Skip to main content
POST
Approve or deny a device code (signed-in browser only)
The human’s decision, submitted by the dashboard approval page. It takes a signed-in browser session — an API key approving a device code would be a key minting a key.
Agents cannot call this. A request carrying an API key instead of a session returns 401 unauthorized. Show your operator human_message and poll POST /device/token.
granted: false denies the code, and the waiting agent’s next poll gets 403 access_denied. Approval issues the live key, and — when a zn_test_ key was attached to the code — moves that sandbox’s orders and key onto the account.

Authorizations

Authorization
string
header
required

Zinc API key (Bearer zn_...)

Headers

authorization
string | null

Body

application/json
user_code
string
required
Required string length: 4 - 16
granted
boolean
required

Response

Successful Response

status
string
required
name
string
required
message
string
required