---
title: /oauth2/device/user
description: Confirm resource owner consent in PingAM OAuth 2.0 device flow and device flow with PKCE using the /oauth2/device/user endpoint
component: pingam
version: 7.5
page_id: pingam:am-oauth2:rest-api-oauth2-device-user
canonical_url: https://docs.pingidentity.com/pingam/8.1/am-oauth2/rest-api-oauth2-device-user.html
llms_txt: https://docs.pingidentity.com/pingam/llms.txt
docs_for_agents: https://developer.pingidentity.com/build-with-ai/docs-for-agents.md
keywords: ["OAuth 2.0", "API Explorer", "Endpoints", "PKCE"]
page_aliases: ["oauth2-guide:rest-api-oauth2-device-user.adoc"]
superseded_by: https://docs.pingidentity.com/pingam/8.1/am-oauth2/rest-api-oauth2-device-user.html
---

# /oauth2/device/user

This is the [Device authorization grant](oauth2-device-flow.html) endpoint for user interaction. Client devices use this endpoint to confirm the resource owner's consent in the following flows:

* Device flow ([OAuth 2.0](oauth2-device-flow.html))

* Device flow with PKCE ([OAuth 2.0](oauth2-device-flow-pkce.html))

Specify the realm in the request URL; for example:

```none
https://openam.example.com:8443/openam/oauth2/realms/root/realms/alpha/device/user
```

The device user endpoint supports the following parameters:

| Parameter      | Description                                                                                                         | Required                                                                  |
| -------------- | ------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------- |
| `csrf`         | The SSO token string linking the request to the user session to protect against Cross-Site Request Forgery attacks. | Yes, when gathering consent without a remote consent service              |
| `decision`     | Specifies whether the resource owner consents to the requested access.                                              | Yes, when gathering consent unless consent is already saved for the scope |
| `save_consent` | Specifies whether to store a resource owner's consented scopes.                                                     | No                                                                        |
| `scope`        | The scopes linked to the permissions requested by the client from the resource owner.                               | No                                                                        |
| `user_code`    | The user code confirmed by the resource owner.                                                                      | Yes                                                                       |