ms epoch token expiry.
Hostname the caller PUT-streams the tarball to.
OptionalpinT1a (Arch A): base64 DER of the device-managed self-signed LEAF the target device serves on its ingest host. When present, the upload client MUST PIN this leaf — trust it as a CA for the ingest PUT (with normal SAN hostname validation) — instead of relying on a public CA. Absent for a grant minted before the device reported its cert (un-migrated / pre-report devices), in which case the client keeps its default public-CA behaviour.
One-time plaintext session token — never returned by later reads.
Kick-off response for an upload session.
sessionTokenis one-time.