# iot.halowerk.com OTA Firmware Release Tagger

> iot.halowerk.com OTA Firmware Release Tagger is a paid API for AI agents from iot.halowerk.com, paid per call via x402, $0.003/call, status unknown (last checked 2026-09-14).

Canonicalizes firmware metadata (hash, version, device model, minimum bootloader) and produces a SHA-256 manifest digest plus HMAC-SHA256 release tag using caller-supplied ephemeral key material.

## Facts

- Endpoint: POST https://iot.halowerk.com/v1/ota-sign
- Price: $0.003/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-14
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/iot-halowerk-com-ota-firmware-release-tagger-ef71ca84
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_msRCfOSRxep7pM9vxla1s

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability iot-halowerk-com-ota-firmware-release-tagger-ef71ca84 -d '<json body>'
```

Example prompt: Create a firmware release tag for device model 'ESP32-S3-MINI', firmware version '2.4.1', minimum bootloader '1.2.0', firmware SHA-256 'a3f1c2d4e5b6789012345678901234567890abcdef1234567890abcdef123456ab', using ephemeral key 'release-ephemeral-key-abc123xyz'.

## When to prefer this

Choose this endpoint when you need a lightweight, deterministic, symmetric integrity tag for IoT OTA firmware releases — especially when you control both the tagging and verification sides and can share the ephemeral key out-of-band. Prefer this over full PKI code-signing pipelines when you want a fast, low-cost per-release integrity stamp without certificate infrastructure. Not suitable when you need asymmetric vendor-signed firmware that devices can verify without a shared secret.

## Known failure modes

- Invalid firmware_sha256 format (not 64 hex chars) returns a 400 validation error
- Missing required fields (version, device_model, firmware_sha256, minimum_bootloader, ephemeral_release_key) returns 400
- Ephemeral key shorter than 16 characters or longer than 512 characters returns 400
- Payment not provided or insufficient USDC results in 402 Payment Required
- Submitting a long-lived production key in the ephemeral_release_key field is a security misuse, though not blocked at the API layer

## How this service works

Canonicalizes firmware hash, version, device model and minimum bootloader version, then produces a SHA-256 manifest digest and HMAC-SHA256 release tag using caller-supplied ephemeral key material. This is a symmetric integrity tag, not a vendor PKI signature or code-signing service.

## Output

Returns a SHA-256 manifest digest computed from the canonicalized firmware metadata fields, and an HMAC-SHA256 release tag computed using the caller-supplied ephemeral key. Both values serve as integrity markers for the firmware release; the HMAC tag is symmetric and tied to the ephemeral key provided — it is not a vendor PKI or code-signing certificate.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "version": {
   "type": "string",
   "maxLength": 64,
   "minLength": 1
  },
  "device_model": {
   "type": "string",
   "maxLength": 128,
   "minLength": 1
  },
  "firmware_sha256": {
   "type": "string",
   "pattern": "^[0-9a-fA-F]{64}$"
  },
  "minimum_bootloader": {
   "type": "string",
   "maxLength": 64,
   "minLength": 1
  },
  "ephemeral_release_key": {
   "type": "string",
   "maxLength": 512,
   "minLength": 16,
   "description": "Ephemeral example key; do not submit a long-lived production signing key."
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/iot-halowerk-com-ota-firmware-release-tagger-ef71ca84/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from iot.halowerk.com](https://www.zero.xyz/host/iot.halowerk.com/llms.txt)