---
title: "Device Confirm"
method: POST
path: "/api/v1/oauth/device/confirm"
tags: ["oauth2-server"]
---

# Device Confirm

`POST /api/v1/oauth/device/confirm`

## Request

- Base URL: `https://memory.kagura-ai.com` (the document declares no server; this is the origin it was published from)
- URL: `https://memory.kagura-ai.com/api/v1/oauth/device/confirm`
- Auth: none declared

User consent endpoint for device authorization.

Requires session authentication. Sets authorized_at or denied_at on the
device code record so the polling CLI receives the decision. Every
approval emails the user a security notice after the commit (Issue #1752):
a device code can be phished (the attacker starts the flow and gets the
victim to approve the code), so unlike authorization-code consent this is
not limited to the first grant; coalescing bounds the volume. Scheduling
the notice touches no DB, so nothing here runs sync DB work for it.

The database work runs in a worker thread (#1770): the approval
share-locks the owner's ``users`` row and may wait on a reset holding it.

## Request body

- DeviceConfirmRequest: User consent decision for a pending device authorization.
  - `user_code` string, required
  - `approve` boolean

## Response `200`

Successful Response

- DeviceConfirmResponse: Result of user consent decision.
  - `status` unknown, required
  - `user_code` unknown, required

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/kagura-ai/apis/kagura-memory-cloud.md) · [All operations](https://skmtc.dev/kagura-ai/apis/kagura-memory-cloud/llms.txt) · [OpenAPI document](https://skmtc.dev/kagura-ai/apis/kagura-memory-cloud/revisions/09f17f5ada29?raw)