Loader delivery & updates

Delivery authorization is a chain: active device → ephemeral session → short-lived file grant → download. Keep keys and session material in memory and never include them in logs.

1. Activate this device

Call activate with a strong hardware hash. Preserve the returned activationSessionId and session fields. If Force Update blocks activation, request a loader_recovery session.

2. Request an update grant

Call version-check or sdk-list with the live activationSessionId. A downloadToken is bound to the license, HWID, file and session, expires in roughly 45 seconds and can be redeemed once.

3. Redeem the grant

POST licenseKey, hwidHash, downloadToken and activationSessionId (or sessionNonce) to sdk-download/{fileId}. VZENC2 seals only with a grant AND (activationSessionId or sessionNonce). Legacy clients without the delivery binding receive catalog PE. Check response headers and format before processing bytes.

Loader updates and drivers

Only a loader with role=loader and is_latest is an EXE replacement target. Drivers use is_latest_driver. A recovery session must never authorize a driver download.

Proof verification

Verify the Ed25519 serverProof against the embedded key from sdk/ed25519_pub.h. Rebuild the signed JSON envelope with ordered keys. Fail closed on invalid or missing proof in production. The REST snippets show transport and request shape; production custom clients must implement proof verification and configured request signing.