code: func (s *HTTPServer) ACLBootstrap(resp http.ResponseWriter, req *http.Request) (interface{}, error) {
  	if s.checkACLDisabled(resp, req) {
  		return nil, nil
  	}
  
  	args := structs.DCSpecificRequest{
  		Datacenter: s.agent.config.Datacenter,
  	}
  
  	legacy := false
  	legacyStr := req.URL.Query().Get("legacy")
  	if legacyStr != "" {
  		legacy, _ = strconv.ParseBool(legacyStr)
  	}
  
  	if legacy && s.agent.delegate.UseLegacyACLs() {
  		var out structs.ACL
  		err := s.agent.RPC("ACL.Bootstrap", &args, &out)
  		if err != nil {
  			if strings.Contains(err.Error(), structs.ACLBootstrapNotAllowedErr.Error()) {
  				resp.WriteHeader(http.StatusForbidden)
  				fmt.Fprint(resp, acl.PermissionDeniedError{Cause: err.Error()}.Error())
  				return nil, nil
  			} else {
  				return nil, err
  			}
  		}
  		return &aclBootstrapResponse{ID: out.ID}, nil
  	} else {
  		var out structs.ACLToken
  		err := s.agent.RPC("ACL.BootstrapTokens", &args, &out)
  		if err != nil {
  			if strings.Contains(err.Error(), structs.ACLBootstrapNotAllowedErr.Error()) {
  				resp.WriteHeader(http.StatusForbidden)
  				fmt.Fprint(resp, acl.PermissionDeniedError{Cause: err.Error()}.Error())
  				return nil, nil
  			} else {
  				return nil, err
  			}
  		}
  		return &aclBootstrapResponse{ID: out.SecretID, ACLToken: out}, nil
  	}
  }
docs: // ACLBootstrap is used to perform a one-time ACL bootstrap operation on
  // a cluster to get the first management token.