ms epoch token expiry.
Hostname the caller PUT-streams the bundle bytes to.
OptionalpinT1a: base64 DER of the device-managed ingest leaf to PIN on the streaming PUT. Absent → default public-CA trust (back-compat). The ingest app serves a self-signed leaf, so without this the PUT fails TLS verification.
One-time plaintext session token — never returned by later reads.
Kick-off response for an artifact ingest session.
sessionTokenis one-time.