---
title: "Read the pending device request a user code names"
method: POST
path: "/api/nodes/device-approvals/lookup"
tags: ["nodes"]
---

# Read the pending device request a user code names

`POST /api/nodes/device-approvals/lookup`

## Request

- Base URL: `https://app.nerdit.ai` (the document declares no server; this is the origin it was published from)
- URL: `https://app.nerdit.ai/api/nodes/device-approvals/lookup`
- Auth: none declared

Answer what the approval screen shows, before anybody has consented.

A read: it charges nothing against the code's attempt budget, because a
person who lands on the page from the link their own terminal printed has
not presented a guess. The budget is spent by approve and deny, which are
presentations; this route's backpressure is the pair of rate limits above.

## Request body

- DeviceApprovalRequest: The one thing all three routes take, and the only place it may travel.
  - `user_code` string, required

## Response `200`

Successful Response

- DeviceApprovalView: Everything the approval screen renders, and nothing that identifies it. No row id, no node id, no account: this is answered to whoever presents the code, and it should tell a wrong guess as little as the 404 does.
  - `credential_fingerprint` string, required
  - `credential_fingerprint_preview` string, required
  - `requested_at` string, date-time, required
  - `requested_ip` string, nullable, required
  - `expires_at` string, date-time, required
  - `reported` ReportedMachine, required: What the requesting machine said about itself. None of it is verified. Every field here is attacker-controlled (D-X16-O23): the mint route that captured them is unauthenticated, so a phisher writes whatever reads best. ``verified`` is typed ``False`` rather than defaulted to it, so no later edit can produce a payload that claims otherwise, and so the console's label — *"reported by the requesting machine — not verified"* — is carried by the contract instead of by a comment.
    - `hostname_hint` string, nullable
    - `daemon_version` string, nullable
    - `os` string, nullable
    - `verified` false

## Other responses

- `401`: Unauthorized
- `403`: Forbidden
- `404`: Not Found
- `422`: Validation Error
- `429`: Too Many Requests

---

[API](https://skmtc.dev/nerdit/apis/nerdit-cloud-web.md) · [All operations](https://skmtc.dev/nerdit/apis/nerdit-cloud-web/llms.txt) · [OpenAPI document](https://skmtc.dev/nerdit/apis/nerdit-cloud-web/revisions/06e3b44b58be?raw)