bootstrap

Bootstrap endpoint

You host an HTTPS GET handler. The add-in calls it at startup with the user's Entra token, you return per-user JSON, the response overrides manifest and extension attrs for that user. This is how you push structured config — mcp_servers, skills — that flat string attrs can't carry.

Ask first

Figure out which mode you're in before walking the spec:

• Just want to understand it? Answer from the sections below. Common questions: what's the response shape, how does {{...}} work, why is CORS biting me.
• Building one? Ask: new handler or editing an existing one? Lambda, Cloud Function, Express, Python, something else? Then jump to Scaffolding — the sections in between are the contract you're coding against.

This vs extension attrs

Both deliver per-user config. Pick by what you're carrying.

	Extension attrs	Bootstrap endpoint
You write	az rest PATCH per user	An HTTPS service
Carries	Flat strings, ≤256 chars	Any JSON — arrays, nested, base64
Good for	Token rotation, region override	mcp_servers, skills, anything structured
Refresh	Token cache, ~1hr lag	bootstrap_expires_at, you control it
Auth	Entra token claims (passive)	You validate the JWT (active)

If you only need to swap gateway_token per user, attrs are less work. The moment you want a Linear MCP server for one team and a Jira one for another, you're here.

Template interpolation

Any string value can contain {{key}}. The add-in substitutes against the merged config chain — manifest params, then extension attrs, then this response, each layer overriding the last. You don't echo a value back just so a template can see it; if gateway_token is already in the manifest or an attr, {{gateway_token}} resolves.

Two phases, because the request has to happen before the response exists:

1. bootstrap_url itself resolves against manifest + attrs only. So the manifest can carry bootstrap_url=https://config.internal/bootstrap?project={{gcp_project_id}} and you run one endpoint that branches on a query param instead of stamping per-team URLs into attrs.
2. Response fields resolve against the full merge — manifest + attrs + whatever this response just returned. An mcp_servers entry can reference a gateway_token that lives three lines up in the same JSON.