API · /v1/devices

List and revoke the machines linked to the caller's account. Tenant-scoped in SQL - another user's device id is an indistinguishable 404.

GET /v1/devices

Auth: Supabase session. Returns the caller's own devices, newest first. It never returns a device's public key.

{
  "devices": [
    { "device_id": "dev_88x", "status": "active",
      "created_at": 1767139200, "last_seen_at": 1767225300 },
    { "device_id": "dev_44a", "status": "revoked",
      "created_at": 1767052800, "last_seen_at": null }
  ]
}

• status - active or revoked.
• last_seen_at - unix seconds, or null when no check-in has been recorded (honest absence, not zero).

POST /v1/devices/revoke

Auth: Supabase session. Revokes one of the caller's devices, idempotently within the tenant.

→ { "device_id": "dev_88x" }
← 200 { "revoked": true }

• 200 - { revoked: true }. Idempotent: revoking an already-revoked device still returns 200.
• 400 - invalid device_id or bad JSON.
• 401 - missing or invalid session.
• 404 - not the caller's device, or nonexistent (indistinguishable, by design).