Finish the sign-in round trip and mint the console session

GET /v1/deploy/callback

Completes the redirect from IAM: it validates state against the single-use flow cookie in constant time, redeems the authorization code with the PKCE verifier, and then VERIFIES the resulting token exactly as this deployment's identity boundary will on every later request — so a token that would be refused next request fails here with the real reason instead of producing a sign-in loop. On success it sets the session cookie, bounded by the token's own expiry, and redirects to the validated return path.

It fails closed, and closes on the ADMIN ORG: a principal whose verified owner claim is not the reserved admin org is told plainly that it lacks the role (403) and no cookie is minted for it. That check is not the authorization decision — every gated route re-derives SuperAdmin from the verified JWT — it exists so nobody is handed a session that silently 403s everything. No flow in progress, or a mismatched state, is a 400; a refused or unexchangeable code is a 401.

Request

GET /v1/deploy/callback takes no parameters and no body — the credential is the whole request.

Response

The document declares no response body for this operation. It answers 200 on success and the platform error shape on failure — see Errors.

Examples

hanzo deploy callback

import { Configuration, DeployApi } from 'hanzoai';

const api = new DeployApi(new Configuration({ accessToken: process.env.HANZO_API_KEY }));
const { data } = await api.getDeployCallback();

from hanzoai.cloud import ApiClient, Configuration
from hanzoai.cloud.api import DeployApi

client = ApiClient(Configuration(access_token=os.environ["HANZO_API_KEY"]))
result = DeployApi(client).get_deploy_callback()

cfg := cloud.NewConfiguration()
cfg.AddDefaultHeader("Authorization", "Bearer "+os.Getenv("HANZO_API_KEY"))
client := cloud.NewAPIClient(cfg)

resp, _, err := client.DeployAPI.GetDeployCallback(context.Background()).Execute()
if err != nil {
	return err
}

use hanzo_cloud::apis::{configuration::Configuration, deploy_api};

let mut cfg = Configuration::new();
cfg.bearer_access_token = std::env::var("HANZO_API_KEY").ok();

let result = deploy_api::get_deploy_callback(&cfg, Default::default()).await?;

import ai.hanzo.cloud.ApiClient;
import ai.hanzo.cloud.api.DeployApi;

ApiClient client = new ApiClient();
client.setRequestInterceptor(b -> b.header("Authorization", "Bearer " + System.getenv("HANZO_API_KEY")));

var result = new DeployApi(client).getDeployCallback();

curl https://api.hanzo.ai/v1/deploy/callback \
  -H "Authorization: Bearer $HANZO_API_KEY"

curl -X POST https://api.hanzo.ai/v1/mcp \
  -H "Authorization: Bearer $HANZO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
       "jsonrpc": "2.0",
       "id": 1,
       "method": "tools/call",
       "params": {
         "name": "deploy",
         "arguments": {
           "op": "get_deploy_callback",
           "input": {}
         }
       }
     }'

Deploy API · All Hanzo APIs · Interactive reference