Verify or approve a device authorization request.

POST

/api/devices/verify

Code sample: Shell / cURL

curl --request POST \
  --url https://auth.example.com/api/devices/verify \
  --header 'Content-Type: application/json' \
  --cookie authrim_session=<authrim_session> \
  --data '{ "user_code": "WDJB-MJHT", "approve": true }'

A code requested before the user last withdrew the client’s consent cannot be approved: 400 consent_withdrawn, and the device has to start again. Consent state that cannot be read returns 503 temporarily_unavailable and leaves the code pending. The per-IP user code rate limit fails closed: without a working rate limiter, or when the device code store cannot answer, the code is not read and the response is 503 temporarily_unavailable.

Authorizations

• sessionCookie
• sessionHeader

Request Body ^required

Media type application/json

object

user_code

required

The user code as shown on the device. Any case is accepted, and the hyphens and spaces between the groups are optional. Only the form is checked (4 to 16 letters and digits once the separators are removed): the tenant’s settings may have changed since the code was issued, so whether the code exists is decided by the code store, and a code that does not exist counts against the per-IP failed-attempt limit.

string

approve

boolean

default: true

user_id

string

sub

string

Example

{
  "user_code": "WDJB-MJHT",
  "approve": true
}

Responses

200

Successful JSON response.

Media type application/json

object

success

required

boolean

message

string

error

string

error_description

string

Example

{
  "success": true,
  "message": "Device authorized successfully"
}

400

OAuth error response.

Media type application/json

object

error

required

string

error_description

string

Example ^generated

{
  "error": "example",
  "error_description": "example"
}

401

OAuth error response.

Media type application/json

object

error

required

string

error_description

string

Example ^generated

{
  "error": "example",
  "error_description": "example"
}

404

OAuth error response.

Media type application/json

object

error

required

string

error_description

string

Example ^generated

{
  "error": "example",
  "error_description": "example"
}

429

OAuth error response.

Media type application/json

object

error

required

string

error_description

string

Example ^generated

{
  "error": "example",
  "error_description": "example"
}

503

OAuth error response.

Media type application/json

object

error

required

string

error_description

string

Example ^generated

{
  "error": "example",
  "error_description": "example"
}