Deny a CLI authorization

POST

/v1/cli/authorizations/{authorizationId}/deny

const url = 'https://api.aetherpush.com/v1/cli/authorizations/2489E9AD-2EE2-8E00-8EC9-32D5F69181C0/deny';
const options = {method: 'POST', headers: {Authorization: 'Bearer <token>'}};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}

curl --request POST \
  --url https://api.aetherpush.com/v1/cli/authorizations/2489E9AD-2EE2-8E00-8EC9-32D5F69181C0/deny \
  --header 'Authorization: Bearer <token>'

Marks the request denied. The device flow learns it on its next poll; the loopback flow is told through the redirect URI in the response, since it does not poll.

Authorizations

accessKeyAuth

Parameters

Path Parameters

authorizationId

required

string format: uuid

Responses

200

Denied.

application/json

object

status

required

string

Allowed values: denied

mode

required

string

Allowed values: pkce device

redirectUri

Present for pkce only. The browser navigates here so the waiting CLI learns it was denied instead of sitting until its request expires. Carries error=access_denied and the state, never a code.

string

Example

{
  "status": "denied",
  "mode": "pkce",
  "redirectUri": "http://127.0.0.1:49152/callback?error=access_denied&state=u8Kq3rN1sVx2"
}

401

The bearer token is missing, invalid, or expired.

application/json

object

error

required

Human-readable error message.

string

requestId

Unique identifier for the request, also exposed as the X-Request-Id response header.

string

Example

{
  "error": "The requested resource was not found.",
  "requestId": "req_abc123"
}

403

API keys and named access keys receive a plain 403. A login session that is not a dashboard login session receives code dashboard_session_required.

application/json

One of:

object
object

object

error

required

Human-readable error message.

string

requestId

Unique identifier for the request, also exposed as the X-Request-Id response header.

string

Returned after login-session validation when a valid session that is not a dashboard login session tries to issue or widen an API key, create an access key or change its lifetime, enrol a passkey or authenticator app, start a passkey step-up challenge, or run the CLI device ceremony. Endpoints that enforce both guards reject API keys and named access keys earlier with a plain 403 response and no code. API-key creation applies only the dashboard-session guard, so any non-dashboard credential receives this response there. Listing, renaming and revoking stay open to any login session. Sessions created before the credential_origin column existed cannot be attributed to the dashboard and are also refused; signing out and back in fixes that.

object

error

required

string

code

required

string

Allowed values: dashboard_session_required

requestId

string

Example

{
  "error": "The requested resource was not found.",
  "requestId": "req_abc123"
}

404

No pending request with that id.

application/json

object

error

required

Human-readable error message.

string

requestId

Unique identifier for the request, also exposed as the X-Request-Id response header.

string

Example

{
  "error": "The requested resource was not found.",
  "requestId": "req_abc123"
}

500

Internal server error.

application/json

object

error

required

Human-readable error message.

string

requestId

Unique identifier for the request, also exposed as the X-Request-Id response header.

string

Example

{
  "error": "The requested resource was not found.",
  "requestId": "req_abc123"
}