status": "error",
  "timestamp": "2026-01-15T14:32:45Z",
  "trace_id": "req_2J9K8L7M6N5P4Q3R"
}

403

Forbidden

application/json

object

category

required

string

code

required

number

details

Array<object>

object

field

required

string

issue

required

string

message

required

string

status

required

string

timestamp

required

string

trace_id

required

string

Example

{
  "code": 403,
  "details": [
    {
      "Field": "required_scope",
      "Issue": "requires 'orion:settings:write' scope, but token only has 'orion:settings:read'"
    }
  ],
  "message": "Access denied: insufficient permissions for this resource",
  "status": "error",
  "timestamp": "2026-01-15T14:32:45Z",
  "trace_id": "req_2J9K8L7M6N5P4Q3R"
}

404

Not Found

application/json

object

category

required

string

code

required

number

details

Array<object>

object

field

required

string

issue

required

string

message

required

string

status

required

string

timestamp

required

string

trace_id

required

string

Example

{
  "code": 404,
  "details": [
    {
      "Field": "organization_id",
      "Issue": "organization with ID 'a1b2c3d4-e5f6-7890-abcd-ef1234567890' not found"
    }
  ],
  "message": "The requested resource could not be found",
  "status": "error",
  "timestamp": "2026-01-15T14:32:45Z",
  "trace_id": "req_2J9K8L7M6N5P4Q3R"
}

500

Internal Server Error

application/json

object

category

required

The category of the error

string

code

required

The HTTP status code

number

details

Additional details about the error

Array<object>

object

field

The field that caused the error

string

issue

The specific issue with the field

string

message

required

A human-readable error message

string

status

required

The status of the response, always ‘error’ for error responses

string

timestamp

required

The timestamp when the error occurred

string format: date-time

trace_id

required

A unique identifier for tracing the error

string format: uuid

Example

{
  "category": "server_error",
  "code": 500,
  "details": [
    {
      "field": "field_name",
      "issue": "Field validation issue"
    }
  ],
  "message": "Internal Server Error",
  "status": "error",
  "timestamp": "2024-03-15T10:30:00Z",
  "trace_id": "b7c5e4d3-a2b1-4f0e-8d9c-1a2b3c4d5e6f"
}

Version 3.14.0 · commit 0771262

Renew a mesh-only machine's certificate

Parameters

Path Parameters

Responses

200

Examplegenerated

400

Example

401

Example

403

Example

404

Example

500

Example

Example^generated