First call of a device provisioned with a pairing code: sends the code typed on the device and the confirmation code the device shows. No authentication.
Used by the device firmware in Provisioning with a pairing code. No Authorization header: the pairing code and the device's confirmation code are the only credentials.
PATCH https://api.things5.digital/provisioning/v2/provisioning_token/{code}
Content-Type: application/json
{ "provisioning_token": { "confirmation_token": "4fK9xQ2mZt" } }
| Parameter | In | Description |
|---|---|---|
code | path | Pairing code generated in Things5: 6 characters of Crockford's base32, case-insensitive (O is read as 0, I and L as 1). Valid for 2 minutes, single use. |
provisioning_token.confirmation_token | body | Random code the device chooses for every provisioning and shows on its display: 6 to 64 letters and digits. |
Responses
| Status | Meaning |
|---|---|
| 200 | Confirmation code recorded: {"data": {"id": "<code>", "confirmed": false, "expires_at": "2026-11-15T10:32:00"}} (expires_at is UTC). Now poll Pairing code: get the certificate. |
| 404 | Unknown, expired or already used code, or a confirmation code was already sent for it. Do not retry: a new code has to be generated in Things5. |
| 422 | The confirmation code is not 6 to 64 letters and digits. |
| 429 | Too many failed attempts from this client: retry after Retry-After seconds. |