Devices API — not a real concept in this API
There is no /devices route family in the Hoziron HTTP API — no GET /devices, POST /devices/pair, or DELETE /devices/{id} exists anywhere in crates/surfaces/hoziron-api/src/routes.rs (v1_routes()). There is no device-pairing/device-registration concept anywhere in the platform's route table, handler code, or hoziron-core public API.
If you arrived here looking for something "device"-shaped, the two real mechanisms in this codebase are:
1. OIDC device-code CLI login (the actual "device flow" in this system)
hoziron-cli login implements RFC 8628 (OAuth 2.0 Device Authorization Grant) — the CLI displays a user_code and verification URL, the operator approves in a browser, and the CLI polls until the IdP issues a token. This is the closest real analog to "device pairing" in the codebase (bin/hoziron-cli/src/oidc.rs). It authenticates a human operator's CLI session, not a physical/IoT device — see auth.md for the full flow and the hoziron-cli login/hoziron-cli logout commands.
2. API keys for service/programmatic callers
For non-interactive callers (CI, integrations, scripts) that would otherwise need something like device registration, the platform's actual mechanism is scoped API keys — see auth.md. POST /auth/keys issues a bearer secret bound to a role and optional expiry; there is no separate device-identity or device-registration concept layered on top.