Show which application a pending user code belongs to.

POST

/api/devices/lookup

Code sample: Shell / cURL

curl --request POST \
  --url https://auth.example.com/api/devices/lookup \
  --header 'Content-Type: application/json' \
  --cookie authrim_session=<authrim_session> \
  --data '{ "user_code": "WDJB-MJHT" }'

Lets the signed-in user see the application and the scopes a user code asks for before deciding it with /api/devices/verify. It decides nothing. It needs the same session as the decision, and a code that does not exist counts against the same per-IP user code rate limit (429 slow_down once blocked). A code that is no longer pending returns 400 invalid_code with its state in code_status (approved, denied or expired) and decided_by_self, true only when the signed-in user is the one who approved it (a denial records no user), so a browser that lost the answer to its approval can tell whether it was saved; who else decided a code is never disclosed. An unknown or expired code returns 404 invalid_code. Without a working rate limiter, or when the device code store cannot answer, it returns 503 temporarily_unavailable.

Authorizations

• sessionCookie
• sessionHeader

Request Body ^required

Media type application/json

object

user_code

required

The user code as shown on the device, in any case, with or without the hyphens and spaces between the groups (4 to 16 letters and digits). Only the form is checked; see DeviceVerifyRequest.

string

Example

{
  "user_code": "WDJB-MJHT"
}

Responses

200

Successful JSON response.

Media type application/json

object

client_id

required

string

client_name

required

string

client_uri

string format: uri

logo_uri

string format: uri

scopes

required

Array<string>

expires_at

required

Epoch milliseconds.

integer

Example

{
  "client_id": "client_123",
  "client_name": "Acme TV",
  "client_uri": "https://tv.example.com",
  "logo_uri": "https://tv.example.com/logo.png",
  "scopes": [
    "openid",
    "profile"
  ],
  "expires_at": 1770000600000
}

400

OAuth error response.

Media type application/json

object

error

required

string

error_description

string

Example ^generated

{
  "error": "example",
  "error_description": "example"
}

401

OAuth error response.

Media type application/json

object

error

required

string

error_description

string

Example ^generated

{
  "error": "example",
  "error_description": "example"
}

404

OAuth error response.

Media type application/json

object

error

required

string

error_description

string

Example ^generated

{
  "error": "example",
  "error_description": "example"
}

429

OAuth error response.

Media type application/json

object

error

required

string

error_description

string

Example ^generated

{
  "error": "example",
  "error_description": "example"
}

503

OAuth error response.

Media type application/json

object

error

required

string

error_description

string

Example ^generated

{
  "error": "example",
  "error_description": "example"
}