After the wallet is healthy, call POST /api/cwp/tenants/setup/default once to seed the first users, owner group, hot master keys, and registered chains. For Helm, finish Helm Deployment through instance verification first.

Prerequisites

• Wallet GET /ready returns 200 and Policy Nodes are connected to the broker.
• The bootstrap API key from first wallet start (Authorization: Bearer). Later cwp_ keys and OIDC tokens are rejected. Read it from the secret referenced by bootstrap_key in wallet.yaml.
• An identity-provider account for every listed user. ID is the lowercase OIDC email claim.
• CAIP-2 values for known chains this deployment serves. Do not mix testnet and mainnet in one payload.

Request body

Restrictions, extra users, and custom or private EVM chains are configured after this call, not in the payload.

Call the API

The call is one-shot. Policy Nodes reject a second populate when signed tables already have data.

POST https://<wallet-api-host>/api/cwp/tenants/setup/default
Authorization: Bearer <bootstrap-api-key>
Content-Type: application/json

{
  "Users": [
    {"ID": "[email protected]", "Name": "Alice"},
    {"ID": "[email protected]", "Name": "Bob"}
  ],
  "Group": "owner",
  "MasterKeysAndAccounts": {
    "Default": []
  },
  "Assets": {
    "CAIP2s": [
      "eip155:11155111",
      "eip155:84532",
      "canton:testnet"
    ]
  }
}

curl -sS -X POST "https://<wallet-api-host>/api/cwp/tenants/setup/default" \
  -H "Authorization: Bearer ${BOOTSTRAP_API_KEY}" \
  -H "Content-Type: application/json" \
  -d @tenant-setup.json

200 means setup completed or the tenant was already populated. 401 means the token is not the bootstrap key. 400 with an invalid-state or data-generation message usually means Policy Nodes already hold tenant data.

Azure and AWS installer bundles wrap this as make bootstrap-policies-and-users. Helm has no Makefile step; call the API directly.