Start a hosted gateway sign-on for a paying tenant (fleet operator)

Device-authorization grant (RFC 8628 shaped) by which a paying tenant of the AgentSafe hosted gateway fleet receives its workspace key without anyone copying one. The fleet operator (Tenant.py) starts it with a Microsoft Entra access token for api://decionis-operator/Operator.Act whose roles holds the operator role; who asked (oid, sign-in name) is recorded from the verified token, never from the body, and a body naming a requester is refused. The customer then approves at verification_uri_complete while signed in to Decionis as owner_email by a sign-in that proved that address, ADMIN or above in a workspace on a paid plan with an active entitlement, and the operator polls the token endpoint. Codes live 30 minutes; poll every interval seconds. Twenty starts per hour per operator. Without Entra configuration (DECIONIS_OPERATOR_ENTRA_TENANT_ID, DECIONIS_OPERATOR_ENTRA_CLIENT_ID, and a well-formed DECIONIS_OPERATOR_ENTRA_CLIENT_APPS when set) every call answers 503 OPERATOR_AUTH_NOT_CONFIGURED.

post/v1/hosted-gateway/authorizations

Request

  • Base URL: https://api.decionis.com
  • URL: https://api.decionis.com/v1/hosted-gateway/authorizations
  • Auth: HTTP bearer

Request body

tenant_labelstring required

The tenant id in the fleet registry; www, api, status, admin and console are reserved.

tenant_hoststring required

Where the tenant is served, <tenant_label>.<fleet domain>.

upstreamstring required

The tenant's upstream, https without credentials, query or fragment; its origin is what the customer is shown and approves.

owner_emailstring email required

Only a signed-in user with exactly this email (case-insensitive) may approve or deny.

max_embedded_body_bytesinteger

The tenant's embedding limit, so the approval page states it exactly.

Example request

{
  "tenant_label": "acme",
  "tenant_host": "acme.decionisedge.com",
  "upstream": "https://api.acme.example"
}

Response

The authorization; device_code stays with the operator, the customer is sent verification_uri_complete (or the URI and user_code)

authorization_idstring uuid required
device_codestring required

Kept by the operator for polling; never shown to the customer or logged.

user_codestring required
verification_uristring uri required
verification_uri_completestring uri required
expires_in1800 required
interval5 required

Example response

{
  "verification_uri": "https://decionis.com/connect/edge",
  "verification_uri_complete": "https://decionis.com/connect/edge?code=BCDF-GHJK"
}

Changes

No recorded changes to this operation across all 1 revision of this API.