---
title: "Poll a hosted gateway sign-on for its workspace key (fleet operator)"
method: POST
path: "/v1/hosted-gateway/authorizations/token"
---

# Poll a hosted gateway sign-on for its workspace key (fleet operator)

`POST /v1/hosted-gateway/authorizations/token`

## Request

- Base URL: `https://api.decionis.com`
- URL: `https://api.decionis.com/v1/hosted-gateway/authorizations/token`
- Auth: HTTP bearer

The operator's poll, with the same Entra token as the start: a device
code redeems only for the operator who started it. Until the customer
decides, it answers `authorization_pending` (or `slow_down`, with a
5 s wider `interval`, when polled sooner than the interval allows).
Once approved, the next poll first applies approval's workspace rules
again (the approver ADMIN or above, a paid plan, an active
entitlement); a workspace that no longer qualifies denies the
authorization (`access_denied` with a `reason`), and Accounts being
unreachable answers 503 `temporarily_unavailable` to retry, nothing
minted. Otherwise it mints the key in the same transaction that
consumes the authorization and makes it the tenant's current key (one
per organization and tenant label), and returns it exactly once: a
MEMBER key named `agentsafe-hosted-<tenant_label>` with scopes
`["decision:shadow"]`, created by the approver. The key expires at
`confirm_by` (10 minutes) unless the holder calls
POST /v1/hosted-gateway/keys/confirm with it, so a key whose delivery
was never confirmed does not stay active. The tenant's earlier keys
(`replaced_key_ids`) stay live until that confirmation revokes them,
except one that was itself never delivered, which is revoked now; a
new key that is lost in transit never leaves the tenant without one.
Later polls answer `invalid_grant`. Sixty polls per minute per
operator.

## Request body

- HostedGatewayTokenRequest
  - `device_code` string, required
  - `grant_type` 'urn:ietf:params:oauth:grant-type:device_code'

## Response `200`

The workspace key; it appears only here

- HostedGatewayIssuedKey
  - `api_key` string, required: The raw key, returned exactly once. Never stored by Decionis.
  - `key_id` string, uuid, required
  - `key_name` string, required
  - `org_id` string, uuid, required
  - `org_name` string, required
  - `tenant_label` string, required
  - `tenant_host` string, required
  - `upstream_origin` string, uri, required: The upstream origin the customer approved; the tenant is held to it.
  - `max_embedded_body_bytes` integer, required: The request-body embedding limit the customer approved.
  - `approved_by_email` string, email, required
  - `approved_at` string, date-time, required
  - `role` 'MEMBER', required
  - `scopes` string[], required
  - `confirm_by` string, date-time, required: The key expires then unless POST /v1/hosted-gateway/keys/confirm is called with it.
  - `replaced_key_ids` string[], required: The tenant's earlier keys in this workspace that this key replaces. One that was never delivered is revoked by this redemption; the others stay live until POST /v1/hosted-gateway/keys/confirm with this key revokes them.

## Other responses

- `400`: An RFC 8628 / RFC 6749 token error
- `401`: OPERATOR_TOKEN_REQUIRED or OPERATOR_TOKEN_INVALID
- `403`: OPERATOR_ROLE_REQUIRED or OPERATOR_CLIENT_NOT_ALLOWED
- `429`: Structured API error
- `503`: `{"error": "temporarily_unavailable"}` when Accounts could not confirm the workspace's entitlement (nothing was minted; poll again), or OPERATOR_AUTH_NOT_CONFIGURED, OPERATOR_AUTH_UNAVAILABLE, HOSTED_GATEWAY_RATE_LIMIT_UNAVAILABLE

---

[API](https://skmtc.dev/decionis/apis/decionis-policy-evaluation-api.md) · [All operations](https://skmtc.dev/decionis/apis/decionis-policy-evaluation-api/llms.txt) · [OpenAPI document](https://skmtc.dev/decionis/apis/decionis-policy-evaluation-api/revisions/357f5e459d0c?raw)