> ## Documentation Index
> Fetch the complete documentation index at: https://developers.tassyir.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Deny a CLI sign-in

> The approval page's route (dashboard JWT ONLY: a developer token can never approve a sign-in). The code travels in the body; dashes, spaces and case are ignored. An unknown, expired or someone else's code is one answer, 404 `CLI_CODE_NOT_FOUND`. 10 approvals per user an hour; 10 wrong codes per user and 30 per IP an hour. Works until the token is issued; a suspended account may still deny.

Takes the dashboard session ONLY: a developer token is refused here, so a stolen CLI token can never approve a new sign-in.



## OpenAPI

````yaml /openapi/openapi.developer.json post /developer/cli/device/deny
openapi: 3.1.0
info:
  title: Tassyir developer API
  version: '1'
  summary: >-
    The API a developer calls to build Tassyir apps: their account, apps, client
    secrets, versions, the webhook console, dev stores and the CLI sign-in.
  description: >-
    The routes under `/developer/` that a DEVELOPER calls: the developer
    console, the `tassyir` CLI and the dev MCP. Not an app's API: installed apps
    call the Admin API, which has its own document. Guides:
    https://developers.tassyir.io.


    **Authentication.** `Authorization: Bearer <dashboard JWT>` (the console) or
    `Authorization: Bearer tsy_dt_…` (a developer token from the CLI sign-in),
    on every route but the approval routes (the dashboard session only) and the
    two public RFC 8628 routes. A developer account belongs to a USER, not a
    business: no route takes a business id, and an id that is not yours answers
    404, exactly like one that does not exist.


    **Conventions.** JSON fields are camelCase (snake_case on the two OAuth
    routes, as RFC 8628 has them); ids are strings; times are ISO 8601 UTC. One
    resource answers `{ data }`, a paged list `{ data, nextCursor }` (pass
    `nextCursor` back as `cursor`), a short list `{ data }`.


    **Errors.** Not problem+json: the dashboard API's shape. A coded refusal is
    `{ statusCode, code, message, fix?, …subject, requestId }`
    (`DeveloperError`); act on `code`. Three refusals carry no `code` today: a
    request that fails validation (400, `message` is a list of sentences), a
    missing or ended dashboard session (401), and the platform-wide rate limit
    (429, a bare JSON string). The two OAuth routes answer `{ error,
    error_description }`. Each operation lists every code it can answer, by
    status.


    **Limits.** Each developer has caps (apps, secrets, versions, dev stores),
    and the console's replays and tests and the CLI sign-in have rate limits of
    their own, which apply whether or not the platform-wide rate limit is
    enforced; each operation says which apply.
servers:
  - url: https://api.tassyir.io
security:
  - dashboardSession: []
  - developerToken: []
tags:
  - name: Account
    description: 'Developer mode: your developer account.'
  - name: Apps
    description: 'Your apps: handle, client id, names.'
  - name: Secrets
    description: 'Client secrets: minted once, rotated with a 24-hour overlap.'
  - name: Versions
    description: Manifest uploads.
  - name: Installations
    description: Where your app is installed, and its webhooks' health.
  - name: Webhooks
    description: The delivery log, replay, test deliveries, re-enable.
  - name: Dev stores
    description: Test businesses with synthetic data that reach no one.
  - name: CLI sign-in
    description: >-
      The OAuth 2.0 Device Authorization Grant (RFC 8628) the `tassyir` CLI
      signs in with, and the approval page's routes.
  - name: CLI tokens
    description: 'Your developer tokens: list and revoke.'
paths:
  /developer/cli/device/deny:
    post:
      tags:
        - CLI sign-in
      summary: Deny a CLI sign-in
      description: >-
        The approval page's route (dashboard JWT ONLY: a developer token can
        never approve a sign-in). The code travels in the body; dashes, spaces
        and case are ignored. An unknown, expired or someone else's code is one
        answer, 404 `CLI_CODE_NOT_FOUND`. 10 approvals per user an hour; 10
        wrong codes per user and 30 per IP an hour. Works until the token is
        issued; a suspended account may still deny.


        Takes the dashboard session ONLY: a developer token is refused here, so
        a stolen CLI token can never approve a new sign-in.
      operationId: denyCliSignIn
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CliUserCodeInput'
      responses:
        '200':
          description: The sign-in.
          headers:
            X-Request-Id:
              $ref: '#/components/headers/X-Request-Id'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CliSignInResponse'
        '400':
          description: >-
            Bad request: `BAD_REQUEST`, `CLI_CODE_INVALID`; a field refused by
            validation (no `code`).
          headers:
            X-Request-Id:
              $ref: '#/components/headers/X-Request-Id'
          content:
            application/json:
              schema:
                anyOf:
                  - allOf:
                      - $ref: '#/components/schemas/DeveloperError'
                      - properties:
                          code:
                            enum:
                              - BAD_REQUEST
                              - CLI_CODE_INVALID
                  - $ref: '#/components/schemas/ValidationError'
        '401':
          $ref: '#/components/responses/SessionUnauthorized'
        '404':
          description: 'Not found: `CLI_CODE_NOT_FOUND`, `DEVELOPER_ACCOUNT_NOT_FOUND`.'
          headers:
            X-Request-Id:
              $ref: '#/components/headers/X-Request-Id'
          content:
            application/json:
              schema:
                allOf:
                  - $ref: '#/components/schemas/DeveloperError'
                  - properties:
                      code:
                        enum:
                          - CLI_CODE_NOT_FOUND
                          - DEVELOPER_ACCOUNT_NOT_FOUND
        '409':
          description: 'Conflict: `CLI_CODE_ALREADY_DECIDED`.'
          headers:
            X-Request-Id:
              $ref: '#/components/headers/X-Request-Id'
          content:
            application/json:
              schema:
                allOf:
                  - $ref: '#/components/schemas/DeveloperError'
                  - properties:
                      code:
                        enum:
                          - CLI_CODE_ALREADY_DECIDED
        '413':
          $ref: '#/components/responses/PayloadTooLarge'
        '415':
          $ref: '#/components/responses/UnsupportedMediaType'
        '429':
          description: >-
            Rate limited: `CLI_SIGN_IN_RATE_LIMITED`; the platform-wide rate
            limit (a string).
          headers:
            X-Request-Id:
              $ref: '#/components/headers/X-Request-Id'
            Retry-After:
              $ref: '#/components/headers/Retry-After'
          content:
            application/json:
              schema:
                anyOf:
                  - allOf:
                      - $ref: '#/components/schemas/DeveloperError'
                      - properties:
                          code:
                            enum:
                              - CLI_SIGN_IN_RATE_LIMITED
                  - $ref: '#/components/schemas/RateLimitError'
        '500':
          $ref: '#/components/responses/InternalError'
        '503':
          $ref: '#/components/responses/Unavailable'
      security:
        - dashboardSession: []
components:
  schemas:
    CliUserCodeInput:
      type: object
      properties:
        userCode:
          maxLength: 32
          type: string
      additionalProperties: false
      required:
        - userCode
    CliSignInResponse:
      type: object
      properties:
        data:
          $ref: '#/components/schemas/CliSignIn'
      required:
        - data
      additionalProperties: false
    DeveloperError:
      type: object
      description: >-
        A coded refusal of the developer API (the dashboard API's error shape,
        not problem+json). Act on `code`, never on `message`. Other members name
        the subject of the refusal (`appId`, `limit`, `retryAfterSeconds`,
        `status`, …).
      properties:
        statusCode:
          type: integer
        code:
          type: string
          pattern: ^[A-Z][A-Z0-9_]{1,63}$
          description: 'Stable: what a client branches on.'
        message:
          type: string
          description: For a person (English).
        fix:
          type: string
          description: One sentence an AI agent can act on.
        errors:
          type: array
          items:
            $ref: '#/components/schemas/FieldError'
          description: >-
            With `APP_MANIFEST_INVALID`, `APP_FIELDS_INVALID`,
            `DEVELOPER_ACCOUNT_INVALID`: every problem at once, in the manifest
            validator's format.
        path:
          type: string
          description: 'With a body the parser refused: the request path.'
        requestId:
          type: string
          description: Also in the `X-Request-Id` header. Quote it to Tassyir.
      required:
        - code
        - message
    ValidationError:
      type: object
      description: >-
        A request that fails validation: a field missing, malformed or unknown,
        in the body or the query string. It carries NO `code`: branch on the
        status (400) and show `message`.
      properties:
        statusCode:
          type: integer
          const: 400
        message:
          type: array
          items:
            type: string
          description: >-
            One sentence per refused field (`limit must not be greater than
            100`).
        error:
          type: string
          const: Bad Request
        requestId:
          type: string
      required:
        - statusCode
        - message
        - error
    RateLimitError:
      type: string
      description: >-
        The platform-wide rate limit's refusal: a bare JSON string, not an
        object, sent only while that limit is enforced. A developer token's
        calls are counted by IP.
    CliSignIn:
      type: object
      properties:
        userCode:
          type: string
          pattern: ^[BCDFGHJKLMNPQRSTVWXZ]{4}-[BCDFGHJKLMNPQRSTVWXZ]{4}$
          description: The code the terminal shows, `XXXX-XXXX`.
        status:
          type: string
          enum:
            - pending
            - approved
            - denied
            - completed
          description: '`completed`: the CLI has its token.'
        client:
          $ref: '#/components/schemas/CliClient'
        deviceName:
          anyOf:
            - type: string
            - type: 'null'
        requestedAt:
          type: string
          format: date-time
          pattern: >-
            ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
          description: ISO 8601 date-time, UTC.
        expiresAt:
          type: string
          format: date-time
          pattern: >-
            ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
          description: ISO 8601 date-time, UTC.
        origin:
          type: object
          properties:
            country:
              anyOf:
                - type: string
                  pattern: ^[A-Z]{2}$
                  description: >-
                    The country the request came from, by its IP address (ISO
                    3166-1 alpha-2).
                - type: 'null'
              description: Where the sign-in was STARTED; null when unknown.
            sameCountryAsYou:
              anyOf:
                - type: boolean
                - type: 'null'
              description: >-
                Whether you are in that country; null when either is unknown.
                Warn when false.
          required:
            - country
            - sameCountryAsYou
          additionalProperties: false
      required:
        - userCode
        - status
        - client
        - deviceName
        - requestedAt
        - expiresAt
        - origin
      additionalProperties: false
      description: A CLI sign-in waiting for (or past) your decision.
    FieldError:
      type: object
      description: One problem, as the manifest validator reports it.
      properties:
        code:
          type: string
          pattern: ^[A-Z][A-Z0-9_]{1,63}$
        path:
          type: string
          description: 'Where: `handle`, `webhooks[0].uri`, …'
        message:
          type: string
        fix:
          type: string
      required:
        - code
        - path
        - message
    HttpError:
      type: object
      description: >-
        A refusal without a `code`: no dashboard session (no token, a revoked or
        expired session, a password changed since it was issued).
      properties:
        statusCode:
          type: integer
        message:
          anyOf:
            - type: string
            - type: array
              items:
                type: string
        error:
          type: string
        requestId:
          type: string
      required:
        - statusCode
        - message
    ServerError:
      type: object
      description: >-
        An unexpected failure (500), or a database that cannot be reached (503:
        retry). Never an internal message: `requestId` names it.
      properties:
        statusCode:
          type: integer
        message:
          type: string
        path:
          type: string
        requestId:
          type: string
      required:
        - statusCode
        - message
    CliClient:
      type: object
      properties:
        id:
          type: string
          description: The `client_id`, e.g. `tassyir-cli`.
        name:
          type: string
          description: Tassyir's name for the client, never what the request said.
        version:
          anyOf:
            - type: string
            - type: 'null'
      required:
        - id
        - name
        - version
      additionalProperties: false
  headers:
    X-Request-Id:
      description: The request's id, also in an error's `requestId`.
      schema:
        type: string
    Retry-After:
      description: >-
        Seconds to wait before retrying, when the refusal knows (also
        `retryAfterSeconds` in a coded body).
      schema:
        type: integer
        minimum: 0
  responses:
    SessionUnauthorized:
      description: 'Not signed in: no dashboard session (no `code`).'
      headers:
        X-Request-Id:
          $ref: '#/components/headers/X-Request-Id'
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/HttpError'
    PayloadTooLarge:
      description: 'Body too large: `PAYLOAD_TOO_LARGE`.'
      headers:
        X-Request-Id:
          $ref: '#/components/headers/X-Request-Id'
      content:
        application/json:
          schema:
            allOf:
              - $ref: '#/components/schemas/DeveloperError'
              - properties:
                  code:
                    enum:
                      - PAYLOAD_TOO_LARGE
    UnsupportedMediaType:
      description: 'Unsupported body: `BAD_REQUEST`.'
      headers:
        X-Request-Id:
          $ref: '#/components/headers/X-Request-Id'
      content:
        application/json:
          schema:
            allOf:
              - $ref: '#/components/schemas/DeveloperError'
              - properties:
                  code:
                    enum:
                      - BAD_REQUEST
    InternalError:
      description: 'Internal error: an unexpected failure.'
      headers:
        X-Request-Id:
          $ref: '#/components/headers/X-Request-Id'
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ServerError'
    Unavailable:
      description: 'Unavailable: a database that cannot be reached.'
      headers:
        X-Request-Id:
          $ref: '#/components/headers/X-Request-Id'
        Retry-After:
          $ref: '#/components/headers/Retry-After'
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ServerError'
  securitySchemes:
    dashboardSession:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: >-
        The dashboard's session token (`Authorization: Bearer <JWT>`), as the
        console sends it. Never paste it into a terminal: it opens every
        business the user belongs to.
    developerToken:
      type: http
      scheme: bearer
      bearerFormat: tsy_dt_<43 base62>
      description: >-
        A developer token from the CLI sign-in (`POST
        /developer/cli/device-code`, then `POST /developer/cli/token`): accepted
        on `developer/*` ONLY, scope `developer`. Valid while not revoked, used
        within 90 days (each use extends it) and issued less than 365 days ago;
        refused once the user changes their password. Signing out of the
        dashboard does not revoke it.

````

This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.