Skip to content
deedglassdocs

Sign in with a link's token, or with an email address and code

POST
/v1/auth/callback
curl --request POST \
  --url http://127.0.0.1:8080/v1/auth/callback \
  --header 'Content-Type: application/json' \
  --header 'Deedglass-Version: 2026-10-01' \
  --data '{ "token": "OEVkbr-q18qimgaDkbcE5mnZqQ2a1zGG7_TgYq8PKFc" }'

Public. Uses the token once (only while unused, not replaced by a newer email and not expired), accepts the invite when the link is one, and sets the session and CSRF cookies. With email and code, the code must belong to the newest email; each code allows 5 attempts. Every miss is 400 login_code_invalid with the same message.

Parameters

Section titled “Parameters”

Header Parameters

Section titled “Header Parameters”
Deedglass-Version
string
/^[0-9]{4}-[0-9]{2}-[0-9]{2}$/

The API version (YYYY-MM-DD). Leave it out to use your org’s pinned version (public routes use the latest). An unknown version is 400 api_version_invalid.

Request Bodyrequired

Section titled “Request Bodyrequired”
Media typeapplication/json
One of:
object
token
required
string
Examples
{
  "token": "OEVkbr-q18qimgaDkbcE5mnZqQ2a1zGG7_TgYq8PKFc"
}

Responses

Section titled “Responses”

200

Section titled “200”

Signed in. Set-Cookie carries __Host-deedglass_session and __Host-deedglass_csrf.

Media typeapplication/json
object
object
required
string
Allowed value: me
user
required
object
object
required
string
Allowed value: user
id
required
string
email
required
string
name
required
string
created_at
required
string format: date-time
org
required
object
object
required
string
Allowed value: org
id
required
string
name
required
string
slug
required
string
timezone
required
string
status
required
string
Allowed values: active disabled
created_at
required
string format: date-time
retention_days

GET and PATCH /v1/org only (S26, additive): how many days action payloads are kept, the org’s setting or the default of 90. Omitted elsewhere.

integer
>= 1 <= 3650
settings

GET and PATCH /v1/org only (S26, additive), with defaults applied. Omitted elsewhere.

object
approvals
required
object
email_links
required

Whether emailed approval links can decide (default) or only open the review page.

string
Allowed values: decide review
email_detail
required

How much of the request approval emails show (default summary).

string
Allowed values: summary full
self_countersign
required

Whether the person an action runs on behalf of may countersign it (default deny).

string
Allowed values: deny allow
simulated

Read only (S29, additive): present and true when the org was made by deedglass dev simulate; omitted otherwise. PATCH /v1/org refuses it.

boolean
stop

GET /v1/org only (additive): the Stop all overlay, which the Console’s org-stopped banner reads. Omitted elsewhere.

object
stopped
required
boolean
stopped_at
required
string | null format: date-time
stopped_by
required

Who turned it on.

string | null
reason
required
string | null
membership
required
object
object
required
string
Allowed value: membership
id
required
string
role
required
string
Allowed values: viewer admin owner
status
required
string
orgs
required
Array<object>
object
id
required
string
name
required
string
role
required
string
session
required
object
id
required
string
idle_expires_at
required
string format: date-time
expires_at
required
string format: date-time
csrf_token
required

Send it back as the Deedglass-CSRF header on requests that change state.

string | null
Example
{
  "object": "me",
  "user": {
    "object": "user",
    "id": "usr_01k6c9kb2zcjsyn7b8g2k1vqvp",
    "email": "priya@acme.com",
    "name": "Priya Raman",
    "created_at": "2026-10-03T09:14:07.000Z"
  },
  "org": {
    "object": "org",
    "id": "org_01k6h7kp6msmzrhdzwtcr3jnkp",
    "name": "Acme",
    "slug": "acme",
    "timezone": "Asia/Kolkata",
    "status": "active",
    "created_at": "2026-10-03T09:14:07.000Z"
  },
  "membership": {
    "object": "membership",
    "id": "mem_01k6zymkd83ftdv0mf9keseaz1",
    "role": "owner",
    "status": "active"
  },
  "orgs": [
    {
      "id": "org_01k6h7kp6msmzrhdzwtcr3jnkp",
      "name": "Acme",
      "role": "owner"
    }
  ],
  "session": {
    "id": "ses_01k6ydnxs578tgcwjbknyjdh8m",
    "idle_expires_at": "2026-10-03T21:14:07.000Z",
    "expires_at": "2026-10-10T09:14:07.000Z"
  },
  "csrf_token": "M3q1c0Zb9xK2yV7wQ4nH8pT6rJ5sD1fG0aL3kE9uW2c"
}

Headers

Section titled “Headers”
Deedglass-Request-Id
string
/^req_[0-7][0-9a-hjkmnp-tv-z]{25}$/

This request’s id. Quote it to support; it matches error.request_id.

Set-Cookie
string

default

Section titled “default”

An error. Every error has this envelope; doc_url explains the code.

Media typeapplication/json
object
error
required
object
type
required
string
Allowed values: invalid_request_error authentication_error permission_error policy_error rate_limit_error api_error
code
required
string
Allowed values: invalid_api_key api_key_revoked api_key_expired agent_suspended agent_stopped org_stopped insufficient_scope policy_denied approval_required approval_expired budget_exceeded intent_required intent_invalid intent_replay tool_unknown connector_unavailable upstream_error timeout rate_limited idempotency_conflict validation_failed not_found conflict internal_error authentication_required method_not_allowed request_too_large unsupported_media_type invalid_json api_version_invalid idempotency_key_invalid idempotency_key_in_use service_unavailable session_expired csrf_failed insufficient_role login_link_invalid login_code_invalid last_owner policy_unavailable policy_invalid credentials_missing destination_blocked vault_unavailable upstream_auth_failed upstream_not_found upstream_rate_limited response_too_large statement_refused row_limit_exceeded database_role_unsafe database_not_ready witness_not_configured approval_decided already_countersigned approver_not_eligible self_approval approval_needs_person context_changed approval_unsatisfiable approval_link_invalid approval_link_review_only approver_unmapped stripe_live_key_refused stripe_livemode_detected upstream_approval_pending schedule_needs_approval action_executing from_denied undo_unavailable undo_plan_stale already_undone undo_conflict replay_too_large replay_window_invalid suggestion_stale shadow_slot_taken suggestion_decided observe_not_enabled pro_required
message
required

One or more calm sentences with the next step.

string
param
required

The request field, query parameter or header the error is about.

string | null
request_id
required
string
/^req_[0-7][0-9a-hjkmnp-tv-z]{25}$/
doc_url
required
string format: uri
diagnostics

On policy_invalid only. Each problem with its line, code and hint.

Array<object>

One finding about a policy file, with its position and the next step. Codes are stable and listed in docs/POLICY_ERRORS.md. In the policy_invalid error envelope each diagnostic also carries object: policy_diagnostic. The full PolicyDiagnostic schema is in openapi.yaml.

object
action

One agent action. Its sections mirror the deed’s. status is the one field an agent needs; state is the exact lifecycle state (docs/GATE.md). The Gate’s own responses (POST /v1/actions and its result report) add execution.result and witness.reasons; lists leave both out. The full Action schema is in openapi.yaml.

object
checks

On undo_unavailable only. Every check of the undo, each with its fix. Additive (S23).

Array<object>

One of the twelve safety checks (S23 §3.3). Available means no check failed. The full UndoCheck schema is in openapi.yaml.

object
Example
{
  "error": {
    "type": "invalid_request_error",
    "code": "not_found",
    "message": "There's no endpoint at GET /v1/helth. Did you mean /v1/health?",
    "param": null,
    "request_id": "req_01j9zr3m5k8q2w7x4t6v0b1c9d",
    "doc_url": "https://docs.deedglass.com/errors/not_found"
  }
}

Headers

Section titled “Headers”
Deedglass-Request-Id
string
/^req_[0-7][0-9a-hjkmnp-tv-z]{25}$/

This request’s id. Quote it to support; it matches error.request_id.

Deedglass-Version
string

The API version this response follows.