> ## Documentation Index > Fetch the complete documentation index at: https://docs.app.strix.ai/llms.txt > Use this file to discover all available pages before exploring further. # Poll a CLI sign-in > Exchange a device code for a personal API token. While the user has not approved the sign-in, the response is 400 with an `error` field of `authorization_pending` or `slow_down` — wait for the returned interval and poll again. `access_denied` and `expired_token` are terminal. On approval, the endpoint provisions the user and a default organization when needed, and returns a personal API token with a 90 day expiry. Set `interactive` to true to get a workspace list and a scope catalog instead of a token, then finish with POST /cli/login/complete. This endpoint does not require authentication. ## OpenAPI ````yaml /openapi.json post /cli/login/poll openapi: 3.1.0 info: title: Strix API version: 1.0.0 description: >- Public REST API for the Strix autonomous penetration testing platform. Manage scans, vulnerabilities, assets, schedules, API tokens, and webhooks. servers: - url: /api/v1 description: Strix v1 API security: - BearerAuth: [] tags: - name: Scans description: Launch, monitor, and manage security scans. - name: Vulnerabilities description: View and triage discovered vulnerabilities. - name: Assets description: Domains and repositories registered for scanning. - name: Schedules description: Recurring scan schedules (Pro plan). - name: Search description: Search across issues, pentests, PR reviews, chats, assets and schedules. - name: Tokens description: Manage API tokens for authentication. - name: Webhooks description: Configure webhook subscriptions for real-time event notifications. - name: Organization description: Workspace configuration for the authenticated organization. - name: Members description: Manage organization members and roles. - name: Invitations description: List and revoke organization invitations. - name: PR Reviews description: Automated security review of pull requests. - name: Connectors description: Network connectors for scanning internal/private targets. - name: Knowledge description: >- Organization knowledge base: documents, policies, and repo profiles that steer the agent. - name: Uploads description: Upload source/code/documentation archives for whitebox scans. - name: Integrations description: Third-party integrations (GitLab, Bitbucket, ticketing). - name: Chat description: Conversational agent sessions. - name: Analytics description: Aggregate dashboard analytics. - name: Test Users description: >- Per-domain test accounts (with optional MFA) the agent authenticates as during scans. - name: License description: Self-hosted license state, entitlements, and aggregate usage. - name: Supply Chain description: >- SBOM inventory, supply-chain findings, scans, and policy for connected repositories. - name: CLI description: >- Device authorization endpoints that let the Strix CLI and coding agents sign in and receive an API token. - name: Billing description: Credit balance, agent-payable top-ups, and automatic top-up settings. - name: Workspaces description: List, create, and switch workspaces. - name: Asset Discovery description: >- Passive reconnaissance runs that map the organization's external attack surface, and the discovered-asset inventory they fill. - name: Containers description: >- Container registries, tracked images, image scans, findings, and SBOM components. - name: Run Logs description: Persisted engine logs and the diagnostics bundle of a self-hosted install. paths: /cli/login/poll: post: tags: - CLI summary: Poll a CLI sign-in description: >- Exchange a device code for a personal API token. While the user has not approved the sign-in, the response is 400 with an `error` field of `authorization_pending` or `slow_down` — wait for the returned interval and poll again. `access_denied` and `expired_token` are terminal. On approval, the endpoint provisions the user and a default organization when needed, and returns a personal API token with a 90 day expiry. Set `interactive` to true to get a workspace list and a scope catalog instead of a token, then finish with POST /cli/login/complete. This endpoint does not require authentication. operationId: pollCliLogin requestBody: required: true content: application/json: schema: type: object properties: device_code: type: string description: >- Device code from POST /cli/login. Never show this code to the user. scopes: type: array items: $ref: '#/components/schemas/ApiV1Scope' description: >- Optional scopes for the minted token. The server always includes the minimum scopes scans:read, scans:write, and billing:read. The member's role limits the final set. Without this field, the server applies a default scope set. scope_profile: $ref: '#/components/schemas/CliScopeProfile' client_instance_id: type: string minLength: 8 maxLength: 128 description: >- Opaque stable identifier for this CLI installation. Send with device_name to reuse one session row on later sign-ins. device_name: type: string minLength: 1 maxLength: 80 description: >- Privacy-safe device label shown in API Access. Required with client_instance_id. interactive: type: boolean description: >- When true, approval returns `selection_required` with the user's workspaces, the scope catalog, and a short-lived `selection_token` instead of a token. Finish with POST /cli/login/complete. required: - device_code responses: '200': description: >- Sign-in complete, or a selection step when `interactive` is true. The `api_token` field contains the raw secret — store it securely. content: application/json: schema: oneOf: - $ref: '#/components/schemas/CliLoginResult' - $ref: '#/components/schemas/CliLoginSelection' '400': description: >- The device code is missing, pending, expired, or denied. The `error` field carries the OAuth error code. content: application/json: schema: type: object properties: detail: type: string error: type: string '429': description: Too many requests from this client. Wait and retry. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' '500': $ref: '#/components/responses/InternalError' security: [] components: schemas: ApiV1Scope: type: string enum: - scans:read - scans:write - vulnerabilities:read - vulnerabilities:write - dependencies:read - schedules:read - schedules:write - assets:read - assets:write - organizations:read - organizations:write - members:read - members:write - invitations:read - invitations:write - webhooks:read - webhooks:write - tokens:write - audit:read - pr_reviews:read - pr_reviews:write - connectors:read - connectors:write - knowledge:read - knowledge:write - uploads:write - integrations:read - integrations:write - chat:read - chat:write - scans:message - analytics:read - llm:read - llm:write - test_users:read - test_users:write - discovery:read - discovery:write - license:read - supply_chain:read - supply_chain:write - billing:read - billing:write - containers:read - containers:write - logs:read CliScopeProfile: type: string enum: - minimal - recommended - full - custom description: >- Named CLI authority preference. Minimal grants scans and billing:read. Recommended adds every scope that everyday `strix cloud` commands use: vulnerabilities, dependencies, supply chain, schedules, assets, knowledge, PR reviews, connectors, chat, uploads, integrations, analytics, license, webhooks:read, audit:read, organizations:read, organizations:write, and billing:write. Full means the session's approved ceiling after login and adds account administration (members, invitations, tokens, webhooks:write, LLM, test users). Custom requires an explicit scopes array. The member's role caps every profile. CliLoginResult: type: object properties: api_token: type: string description: Raw personal API token secret. Only returned at sign-in time. organization_id: type: string organization_name: type: string email: type: string expires_at: type: string format: date-time description: Expiry of the API token. is_new_user: type: boolean description: True when this sign-in created the account. scopes: type: array items: $ref: '#/components/schemas/ApiV1Scope' description: Scopes granted to the minted token. scope_ceiling: type: array items: $ref: '#/components/schemas/ApiV1Scope' description: Maximum authority approved for this session at login. requested_scopes: type: array items: $ref: '#/components/schemas/ApiV1Scope' scope_profile: $ref: '#/components/schemas/CliScopeProfile' token_id: type: string format: uuid credential_source: type: string enum: - api - cli device_name: type: - string - 'null' onboarding: $ref: '#/components/schemas/CliOnboardingState' description: >- Setup state of the workspace that received the token. Omitted when the server cannot read the live workspace state. The token is still valid in that case. next_steps_hint: type: string description: >- One short paragraph with the first commands to run after sign-in. When the workspace still has its default name, the text names the rename command for a session with organizations:write, and tells other sessions to ask a workspace admin or to sign in again with the full profile. When `onboarding.github_install_url` is present, the text tells the person to open the link. When the session also has integrations:write, the text names the command that creates a new link. When the workspace can still start the Cloud plan trial and the new session can call the billing checkout operation, the text also offers the trial. The session must have the billing:write scope and no asset scopes. next_steps: type: array items: $ref: '#/components/schemas/CliNextStep' description: >- Suggested first actions, in order. Each item names the CLI command and the matching API operation. Setup steps come first: name the workspace when the session has organizations:write and the workspace still has its default name, and connect GitHub when the session has integrations:write, no asset scopes, and `onboarding.github_install_url` is present. A deployment without the GitHub App never gets the GitHub step. When the workspace can still start the Cloud plan trial and the new session can call the billing checkout operation, the last item starts the trial. The session must have the billing:write scope and no asset scopes. dashboard_url: type: string format: uri description: URL of the Strix dashboard. required: - api_token - organization_id - organization_name - email - expires_at - is_new_user - scopes - scope_ceiling - requested_scopes - scope_profile - token_id - credential_source CliLoginSelection: type: object description: >- Selection step of an interactive CLI sign-in. Show the workspaces and the scope catalog to the user, then finish with POST /cli/login/complete. properties: selection_required: type: boolean description: Always true for this response shape. selection_token: type: string description: Short-lived token for POST /cli/login/complete. expires_in: type: integer description: Lifetime of the selection token in seconds. is_new_user: type: boolean description: >- True when this sign-in created the account. The CLI can then offer the first-time setup prompts. organizations: type: array items: $ref: '#/components/schemas/CliWorkspaceOption' description: Workspaces the user is a member of. scopes: type: array items: $ref: '#/components/schemas/CliScopeOption' description: >- Catalog of all scopes with descriptions, defaults, and role requirements. required: - selection_required - selection_token - expires_in - is_new_user - organizations - scopes ErrorResponse: type: object properties: detail: type: string description: Human-readable explanation of the error. code: type: string description: >- Stable machine-readable error code. `insufficient_scope` means the token does not hold the scope that this endpoint requires. required_scope: $ref: '#/components/schemas/ApiV1Scope' description: >- Scope that the caller must add to the token. Returned with the `insufficient_scope` code. docs: type: string format: uri description: Documentation page that explains how to resolve the error. hint: type: string description: >- One instruction that resolves the error. For `insufficient_scope`, a CLI session gets the `strix cloud session scopes set full` or `strix cloud login --scope-profile full` command, and an API token gets the settings page where the user creates a token with the scope. When the owner's role cannot hold the scope, the hint asks for a role change instead. required: - detail CliOnboardingState: type: object description: >- Setup state of the workspace that received the token. The server computes it from live data on every sign-in, so it is correct for new and returning users. When the server cannot read the live state, the sign-in response omits this object instead of reporting unverified values. properties: workspace_named: type: boolean description: >- False while the workspace still has the name the server generated at sign-up, for example `Alex's Workspace`. The server records the origin of the name, so a later profile change does not alter this value. Rename the workspace with PATCH /organization. repositories_connected: type: boolean description: >- True when at least one repository has an active installation in the workspace. Repositories from a disconnected installation do not count. domains_added: type: boolean description: True when at least one domain is added to the workspace. github_install_url: type: string format: uri description: >- Link to install the Strix GitHub App on the workspace. Present for an admin session without asset scopes while no repository is connected. A person opens the link in a browser. When the browser has no dashboard session, the dashboard asks the person to sign in with the same account and returns to the installation. The new browser session is bound to this workspace. The link expires after 10 minutes. POST /integrations/github/install-url creates a new one. Absent when this deployment has no GitHub App. required: - workspace_named - repositories_connected - domains_added CliNextStep: type: object properties: action: type: string description: What the step does, for example `List your workspaces`. cli: type: string description: The Strix CLI command for this step. method: type: string enum: - GET - POST - PATCH path: type: string description: The API path for this step, relative to the API root. required: - action - cli - method - path CliWorkspaceOption: type: object properties: id: type: string name: type: string role: type: string enum: - admin - analyst - viewer description: >- The user's role in this workspace. The role limits which scopes the token can receive. has_default_name: type: boolean description: >- True when the user is an admin and the workspace still has the generated default name, for example `Alex's Workspace`. Offer a `workspace_name` on POST /cli/login/complete. required: - id - name - role - has_default_name CliScopeOption: type: object properties: scope: $ref: '#/components/schemas/ApiV1Scope' description: type: string description: Plain-language description of what the scope allows. minimum: type: boolean description: True when the server always includes this scope. default: type: boolean description: True when this scope is part of the default set. min_role: type: string enum: - admin - analyst - viewer description: Lowest role that can receive this scope. required: - scope - description - minimum - default - min_role responses: InternalError: description: Internal server error. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' securitySchemes: BearerAuth: type: http scheme: bearer description: >- API token obtained from the Tokens endpoint or CLI device login. Include as `Authorization: Bearer `. Requests made with a managed CLI session also include `X-Strix-Workspace: ` to pin a process to the workspace it started in; recovery endpoints report the current workspace after a concurrent switch. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.