Offline Access Device Endpoints

These routes manage local OAuth device and offline-access records and token pickup.

They are public direct APIs on api.user.m7.org, but they are not the same thing as the public sso.user.m7.org /device_authorization endpoint.

Current live endpoints:

  • /oauth/device/issue
  • /oauth/device/pickup
  • /oauth/device/refresh/bundle
  • /oauth/device/revoke
  • /oauth/device/search
  • /oauth/device/search/app
  • /oauth/device/search/user
  • /oauth/device/update
  • /oauth/device/view

Endpoint Summary

Route What it does Notes
/oauth/device/issue Creates or starts a local offline-access device grant. Token-mint-adjacent endpoint used by current offline-access flows.
/oauth/device/pickup Picks up the token package for an approved device grant. Returns success or grant errors such as revoked, closed, or abandoned state.
/oauth/device/refresh/bundle Refreshes or rotates the stored bundle for an offline-access device grant. Current token-rotation helper for this family.
/oauth/device/revoke Revokes a device or offline-access grant. Lifecycle helper.
/oauth/device/search Searches device or offline-access grants. General search helper.
/oauth/device/search/app Searches device or offline-access grants owned by an app-owner view. First-party app-owner helper.
/oauth/device/search/user Searches device or offline-access grants from a user view. First-party user helper. Supports limit, page_number, offset, and cursor.
/oauth/device/update Updates device or offline-access record metadata or state. Management helper.
/oauth/device/view Returns one device or offline-access record. Detail helper.

/oauth/device/issue

Purpose:

  • start a device or offline-access grant under the current principal context

Principal context may be:

  • a signed-in user
  • a supported machine principal acting through the shared auth layer

/oauth/device/pickup

Purpose:

  • redeem a local device or offline-access record into access and refresh output
  • backfill local token metadata after successful pickup

Consumer note:

  • this is the current pickup endpoint for the local offline-access device family
  • it handles common local error states such as revoked, closed, or abandoned grants

/oauth/device/refresh/bundle

Purpose:

  • rotate or refresh the locally tracked token bundle tied to an offline-access device record

Consumer note:

  • this remains part of the active current token surface
  • it should not be treated as a legacy stray endpoint

Search / View / Update / Revoke

These routes are management helpers around the same offline-access record family.

Use them when you need to:

  • inspect one device grant
  • list active grants
  • list grants by app-owner or user perspective
  • update a grant record
  • revoke or close a grant
1