# Setup API

First-run bootstrap. 2 operations under /api/v1. Errors are RFC 9457 problem+json with a stable `code` field. The complete schemas are in https://nebulactrl.com/api/v1/openapi.json.

## GET /setup

Whether first-run setup is still required

Authentication: none.

Response 200: OK (SetupStatusOutputBody)
  - `needsSetup` (boolean, required)
  - `tokenRequired` (boolean, required)

## POST /setup

Create the workspace and first user, and sign in

Only works while no users exist; afterwards returns 409 `already_setup`. When the server runs with `NEBULACTRL_SETUP_TOKEN` (the installer sets it) the matching `setupToken` is required (403 `setup_token_invalid`).

Authentication: none.

Request body (application/json, required): SetupInputBody
  - `email` (string (email), required)
  - `name` (string, required)
  - `password` (string, required)
  - `setupToken` (string): The one-time setup token printed by the installer; required only when the server was started with NEBULACTRL_SETUP_TOKEN
  - `teamName` (string): Name of the first team; default NebulaCtrl

Response 201: Created (MeBody)
  - `createdAt` (string (date-time), required)
  - `email` (string, required)
  - `id` (string, required)
  - `instanceAdmin` (boolean, required): The first user: manages instance settings
  - `name` (string, required)
  - `principal` (PrincipalBody, required)
  - `workspaceId` (string, required)
Errors: 403 Forbidden (`setup_token_invalid`); 409 Conflict (`already_setup`); 422 Unprocessable Entity; 429 Too Many Requests; 500 Internal Server Error