Pairing code: get the certificate

Second step of Provisioning with a pairing code, after Pairing code: send the confirmation code. The device polls this endpoint, at most once every few seconds and never past expires_at, until the user confirms in Things5 that the confirmation code shown there is the one on the device. No Authorization header.

PUT https://api.things5.digital/provisioning/v2/provisioning_token/{code}/check
Content-Type: application/json

{ "confirmation_token": "4fK9xQ2mZt" }

Responses

200, not confirmed yet: keep polling.

{ "data": { "id": "7KQ2MX", "confirmed": false, "expires_at": "2026-11-15T10:32:00" } }

200, confirmed: the certificate, its private key and the CA certificate, delivered once. Later calls with the same code get 404.

{
  "machine_id": "4efe48f3-7619-4e27-826b-d710654adbc1",
  "serial": "SN-0042",
  "certificate_id": "…",
  "certificate": "-----BEGIN CERTIFICATE-----…",
  "private_key": "-----BEGIN PRIVATE KEY-----…",
  "public_key": "",
  "ca": "-----BEGIN CERTIFICATE-----…"
}

Field	Description
`machine_id`, `serial`	The machine the certificate is for. The firmware can check `serial` to detect a code generated on the wrong machine. `serial` can be null.
`certificate`, `private_key`, `ca`	PEM. Store the private key in a protected area of the device; never write it to logs or debug output. Things5 does not keep it.
`public_key`	Not used: always an empty string.

Status	Meaning
404	Unknown, expired or already used code, a confirmation code different from the one sent, or a code cancelled after 5 wrong confirmation codes. Stop: a new code has to be generated.
429	Too many failed attempts from this client: retry after `Retry-After` seconds.
5xx	The certificate could not be issued: retry, the code is still valid until it expires.

Issuing the certificate invalidates the machine's previous certificate.