ControlPlane

Exchange a CLI loopback claim code for the write approval token (PKCE)

The headless-CLI delivery leg (write-approval, v1.87). When a write-intent challenge was opened with loopback params (cli_redirect_uri + code_challenge S256 + state), the gateway-rendered confirm page redirects to the CLI's 127.0.0.1 loopback with a one-time claim code after the passkey tap. The CLI exchanges that code here with its PKCE code_verifier + state; on success the write approval is minted (bound to the challenge's control-plane session + target) and the opaque token returned ONCE. Public endpoint — the code+verifier is the credential; the minted token is still cp-session-bound (dual-header).

post/agent/v1/control-plane/write-approval/cli/token

Request

  • Base URL: https://api.run402.com
  • URL: https://api.run402.com/agent/v1/control-plane/write-approval/cli/token
  • Auth: none declared

Request body

codestring required

The one-time claim code captured on the loopback redirect.

code_verifierstring required

The PKCE S256 verifier whose hash equals the code_challenge sent at challenge issue.

statestring required

The CSRF state sent at challenge issue.

Response

write_approval_token (returned once) + session metadata

object required

Changes

No recorded changes to this operation across all 1 revision of this API.