# Deny a device authorization

Denies the device behind `userCode`, so its next poll answers `denied` and no API key is ever minted. Only a pending authorization can be denied. Requires a signed-in browser session.

## POST `/v1/auth/device/deny`

### Authorization

`__Host-better-auth.session_token` API key · cookie required

Dashboard session cookie set at sign-in. An operation that lists only this scheme needs a person: API keys and machine credentials are refused. The same session token also works as `Authorization: Bearer`.

### Request body

required `application/json`

- `userCode` string required  
  User code shown on the device being denied. Dashes and letter case are ignored.
  - min length 1 · max length 32

### Responses

#### 200 Response for status 200

- `$schema` string `<uri>`  
  Canonical JSON Schema URL for this response body. The server also sends it in the `Link: rel="describedby"` response header.

- `data` object required
    - `status` string required  
      Always `denied`; the call fails instead of returning any other value.

- `defaultError`. Every 4xx and 5xx response is one RFC 9457 problem document served as `application/problem+json`.

- `$schema` string `<uri>`  
      Canonical JSON Schema URL for this response body. The server also sends it in the `Link: rel="describedby"` response header.

- `type` string required  
      URL of the documentation page for this error. Derived from `code`.

- `title` string required  
      Human-readable name of the error type. Derived from `code`.

- `status` integer required  
      HTTP status of the response, repeated in the body.
      - min -9007199254740991 · max 9007199254740991

- `detail` string required  
      What went wrong in this request.

- `code` string required  
      Stable snake_case error code. Match on this, not on `detail`.

- `pointer` string  
      RFC 6901 JSON Pointer to the request field or batch entry that failed, for example `/files/37/path`. Present on validation failures.

- `details` object  
      Machine-readable context keyed by the error code.

- `suggestions` string[]  
          Recovery steps safe to show to a person.

- `next` string[]  
          Commands or API requests to run next, usable as written.

- `requestId` string required  
      ID of this request, from the `X-Request-Id` header or generated. Quote it when contacting support.

### Try it

**Server**

Base URL `https://api.spacefast.com`  
Custom base URL Overrides the selected server when set.

### Authorization

API key  
Remember on this device  
Include my values in samples

### Body

`application/json`
- `userCode` string *  
  User code shown on the device being denied. Dashes and letter case are ignored.

### Request Examples

#### cURL

```bash
curl -X POST "https://api.spacefast.com/v1/auth/device/deny" \
  -H "Cookie: __Host-better-auth.session_token=YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{\n  "userCode": "string"\n}'
```

#### JavaScript

```javascript
const response = await fetch("https://api.spacefast.com/v1/auth/device/deny", {
  method: "POST",
  headers: {
    "Cookie": "__Host-better-auth.session_token=YOUR_API_KEY",
    "Content-Type": "application/json"
  },
  body: "{\n  \"userCode\": \"string\"\n}"
});
```

#### Python

```python
import requests

response = requests.post(
    "https://api.spacefast.com/v1/auth/device/deny",
    headers={
        "Cookie": "__Host-better-auth.session_token=YOUR_API_KEY",
        "Content-Type": "application/json"
    },
    data="{\n  \"userCode\": \"string\"\n}",
)
```

### Example Response

#### 200 default

```json
{
  "$schema": "http://example.com",
  "data": {
    "status": "denied"
  }
}
```

```json
{
  "$schema": "http://example.com",
  "type": "string",
  "title": "string",
  "status": -9007199254740991,
  "detail": "string",
  "code": "string",
  "pointer": "string",
  "details": {
    "property1": null,
    "property2": null
  },
  "suggestions": [
    "string"
  ],
  "next": [
    "string"
  ],
  "requestId": "string"
}
```