---
title: "Complete Device Authorization"
method: POST
path: "/api/{serviceId}/device/complete"
tags: ["Device Flow"]
---

# Complete Device Authorization

`POST /api/{serviceId}/device/complete`

This API returns information about what action the authorization server should take after it receives
the result of end-user's decision about whether the end-user has approved or rejected a client
application's request.

## Path parameters

- `serviceId` string, required

## Request body

- DeviceCompleteRequest
  - `userCode` string, required — A user code.
  - `result` 'TRANSACTION_FAILED' | 'ACCESS_DENIED' | 'AUTHORIZED', required — The result of the end-user authentication and authorization. One of the following. Details are described in the description.
  - `subject` string, required — The subject (= unique identifier) of the end-user.
  - `sub` string — The value of the sub claim that should be used in the ID token.
  - `authTime` integer — The time at which the end-user was authenticated. Its value is the number of seconds from `1970-01-01`.
  - `acr` string — The reference of the authentication context class which the end-user authentication satisfied.
  - `claims` string — Additional claims which will be embedded in the ID token.
  - `properties` Property[] — The extra properties associated with the access token.
    - `key` string — The key part.
    - `value` string — The value part.
    - `hidden` boolean — The flag to indicate whether this property hidden from or visible to client applications. If `true`, this property is hidden from client applications. Otherwise, this property is visible to client applications.
  - `scopes` string[] — Scopes to replace the scopes specified in the original device authorization request with. When nothing is specified for this parameter, replacement is not performed.
  - `errorDescription` string — The description of the error. If this optional request parameter is given, its value is used as the value of the `error_description` property, but it is used only when the result is not `AUTHORIZED`. To comply with the specification strictly, the description must not include characters outside the set `%x20-21 / %x23-5B / %x5D-7E`.
  - `errorUri` string — The URI of a document which describes the error in detail. This corresponds to the `error_uri` property in the response to the client.
  - `idtHeaderParams` string — JSON that represents additional JWS header parameters for ID tokens.
  - `consentedClaims` string[] — the claims that the user has consented for the client application to know.
  - `jwtAtClaims` string — Additional claims that are added to the payload part of the JWT access token.
  - `accessTokenDuration` integer — The duration (in seconds) of the access token that may be issued as a result of the Authlete API call. When this request parameter holds a positive integer, it is used as the duration of the access token in. In other cases, this request parameter is ignored.
  - `refreshTokenDuration` integer — The duration (in seconds) of the refresh token that may be issued as a result of the Authlete API call. When this request parameter holds a positive integer, it is used as the duration of the refresh token in. In other cases, this request parameter is ignored.
  - `idTokenAudType` string — The type of the `aud` claim of the ID token being issued. Valid values are as follows. | Value | Description | | ----- | ----------- | | "array" | The type of the aud claim is always an array of strings. | | "string" | The type of the aud claim is always a single string. | | null | The type of the aud claim remains the same as before. | This request parameter takes precedence over the `idTokenAudType` property of the service.

## Response `200`

- DeviceCompleteResponse
  - `resultCode` string — The code which represents the result of the API call.
  - `resultMessage` string — A short message which explains the result of the API call.
  - `action` 'SERVER_ERROR' | 'USER_CODE_NOT_EXIST' | 'USER_CODE_EXPIRED' | 'INVALID_REQUEST' | 'SUCCESS' — The next action that the authorization server implementation should take.
  - `consentedClaims` string[] — the claims that the user has consented for the client application to know.

## Other responses

- `400`
- `401`
- `403`
- `429` — The request exceeded the request rate permitted for the endpoint.
- `500`

## Changes

- **2026-08-03** `7ad74ab64749` — 2 info
  - added the non-success response with the status `429`
  - added the optional property `consentedClaims` to the response with the `200` status

[Change history](https://skmtc.dev/authlete/apis/authlete-api/changes/api/:serviceId/device/complete/post.md)

---

[API](https://skmtc.dev/authlete/apis/authlete-api.md) · [All operations](https://skmtc.dev/authlete/apis/authlete-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/authlete/authlete-api/revisions/7ad74ab64749/schema)