Get a device authorization by user code

Returns what the device behind a user code asked for: the client that started the flow, the scopes it requested, the IP it came from, its deadline, and any Space it will claim. The approval page reads this before a person approves or denies. Attempts are rate limited per caller and per user code.

GET /v1/auth/device

Query parameters

user_code string required
min length 1 · max length 32

Responses

200 Response for status 200

$schema string
Canonical JSON Schema URL for this response body. The server also sends it in the Link: rel="describedby" response header.

data object required

Show propertiesHide properties

claim object | any required
Space attached to this flow for claiming. Null for an ordinary sign-in.

Any of:

• object

spaceId string required
Space that approval will claim.

title string | any required
Title of that Space. Null when it has none.

liveUrl string | any required
Live URL of that Space. Always null.

clientId string | any required
Client that started the flow. Null when none was recorded.

expiresAt string required
ISO 8601 timestamp after which the codes stop working.

origin string | any required
Client IP the flow was started from. Null when it could not be determined.

requestedAccess object required
What the device asked for, resolved from what was recorded when the flow started.

profile string | any required
Access profile whose scope set exactly matches the request. Null when it matches none.

scopes string[] required
Scopes the device asked for. Approval can grant these or fewer, never more.

status string required
One of pending, approved, consumed, denied, expired.

default Error

Every 4xx and 5xx response is one RFC 9457 problem document served as application/problem+json.

$schema string
Canonical JSON Schema URL for this response body. The server also sends it in the Link: rel="describedby" response header.

type string required
URL of the documentation page for this error. Derived from code.

title string required
Human-readable name of the error type. Derived from code.

status integer required
HTTP status of the response, repeated in the body.

detail string required
What went wrong in this request.

code string required
Stable snake_case error code. Match on this, not on detail.

pointer string
RFC 6901 JSON Pointer to the request field or batch entry that failed, for example /files/37/path. Present on validation failures.

details object
Machine-readable context keyed by the error code.

suggestions string[]
Recovery steps safe to show to a person.

next string[]
Commands or API requests to run next, usable as written.

requestId string required
ID of this request, from the X-Request-Id header or generated. Quote it when contacting support.

Try it

Server
Base URL https://api.spacefast.com
Custom base URL Overwrites the selected server when set.

Parameters

user_code query*

Send

Request

cURL

curl -X GET "https://api.spacefast.com/v1/auth/device?user_code=string"

JavaScript

const response = await fetch("https://api.spacefast.com/v1/auth/device?user_code=string", {
  method: "GET"
});

Python

import requests

response = requests.get(
    "https://api.spacefast.com/v1/auth/device?user_code=string",
)

Response

200 default

{
  "$schema": "http://example.com",
  "data": {
    "claim": {
      "spaceId": "string",
      "title": "string",
      "liveUrl": "string"
    },
    "clientId": "string",
    "expiresAt": "2019-08-24T14:15:22Z",
    "origin": "string",
    "requestedAccess": {
      "profile": "read",
      "scopes": [
        "teams:read"
      ]
    },
    "status": "pending"
  }
}

Error Response

{
  "$schema": "http://example.com",
  "type": "string",
  "title": "string",
  "status": -9007199254740991,
  "detail": "string",
  "code": "string",
  "pointer": "string",
  "details": {
    "property1": null,
    "property2": null
  },
  "suggestions": [
    "string"
  ],
  "next": [
    "string"
  ],
  "requestId": "string"
}