# First-run Setup

Unauthenticated first-run bootstrap of a self-hosted install: whether this deployment still needs setup, and the one call that creates its institute and owner account. Both answer 404 on the cloud platform and once an institute exists.

Generated from `apps/api/openapi.json`. HTML version: https://docs.institflow.com/en/reference/setup

2 operations.

## POST /api/v1/setup/bootstrap

Create this self-hosted install's institute and its owner account, and sign the owner in. 404 in cloud mode or once an institute exists.

- Operation id: `SetupController_bootstrap_v1`
- Permission: —
- Auth: public (no credential)
- `Idempotency-Key`: not required

### Request body

| Property | Type | Required | Constraints |
| --- | --- | --- | --- |
| `setupToken` | string | yes | ≥1 chars |
| `institute` | object | yes |  |
| `owner` | object | yes |  |

```json
{
  "setupToken": "string",
  "institute": {
    "slug": "string",
    "name": "Algebra I",
    "defaultLocale": "ar",
    "timezone": "string",
    "currency": "USD"
  },
  "owner": {
    "email": "ada.lovelace@example.com",
    "password": "string",
    "firstName": "Ada",
    "lastName": "Lovelace"
  }
}
```

### Responses

**201** — An access token for the new owner, their membership, and the institute's id.

```json
{
  "mfaRequired": true,
  "mfaEnrollmentRequired": true,
  "mfaToken": "string"
}
```

Every other status answers with the shared `ErrorEnvelope` — see
https://docs.institflow.com/md/en/error-codes.md

### Example request

```bash
curl -X POST "https://your-institute.example/api/v1/setup/bootstrap" \
  -H "Authorization: Bearer $INSTITFLOW_API_KEY" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: $(uuidgen)" \
  -d '{
    "setupToken": "string",
    "institute": {
      "slug": "string",
      "name": "Algebra I",
      "defaultLocale": "ar",
      "timezone": "string",
      "currency": "USD"
    },
    "owner": {
      "email": "ada.lovelace@example.com",
      "password": "string",
      "firstName": "Ada",
      "lastName": "Lovelace"
    }
  }'
```

## GET /api/v1/setup/status

Whether this deployment still needs first-run setup. Public: the login page reads it before any session exists.

- Operation id: `SetupController_status_v1`
- Permission: —
- Auth: public (no credential)
- `Idempotency-Key`: not required

### Responses

**200** — The deployment mode and whether an institute has been created yet.

| Property | Type | Required | Constraints |
| --- | --- | --- | --- |
| `deploymentMode` | enum: "cloud" \| "self_hosted" | yes |  |
| `needsSetup` | boolean | yes |  |

Every other status answers with the shared `ErrorEnvelope` — see
https://docs.institflow.com/md/en/error-codes.md

### Example request

```bash
curl -X GET "https://your-institute.example/api/v1/setup/status" \
  -H "Authorization: Bearer $INSTITFLOW_API_KEY"
```