Poll a CLI sign-in
Exchange a device code for a personal API token. While the user has not approved the sign-in, the response is 400 with an error field of authorization_pending or slow_down — wait for the returned interval and poll again. access_denied and expired_token are terminal. On approval, the endpoint provisions the user and a default organization when needed, and returns a personal API token with a 90 day expiry. Set interactive to true to get a workspace list and a scope catalog instead of a token, then finish with POST /cli/login/complete. This endpoint does not require authentication.
Body
Device code from POST /cli/login. Never show this code to the user.
Optional scopes for the minted token. The server always includes the minimum scopes scans:read, scans:write, and billing:read. The member's role limits the final set. Without this field, the server applies a default scope set.
scans:read, scans:write, vulnerabilities:read, vulnerabilities:write, dependencies:read, schedules:read, schedules:write, assets:read, assets:write, organizations:read, organizations:write, members:read, members:write, invitations:read, invitations:write, webhooks:read, webhooks:write, tokens:write, audit:read, pr_reviews:read, pr_reviews:write, connectors:read, connectors:write, knowledge:read, knowledge:write, uploads:write, integrations:read, integrations:write, chat:read, chat:write, scans:message, analytics:read, llm:read, llm:write, test_users:read, test_users:write, license:read, supply_chain:read, supply_chain:write, billing:read, billing:write Named CLI authority preference. Full means the session's approved ceiling after login; custom requires an explicit scopes array.
minimal, recommended, full, custom Opaque stable identifier for this CLI installation. Send with device_name to reuse one session row on later sign-ins.
8 - 128Privacy-safe device label shown in API Access. Required with client_instance_id.
1 - 80When true, approval returns selection_required with the user's workspaces, the scope catalog, and a short-lived selection_token instead of a token. Finish with POST /cli/login/complete.
Response
Sign-in complete, or a selection step when interactive is true. The api_token field contains the raw secret — store it securely.
- Option 1
- Option 2
Raw personal API token secret. Only returned at sign-in time.
Expiry of the API token.
True when this sign-in created the account.
Scopes granted to the minted token.
scans:read, scans:write, vulnerabilities:read, vulnerabilities:write, dependencies:read, schedules:read, schedules:write, assets:read, assets:write, organizations:read, organizations:write, members:read, members:write, invitations:read, invitations:write, webhooks:read, webhooks:write, tokens:write, audit:read, pr_reviews:read, pr_reviews:write, connectors:read, connectors:write, knowledge:read, knowledge:write, uploads:write, integrations:read, integrations:write, chat:read, chat:write, scans:message, analytics:read, llm:read, llm:write, test_users:read, test_users:write, license:read, supply_chain:read, supply_chain:write, billing:read, billing:write Maximum authority approved for this session at login.
scans:read, scans:write, vulnerabilities:read, vulnerabilities:write, dependencies:read, schedules:read, schedules:write, assets:read, assets:write, organizations:read, organizations:write, members:read, members:write, invitations:read, invitations:write, webhooks:read, webhooks:write, tokens:write, audit:read, pr_reviews:read, pr_reviews:write, connectors:read, connectors:write, knowledge:read, knowledge:write, uploads:write, integrations:read, integrations:write, chat:read, chat:write, scans:message, analytics:read, llm:read, llm:write, test_users:read, test_users:write, license:read, supply_chain:read, supply_chain:write, billing:read, billing:write scans:read, scans:write, vulnerabilities:read, vulnerabilities:write, dependencies:read, schedules:read, schedules:write, assets:read, assets:write, organizations:read, organizations:write, members:read, members:write, invitations:read, invitations:write, webhooks:read, webhooks:write, tokens:write, audit:read, pr_reviews:read, pr_reviews:write, connectors:read, connectors:write, knowledge:read, knowledge:write, uploads:write, integrations:read, integrations:write, chat:read, chat:write, scans:message, analytics:read, llm:read, llm:write, test_users:read, test_users:write, license:read, supply_chain:read, supply_chain:write, billing:read, billing:write Named CLI authority preference. Full means the session's approved ceiling after login; custom requires an explicit scopes array.
minimal, recommended, full, custom api, cli