---
title: "Read a hosted gateway sign-on request by its user code (signed-in customer)"
method: POST
path: "/v1/hosted-gateway/authorizations/lookup"
---

# Read a hosted gateway sign-on request by its user code (signed-in customer)

`POST /v1/hosted-gateway/authorizations/lookup`

## Request

- Base URL: `https://api.decionis.com`
- URL: `https://api.decionis.com/v1/hosted-gateway/authorizations/lookup`
- Auth: API key in cookie `decionis_account_session`

What the approval page shows: the tenant and its host, the upstream
origin, the operator who asked, when it expires, exactly what the
gateway records (`disclosure`), and the signed-in user's workspaces
with whether each can take the key by the rules the database answers
(ADMIN or above, a paid plan, API access); Accounts' entitlement is
asked at approval. The owner email is shown in full only to that
owner, and workspaces are listed only for them. Never returns the
device code.

A POST so the user code is never in a URL (and so never in a request
log line), from the page itself: `Sec-Fetch-Site: same-origin` (or,
without it, the web application's own `Origin`) and a JSON body,
as approve requires.

## Request body

- HostedGatewayLookupRequest
  - `user_code` string, required

## Response `200`

The request as the customer sees it

- HostedGatewayLookup
  - `authorization` object, required
    - `authorization_id` string, uuid, required
    - `status` 'pending' | 'approved' | 'denied' | 'expired' | 'consumed', required
    - `user_code` string, required
    - `tenant_label` string, required
    - `tenant_host` string, required
    - `upstream_origin` string, required
    - `owner_email` string, required: In full for the owner; masked (`o***@acme.example`) for anyone else.
    - `requested_by` object, required
      - `name` string, nullable, required: The operator's sign-in name from their verified Entra token.
    - `requested_at` string, date-time, required
    - `expires_at` string, date-time, required
    - `org_id` string, uuid, nullable, required
  - `disclosure` HostedGatewayDisclosure, required
    - `statement` string, required: The paragraph the approval page shows verbatim. It states which requests are evaluated and what each records, that each counts as a governed action on the workspace's plan (`metering`), and that Decionis's shadow verdicts never block or change a request while the gateway itself still refuses requests over its rate or size limits or that it cannot read (`refusals`).
    - `evaluated_methods` string[], required: The methods the gateway evaluates; other requests pass through unrecorded.
    - `metering` string, required: That each evaluated request counts as one governed action on the workspace's plan (within its allowance or billed as overage).
    - `refusals` string, required: What Decionis's verdicts do to a request (nothing, in shadow) and what the gateway itself still refuses (HTTP 429, 413, 400).
    - `recorded` string[], required
    - `json_body_max_bytes` integer, required
    - `header_values_recorded` string[], required
    - `never_recorded` string[], required
    - `key` object, required
      - `name` string, required
      - `role` string, required
      - `scopes` string[], required
      - `power` string, required
    - `disconnect` string, required
  - `approver` object, required
    - `email` string, required
    - `email_matches` boolean, required
    - `session_org_id` string, uuid, required
  - `workspaces` HostedGatewayWorkspace[], required: The signed-in owner's workspaces; empty for anyone else.
    - `org_id` string, uuid, required
    - `name` string, required
    - `role` 'OWNER' | 'ADMIN' | 'MEMBER' | 'VIEWER', required
    - `plan_code` string, required
    - `paid` boolean, required
    - `eligible` boolean, required
    - `refusal` 'HOSTED_GATEWAY_ADMIN_REQUIRED' | 'HOSTED_GATEWAY_PAID_PLAN_REQUIRED' | 'HOSTED_GATEWAY_ENTITLEMENT_INACTIVE' | 'null', nullable, required: By the rules the database answers (role, plan, API access); Accounts' entitlement is asked at approval and may still refuse with HOSTED_GATEWAY_ENTITLEMENT_INACTIVE.
  - `pricing_url` string, uri, required

## Other responses

- `400`: Structured API error
- `401`: Structured API error
- `403`: SAME_SITE_REQUEST_REQUIRED or VERIFIED_EMAIL_REQUIRED
- `404`: Structured API error
- `415`: JSON_CONTENT_TYPE_REQUIRED
- `429`: Structured API error

---

[API](https://skmtc.dev/decionis/apis/decionis-policy-evaluation-api.md) · [All operations](https://skmtc.dev/decionis/apis/decionis-policy-evaluation-api/llms.txt) · [OpenAPI document](https://skmtc.dev/decionis/apis/decionis-policy-evaluation-api/revisions/357f5e459d0c?raw)