---
title: "R1's handover: the daemon exchanges the session an older desktop stored for its own credential, once"
method: POST
path: "/v1/devices/exchange"
tags: ["devices"]
---

# R1's handover: the daemon exchanges the session an older desktop stored for its own credential, once

`POST /v1/devices/exchange`

## Request

- Base URL: `https://api.sixminute.ai` (the document declares no server; this is the origin it was published from)
- URL: `https://api.sixminute.ai/v1/devices/exchange`
- Auth: HTTP bearer

The stored session of a desktop older than R1, as the bearer; no page sign-in and no code. Any request carrying `Origin` is refused (403), and a device credential is not a session (401). The device must be one the person registered from a desktop older than R1 and last called from at such a version, and that never held a credential of its own: an unknown id, or one last seen at R1 or later, is 403; one that ever enrolled is 409 `session-exchanged`. Once per device and once per session: a second exchange is 409 `session-exchanged`, except the same session for the same device again (an answer that was lost), which answers 200 with a fresh credential and stops the first. A `device_id` registered to another person is 409 `conflict` and that device is left as it was; a revoked device is 403. The credential is answered once and stored as its hash. Deleted at phase 7.

## Request body

- object
  - `device_id` string, required
  - `name` string, required
  - `platform` 'macos' | 'windows' | 'ios' | 'android' | 'web', required

## Response `200`

The same session for the same device again (its first answer was lost): a fresh credential, the first one stopped.

- object
  - `credential` string, required
  - `device` object, required
    - `id` string, required
    - `user_id` string, required
    - `name` string, required
    - `platform` 'macos' | 'windows' | 'ios' | 'android' | 'web', required
    - `created_at` string, date-time, required
    - `last_seen_at` string, date-time, nullable
    - `revoked_at` string, date-time, nullable
  - `account` string
  - `tenant_id` string

## Other responses

- `201`: The credential, shown once, and the device.
- `400`: The body, query or path did not validate; `errors` lists the fields.
- `401`: No bearer token, or one that does not verify or has expired.
- `403`: The token verified but may not do this: no organisation, not provisioned, wrong role, or a device problem.
- `409`: The id or the email already belongs to something else.

---

[API](https://skmtc.dev/sixminute/apis/sixminute-api.md) - [All operations](https://skmtc.dev/sixminute/apis/sixminute-api/llms.txt) - [OpenAPI document](https://skmtc.dev/sixminute/apis/sixminute-api/revisions/605577eadc10?raw)