Approve a hosted gateway sign-on into one of the customer's workspaces
From the page itself: the request must carry Sec-Fetch-Site: same-origin (same-site is refused: the session cookie reaches every
subdomain) or, without it, an Origin that is the web application's
own (the web proxy forwards the browser's headers), and a JSON body
(415 JSON_CONTENT_TYPE_REQUIRED otherwise, so no form can send it).
The session must come from a sign-in that proved its email (an email
code, a password, Accounts, or an OAuth provider that asserted the
address verified; otherwise 403 VERIFIED_EMAIL_REQUIRED, sign in
again), that email must equal the request's owner email
(case-insensitive), and the user must be ADMIN or above in org_id, a
workspace on a paid plan (org_entitlements.plan_code; a Stripe
subscription in trialing counts as its plan) whose entitlement
Accounts holds active, all read at approval. On success the session
is bound to org_id (a new account-session cookie is set when it was
bound elsewhere), so the console's key list and billing show the
workspace that now holds the gateway's key.
Authorization
AccountSessionCookie The signed HttpOnly account session the web app holds after sign-in (also accepted as a Bearer acct_ token).
In: cookie
Request Body
application/json
length <= 32uuidResponse Body
application/json
application/json
application/json
application/json
application/json
application/json
application/json
application/json
application/json
application/json
application/json
curl -X POST "https://example.com/v1/hosted-gateway/authorizations/approve" \ -H "Content-Type: application/json" \ -d '{ "user_code": "string", "org_id": "a40f5d1f-d889-42e9-94ea-b9b33585fc6b" }'{ "status": "approved", "authorization_id": "be63c26c-03c0-4635-ae2b-58f14bd033f9", "org_id": "a40f5d1f-d889-42e9-94ea-b9b33585fc6b", "org_name": "string", "tenant_label": "string", "tenant_host": "string", "approved_at": "2019-08-24T14:15:22Z", "session_org_id": "a051a9ed-5c73-492a-a0ba-3ff5805fe4af", "session_rebound": true}Read a hosted gateway sign-on request by its user code (signed-in customer) POST
What the approval page shows: the tenant and its host, the upstream origin, the operator who asked, when it expires, exactly what the gateway records (`disclosure`), and the signed-in user's workspaces with whether each can take the key by the rules the database answers (ADMIN or above, a paid plan, API access); Accounts' entitlement is asked at approval. The owner email is shown in full only to that owner, and workspaces are listed only for them. Never returns the device code. A POST so the user code is never in a URL (and so never in a request log line), from the page itself: `Sec-Fetch-Site: same-origin` (or, without it, the web application's own `Origin`) and a JSON body, as approve requires.
Deny a hosted gateway sign-on request (signed-in owner) POST
From the page itself (same-origin, JSON body, as approve), by the owner the request names, signed in by a sign-in that proved the email; the operator's next poll answers `access_denied`.