Confirm the domains and keep the key of an account sign in
Confirm the domains and keep the key of an account sign in: CustomDomain™ API reference. Covers request parameters, the request body, responses and error codes.
The console only, for the member who started the account sign in (POST /provider-accounts:sign-in). The key that waits (key_ready) is kept as a provider account only now, in one step, for the domains the person confirmed: scope is always named (all of the account's domains, or selected ones), and each selected domain must be one the key lists (422 domain_not_listed). A call that is refused keeps nothing and leaves the session waiting inside its ten minutes. The key is claimed for the call, so a double press stores it once (409 browser_wrong_state for the second). A workspace an operator suspended keeps nothing (403 workspace_suspended) and the key still waits.
The account is the workspace's own, made by secure sign in in the console (origin: browser_agent, made_by.how: console_sign_in), for the application the sign in named, or for every application when it named none. access is continuous (the default) or one_time; a provider whose credential is used once and never kept (see POST /provider-accounts) is one_time only (422 use_once_credential). application_ids shares the key with other applications of the workspace (decision D5): an admin or an owner only (403), every id one of the workspace's (404 otherwise), and a key for every application takes none (422 serves_every_application).
When the workspace already holds a continuous key for the same provider account, for the same application, the new key is swapped into that account instead of adding a row: the answer is 200 with swapped: true, the replaced key is named for deletion by hand on the account (agent_key.old_key) and in the answer (replaced_key: its name and the provider's page that deletes it), and the domains chosen join its scope and never narrow it. Every swap takes an admin, an owner or the member who connected the account, as replacing the key by POST /provider-accounts/{id}/reconnect does: another member's keep is 403 whether or not it widens the account, and the key still waits, so the member can cancel the sign in and be told which key to delete. The two keys carry different names (an account sign in names its key to the second), so the one to delete is never the one in use. GoDaddy is the exception until its written permission is on file: its second sign in adds a second row. Every account made, swapped or shared is in the audit log (provider_account.created, .key_replaced with the name of the key it replaced as old_key_name, .updated, .shared).
A sign in that renews an account (POST /provider-accounts/{id}/reconnect with method secure_sign_in; the session's renews_account_id names the account) is kept with an empty body, {}: the key swaps into that account's own row and the account keeps its domains, scope, access and applications, so a body that names scope, domains, access or application_ids is 400 (the account is changed by PATCH /provider-accounts/{id}). It is refused, keeping the key pending, with 404 for an account removed meanwhile, 403 for a member who no longer manages it, 422 different_account for a key of another provider account (domains, when the proof was the list, names the domains the account holds that the new key does not list), and 422 account_not_verifiable for an account that holds no domain and has no account number to compare the key with (remove it and add it again with a new sign in).
A session of another workspace or member, a connect session and an unknown id are 404; a session that is not waiting for the keep step is 409, and one whose ten minutes passed 410.
Authorization
apiKey Long-lived tenant API key, cd_live_… (production) or cd_test_… (staging, development), stored hashed. Keys created before the switch to cd_ start with sk_live_… / sk_test_… and are still accepted. Scoped to the owning application's tenant.
In: header
Path Parameters
The cloud browser session id, bs_ and 32 hex characters.
Request Body
application/json
TypeScript Definitions
Use the request body type in TypeScript.
scope is required to add an account; a sign in that renews one takes no field.
Response Body
application/json
application/json
application/json
application/json
application/json
application/json
application/json
application/json
application/json
application/json
curl -X POST "https://example.com/browser-sessions/string:keep" \ -H "Content-Type: application/json" \ -d '{}'{ "account": { "needs_you": { "reason": "refused", "until": "2019-08-24T14:15:22Z" }, "health": { "state": "ok", "checked_at": "2019-08-24T14:15:22Z", "failures": 0 }, "made_by": { "how": "pasted", "by": "string" }, "enforced_by": "provider", "more_domains": [ "string" ], "id": "string", "kind": "api_key", "provider": "string", "provider_name": "string", "label": "string", "access": "continuous", "scope": "all", "domains": [ "string" ], "credential_held": true, "status": "active", "last_error": "string", "created_by": "string", "last_used_at": "2019-08-24T14:15:22Z", "expires_at": "2019-08-24T14:15:22Z", "created_at": "2019-08-24T14:15:22Z", "updated_at": "2019-08-24T14:15:22Z", "connections": [ { "id": "string", "application_id": "string", "domain": "string", "status": "string" } ], "uses": [ "string" ], "can_manage": true, "application_id": "string", "application_ids": [ "string" ], "origin": "browser_agent", "agent_key": { "name": "string", "scopes": [ "string" ], "account": "string", "session_id": "string", "verified_at": "2019-08-24T14:15:22Z", "expires_at": "2019-08-24T14:15:22Z", "notice": "d30", "reconnect_reason": "expiring", "reconnect_sent_at": "2019-08-24T14:15:22Z", "renewed_at": "2019-08-24T14:15:22Z", "old_key": "revoke_by_hand", "revoke_url": "http://example.com", "rights": [ "transfer" ] }, "owner_kind": "workspace", "end_user_ref": "string", "account_ref": "string" }, "swapped": true, "replaced_key": { "name": "string", "page": "string" }}{ "account": { "needs_you": { "reason": "refused", "until": "2019-08-24T14:15:22Z" }, "health": { "state": "ok", "checked_at": "2019-08-24T14:15:22Z", "failures": 0 }, "made_by": { "how": "pasted", "by": "string" }, "enforced_by": "provider", "more_domains": [ "string" ], "id": "string", "kind": "api_key", "provider": "string", "provider_name": "string", "label": "string", "access": "continuous", "scope": "all", "domains": [ "string" ], "credential_held": true, "status": "active", "last_error": "string", "created_by": "string", "last_used_at": "2019-08-24T14:15:22Z", "expires_at": "2019-08-24T14:15:22Z", "created_at": "2019-08-24T14:15:22Z", "updated_at": "2019-08-24T14:15:22Z", "connections": [ { "id": "string", "application_id": "string", "domain": "string", "status": "string" } ], "uses": [ "string" ], "can_manage": true, "application_id": "string", "application_ids": [ "string" ], "origin": "browser_agent", "agent_key": { "name": "string", "scopes": [ "string" ], "account": "string", "session_id": "string", "verified_at": "2019-08-24T14:15:22Z", "expires_at": "2019-08-24T14:15:22Z", "notice": "d30", "reconnect_reason": "expiring", "reconnect_sent_at": "2019-08-24T14:15:22Z", "renewed_at": "2019-08-24T14:15:22Z", "old_key": "revoke_by_hand", "revoke_url": "http://example.com", "rights": [ "transfer" ] }, "owner_kind": "workspace", "end_user_ref": "string", "account_ref": "string" }, "swapped": true, "replaced_key": { "name": "string", "page": "string" }}{ "code": "string", "title": "string", "details": "string"}{ "code": "string", "title": "string", "details": "string"}{ "code": "string", "title": "string", "details": "string"}{ "code": "string", "title": "string", "details": "string"}{ "code": "string", "title": "string", "details": "string"}{ "code": "string", "title": "string", "details": "string"}{ "code": "string", "title": "string", "details": "string", "domains": [ "string" ]}{ "code": "string", "title": "string", "details": "string"}