Xeonr Developer Docs
API SpecificationPRIVATExeonr.auth.private.v1.AutomationService

Approve Device Code

POST
/xeonr.auth.private.v1.AutomationService/ApproveDeviceCode

Approves or denies a pending device authorization request from its user code, on behalf of the key's bound user.

Authorization

BearerAuth
AuthorizationBearer <token>

JWT access token for internal API access. Requires 'private' scope for most endpoints, 'admin' scope for administrative operations.

In: header

Header Parameters

Connect-Protocol-Version*number

Define the version of the Connect protocol

Value in1
Connect-Timeout-Ms?number

Define the timeout, in ms

Request Body

application/json

userCode?string
Length1 <= length <= 32
deny?boolean
[key: string]?never

Response Body

application/json

application/json

curl -X POST "https://auth.xeonr.io/xeonr.auth.private.v1.AutomationService/ApproveDeviceCode" \  -H "Connect-Protocol-Version: 1" \  -H "Content-Type: application/json" \  -d '{}'
{
  "approved": true,
  "clientId": "string",
  "clientName": "string",
  "requestedScopes": [
    "string"
  ],
  "grantedScopes": [
    "string"
  ],
  "droppedScopes": [
    "string"
  ],
  "approvedAs": "string"
}
{
  "code": "not_found",
  "message": "string",
  "details": [
    {
      "type": "string",
      "value": "string",
      "debug": {}
    }
  ]
}

xeonr.auth.private.v1.AutomationService

AutomationService is the surface an application automation key can call. Every method here carries allow_automation_keys and accepts NOTHING else: a portal session, an OAuth access token or a service account token is refused, and a key is refused on every method that does not carry the option. The caller acts as the key's bound user, for the clients of the key's application, and nothing more — the same authorization core the consent screen and the MCP tools use decides what is actually granted. Core only. Edge replicas serve a read-only snapshot and do not mount this service; point automation at the core hostname.

Authorize POST

Completes an OAuth authorization request on behalf of the key's bound user and returns the redirect URL, authorization code and state.