diff --git a/internal/api/orchestrator/v1/orchestratorv1connect/plugin_registry.connect.go b/internal/api/orchestrator/v1/orchestratorv1connect/plugin_registry.connect.go
index f0d8174..6ae0adf 100644
--- a/internal/api/orchestrator/v1/orchestratorv1connect/plugin_registry.connect.go
+++ b/internal/api/orchestrator/v1/orchestratorv1connect/plugin_registry.connect.go
@@ -78,6 +78,12 @@ const (
 	// PluginAuthServiceApproveDeviceProcedure is the fully-qualified name of the PluginAuthService's
 	// ApproveDevice RPC.
 	PluginAuthServiceApproveDeviceProcedure = "/orchestrator.v1.PluginAuthService/ApproveDevice"
+	// PluginAuthServiceDenyDeviceProcedure is the fully-qualified name of the PluginAuthService's
+	// DenyDevice RPC.
+	PluginAuthServiceDenyDeviceProcedure = "/orchestrator.v1.PluginAuthService/DenyDevice"
+	// PluginAuthServiceGetDeviceStatusProcedure is the fully-qualified name of the PluginAuthService's
+	// GetDeviceStatus RPC.
+	PluginAuthServiceGetDeviceStatusProcedure = "/orchestrator.v1.PluginAuthService/GetDeviceStatus"
 	// PluginAuthServiceWhoamiProcedure is the fully-qualified name of the PluginAuthService's Whoami
 	// RPC.
 	PluginAuthServiceWhoamiProcedure = "/orchestrator.v1.PluginAuthService/Whoami"
@@ -482,6 +488,8 @@ type PluginAuthServiceClient interface {
 	StartDevice(context.Context, *connect.Request[v1.StartDeviceRequest]) (*connect.Response[v1.StartDeviceResponse], error)
 	PollDevice(context.Context, *connect.Request[v1.PollDeviceRequest]) (*connect.Response[v1.PollDeviceResponse], error)
 	ApproveDevice(context.Context, *connect.Request[v1.ApproveDeviceRequest]) (*connect.Response[v1.ApproveDeviceResponse], error)
+	DenyDevice(context.Context, *connect.Request[v1.DenyDeviceRequest]) (*connect.Response[v1.DenyDeviceResponse], error)
+	GetDeviceStatus(context.Context, *connect.Request[v1.GetDeviceStatusRequest]) (*connect.Response[v1.GetDeviceStatusResponse], error)
 	Whoami(context.Context, *connect.Request[v1.WhoamiRequest]) (*connect.Response[v1.WhoamiResponse], error)
 }
 
@@ -514,6 +522,18 @@ func NewPluginAuthServiceClient(httpClient connect.HTTPClient, baseURL string, o
 			connect.WithSchema(pluginAuthServiceMethods.ByName("ApproveDevice")),
 			connect.WithClientOptions(opts...),
 		),
+		denyDevice: connect.NewClient[v1.DenyDeviceRequest, v1.DenyDeviceResponse](
+			httpClient,
+			baseURL+PluginAuthServiceDenyDeviceProcedure,
+			connect.WithSchema(pluginAuthServiceMethods.ByName("DenyDevice")),
+			connect.WithClientOptions(opts...),
+		),
+		getDeviceStatus: connect.NewClient[v1.GetDeviceStatusRequest, v1.GetDeviceStatusResponse](
+			httpClient,
+			baseURL+PluginAuthServiceGetDeviceStatusProcedure,
+			connect.WithSchema(pluginAuthServiceMethods.ByName("GetDeviceStatus")),
+			connect.WithClientOptions(opts...),
+		),
 		whoami: connect.NewClient[v1.WhoamiRequest, v1.WhoamiResponse](
 			httpClient,
 			baseURL+PluginAuthServiceWhoamiProcedure,
@@ -525,10 +545,12 @@ func NewPluginAuthServiceClient(httpClient connect.HTTPClient, baseURL string, o
 
 // pluginAuthServiceClient implements PluginAuthServiceClient.
 type pluginAuthServiceClient struct {
-	startDevice   *connect.Client[v1.StartDeviceRequest, v1.StartDeviceResponse]
-	pollDevice    *connect.Client[v1.PollDeviceRequest, v1.PollDeviceResponse]
-	approveDevice *connect.Client[v1.ApproveDeviceRequest, v1.ApproveDeviceResponse]
-	whoami        *connect.Client[v1.WhoamiRequest, v1.WhoamiResponse]
+	startDevice     *connect.Client[v1.StartDeviceRequest, v1.StartDeviceResponse]
+	pollDevice      *connect.Client[v1.PollDeviceRequest, v1.PollDeviceResponse]
+	approveDevice   *connect.Client[v1.ApproveDeviceRequest, v1.ApproveDeviceResponse]
+	denyDevice      *connect.Client[v1.DenyDeviceRequest, v1.DenyDeviceResponse]
+	getDeviceStatus *connect.Client[v1.GetDeviceStatusRequest, v1.GetDeviceStatusResponse]
+	whoami          *connect.Client[v1.WhoamiRequest, v1.WhoamiResponse]
 }
 
 // StartDevice calls orchestrator.v1.PluginAuthService.StartDevice.
@@ -546,6 +568,16 @@ func (c *pluginAuthServiceClient) ApproveDevice(ctx context.Context, req *connec
 	return c.approveDevice.CallUnary(ctx, req)
 }
 
+// DenyDevice calls orchestrator.v1.PluginAuthService.DenyDevice.
+func (c *pluginAuthServiceClient) DenyDevice(ctx context.Context, req *connect.Request[v1.DenyDeviceRequest]) (*connect.Response[v1.DenyDeviceResponse], error) {
+	return c.denyDevice.CallUnary(ctx, req)
+}
+
+// GetDeviceStatus calls orchestrator.v1.PluginAuthService.GetDeviceStatus.
+func (c *pluginAuthServiceClient) GetDeviceStatus(ctx context.Context, req *connect.Request[v1.GetDeviceStatusRequest]) (*connect.Response[v1.GetDeviceStatusResponse], error) {
+	return c.getDeviceStatus.CallUnary(ctx, req)
+}
+
 // Whoami calls orchestrator.v1.PluginAuthService.Whoami.
 func (c *pluginAuthServiceClient) Whoami(ctx context.Context, req *connect.Request[v1.WhoamiRequest]) (*connect.Response[v1.WhoamiResponse], error) {
 	return c.whoami.CallUnary(ctx, req)
@@ -556,6 +588,8 @@ type PluginAuthServiceHandler interface {
 	StartDevice(context.Context, *connect.Request[v1.StartDeviceRequest]) (*connect.Response[v1.StartDeviceResponse], error)
 	PollDevice(context.Context, *connect.Request[v1.PollDeviceRequest]) (*connect.Response[v1.PollDeviceResponse], error)
 	ApproveDevice(context.Context, *connect.Request[v1.ApproveDeviceRequest]) (*connect.Response[v1.ApproveDeviceResponse], error)
+	DenyDevice(context.Context, *connect.Request[v1.DenyDeviceRequest]) (*connect.Response[v1.DenyDeviceResponse], error)
+	GetDeviceStatus(context.Context, *connect.Request[v1.GetDeviceStatusRequest]) (*connect.Response[v1.GetDeviceStatusResponse], error)
 	Whoami(context.Context, *connect.Request[v1.WhoamiRequest]) (*connect.Response[v1.WhoamiResponse], error)
 }
 
@@ -584,6 +618,18 @@ func NewPluginAuthServiceHandler(svc PluginAuthServiceHandler, opts ...connect.H
 		connect.WithSchema(pluginAuthServiceMethods.ByName("ApproveDevice")),
 		connect.WithHandlerOptions(opts...),
 	)
+	pluginAuthServiceDenyDeviceHandler := connect.NewUnaryHandler(
+		PluginAuthServiceDenyDeviceProcedure,
+		svc.DenyDevice,
+		connect.WithSchema(pluginAuthServiceMethods.ByName("DenyDevice")),
+		connect.WithHandlerOptions(opts...),
+	)
+	pluginAuthServiceGetDeviceStatusHandler := connect.NewUnaryHandler(
+		PluginAuthServiceGetDeviceStatusProcedure,
+		svc.GetDeviceStatus,
+		connect.WithSchema(pluginAuthServiceMethods.ByName("GetDeviceStatus")),
+		connect.WithHandlerOptions(opts...),
+	)
 	pluginAuthServiceWhoamiHandler := connect.NewUnaryHandler(
 		PluginAuthServiceWhoamiProcedure,
 		svc.Whoami,
@@ -598,6 +644,10 @@ func NewPluginAuthServiceHandler(svc PluginAuthServiceHandler, opts ...connect.H
 			pluginAuthServicePollDeviceHandler.ServeHTTP(w, r)
 		case PluginAuthServiceApproveDeviceProcedure:
 			pluginAuthServiceApproveDeviceHandler.ServeHTTP(w, r)
+		case PluginAuthServiceDenyDeviceProcedure:
+			pluginAuthServiceDenyDeviceHandler.ServeHTTP(w, r)
+		case PluginAuthServiceGetDeviceStatusProcedure:
+			pluginAuthServiceGetDeviceStatusHandler.ServeHTTP(w, r)
 		case PluginAuthServiceWhoamiProcedure:
 			pluginAuthServiceWhoamiHandler.ServeHTTP(w, r)
 		default:
@@ -621,6 +671,14 @@ func (UnimplementedPluginAuthServiceHandler) ApproveDevice(context.Context, *con
 	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("orchestrator.v1.PluginAuthService.ApproveDevice is not implemented"))
 }
 
+func (UnimplementedPluginAuthServiceHandler) DenyDevice(context.Context, *connect.Request[v1.DenyDeviceRequest]) (*connect.Response[v1.DenyDeviceResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("orchestrator.v1.PluginAuthService.DenyDevice is not implemented"))
+}
+
+func (UnimplementedPluginAuthServiceHandler) GetDeviceStatus(context.Context, *connect.Request[v1.GetDeviceStatusRequest]) (*connect.Response[v1.GetDeviceStatusResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("orchestrator.v1.PluginAuthService.GetDeviceStatus is not implemented"))
+}
+
 func (UnimplementedPluginAuthServiceHandler) Whoami(context.Context, *connect.Request[v1.WhoamiRequest]) (*connect.Response[v1.WhoamiResponse], error) {
 	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("orchestrator.v1.PluginAuthService.Whoami is not implemented"))
 }
diff --git a/internal/api/orchestrator/v1/plugin_registry.pb.go b/internal/api/orchestrator/v1/plugin_registry.pb.go
index 07afad7..671d940 100644
--- a/internal/api/orchestrator/v1/plugin_registry.pb.go
+++ b/internal/api/orchestrator/v1/plugin_registry.pb.go
@@ -1890,6 +1890,198 @@ func (*ApproveDeviceResponse) Descriptor() ([]byte, []int) {
 	return file_orchestrator_v1_plugin_registry_proto_rawDescGZIP(), []int{30}
 }
 
+type DenyDeviceRequest struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	UserCode      string                 `protobuf:"bytes,1,opt,name=user_code,json=userCode,proto3" json:"user_code,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *DenyDeviceRequest) Reset() {
+	*x = DenyDeviceRequest{}
+	mi := &file_orchestrator_v1_plugin_registry_proto_msgTypes[31]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *DenyDeviceRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*DenyDeviceRequest) ProtoMessage() {}
+
+func (x *DenyDeviceRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_orchestrator_v1_plugin_registry_proto_msgTypes[31]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use DenyDeviceRequest.ProtoReflect.Descriptor instead.
+func (*DenyDeviceRequest) Descriptor() ([]byte, []int) {
+	return file_orchestrator_v1_plugin_registry_proto_rawDescGZIP(), []int{31}
+}
+
+func (x *DenyDeviceRequest) GetUserCode() string {
+	if x != nil {
+		return x.UserCode
+	}
+	return ""
+}
+
+type DenyDeviceResponse struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *DenyDeviceResponse) Reset() {
+	*x = DenyDeviceResponse{}
+	mi := &file_orchestrator_v1_plugin_registry_proto_msgTypes[32]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *DenyDeviceResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*DenyDeviceResponse) ProtoMessage() {}
+
+func (x *DenyDeviceResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_orchestrator_v1_plugin_registry_proto_msgTypes[32]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use DenyDeviceResponse.ProtoReflect.Descriptor instead.
+func (*DenyDeviceResponse) Descriptor() ([]byte, []int) {
+	return file_orchestrator_v1_plugin_registry_proto_rawDescGZIP(), []int{32}
+}
+
+type GetDeviceStatusRequest struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	UserCode      string                 `protobuf:"bytes,1,opt,name=user_code,json=userCode,proto3" json:"user_code,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *GetDeviceStatusRequest) Reset() {
+	*x = GetDeviceStatusRequest{}
+	mi := &file_orchestrator_v1_plugin_registry_proto_msgTypes[33]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *GetDeviceStatusRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*GetDeviceStatusRequest) ProtoMessage() {}
+
+func (x *GetDeviceStatusRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_orchestrator_v1_plugin_registry_proto_msgTypes[33]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use GetDeviceStatusRequest.ProtoReflect.Descriptor instead.
+func (*GetDeviceStatusRequest) Descriptor() ([]byte, []int) {
+	return file_orchestrator_v1_plugin_registry_proto_rawDescGZIP(), []int{33}
+}
+
+func (x *GetDeviceStatusRequest) GetUserCode() string {
+	if x != nil {
+		return x.UserCode
+	}
+	return ""
+}
+
+type GetDeviceStatusResponse struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Valid         bool                   `protobuf:"varint,1,opt,name=valid,proto3" json:"valid,omitempty"`
+	Authorized    bool                   `protobuf:"varint,2,opt,name=authorized,proto3" json:"authorized,omitempty"`
+	Denied        bool                   `protobuf:"varint,3,opt,name=denied,proto3" json:"denied,omitempty"`
+	ClientId      string                 `protobuf:"bytes,4,opt,name=client_id,json=clientId,proto3" json:"client_id,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *GetDeviceStatusResponse) Reset() {
+	*x = GetDeviceStatusResponse{}
+	mi := &file_orchestrator_v1_plugin_registry_proto_msgTypes[34]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *GetDeviceStatusResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*GetDeviceStatusResponse) ProtoMessage() {}
+
+func (x *GetDeviceStatusResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_orchestrator_v1_plugin_registry_proto_msgTypes[34]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use GetDeviceStatusResponse.ProtoReflect.Descriptor instead.
+func (*GetDeviceStatusResponse) Descriptor() ([]byte, []int) {
+	return file_orchestrator_v1_plugin_registry_proto_rawDescGZIP(), []int{34}
+}
+
+func (x *GetDeviceStatusResponse) GetValid() bool {
+	if x != nil {
+		return x.Valid
+	}
+	return false
+}
+
+func (x *GetDeviceStatusResponse) GetAuthorized() bool {
+	if x != nil {
+		return x.Authorized
+	}
+	return false
+}
+
+func (x *GetDeviceStatusResponse) GetDenied() bool {
+	if x != nil {
+		return x.Denied
+	}
+	return false
+}
+
+func (x *GetDeviceStatusResponse) GetClientId() string {
+	if x != nil {
+		return x.ClientId
+	}
+	return ""
+}
+
 type WhoamiRequest struct {
 	state         protoimpl.MessageState `protogen:"open.v1"`
 	unknownFields protoimpl.UnknownFields
@@ -1898,7 +2090,7 @@ type WhoamiRequest struct {
 
 func (x *WhoamiRequest) Reset() {
 	*x = WhoamiRequest{}
-	mi := &file_orchestrator_v1_plugin_registry_proto_msgTypes[31]
+	mi := &file_orchestrator_v1_plugin_registry_proto_msgTypes[35]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1910,7 +2102,7 @@ func (x *WhoamiRequest) String() string {
 func (*WhoamiRequest) ProtoMessage() {}
 
 func (x *WhoamiRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_orchestrator_v1_plugin_registry_proto_msgTypes[31]
+	mi := &file_orchestrator_v1_plugin_registry_proto_msgTypes[35]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1923,7 +2115,7 @@ func (x *WhoamiRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use WhoamiRequest.ProtoReflect.Descriptor instead.
 func (*WhoamiRequest) Descriptor() ([]byte, []int) {
-	return file_orchestrator_v1_plugin_registry_proto_rawDescGZIP(), []int{31}
+	return file_orchestrator_v1_plugin_registry_proto_rawDescGZIP(), []int{35}
 }
 
 type WhoamiResponse struct {
@@ -1937,7 +2129,7 @@ type WhoamiResponse struct {
 
 func (x *WhoamiResponse) Reset() {
 	*x = WhoamiResponse{}
-	mi := &file_orchestrator_v1_plugin_registry_proto_msgTypes[32]
+	mi := &file_orchestrator_v1_plugin_registry_proto_msgTypes[36]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1949,7 +2141,7 @@ func (x *WhoamiResponse) String() string {
 func (*WhoamiResponse) ProtoMessage() {}
 
 func (x *WhoamiResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_orchestrator_v1_plugin_registry_proto_msgTypes[32]
+	mi := &file_orchestrator_v1_plugin_registry_proto_msgTypes[36]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1962,7 +2154,7 @@ func (x *WhoamiResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use WhoamiResponse.ProtoReflect.Descriptor instead.
 func (*WhoamiResponse) Descriptor() ([]byte, []int) {
-	return file_orchestrator_v1_plugin_registry_proto_rawDescGZIP(), []int{32}
+	return file_orchestrator_v1_plugin_registry_proto_rawDescGZIP(), []int{36}
 }
 
 func (x *WhoamiResponse) GetUserId() string {
@@ -2149,7 +2341,19 @@ const file_orchestrator_v1_plugin_registry_proto_rawDesc = "" +
 	"\x06status\x18\x02 \x01(\tR\x06status\"3\n" +
 	"\x14ApproveDeviceRequest\x12\x1b\n" +
 	"\tuser_code\x18\x01 \x01(\tR\buserCode\"\x17\n" +
-	"\x15ApproveDeviceResponse\"\x0f\n" +
+	"\x15ApproveDeviceResponse\"0\n" +
+	"\x11DenyDeviceRequest\x12\x1b\n" +
+	"\tuser_code\x18\x01 \x01(\tR\buserCode\"\x14\n" +
+	"\x12DenyDeviceResponse\"5\n" +
+	"\x16GetDeviceStatusRequest\x12\x1b\n" +
+	"\tuser_code\x18\x01 \x01(\tR\buserCode\"\x84\x01\n" +
+	"\x17GetDeviceStatusResponse\x12\x14\n" +
+	"\x05valid\x18\x01 \x01(\bR\x05valid\x12\x1e\n" +
+	"\n" +
+	"authorized\x18\x02 \x01(\bR\n" +
+	"authorized\x12\x16\n" +
+	"\x06denied\x18\x03 \x01(\bR\x06denied\x12\x1b\n" +
+	"\tclient_id\x18\x04 \x01(\tR\bclientId\"\x0f\n" +
 	"\rWhoamiRequest\"b\n" +
 	"\x0eWhoamiResponse\x12\x17\n" +
 	"\auser_id\x18\x01 \x01(\tR\x06userId\x12\x14\n" +
@@ -2168,12 +2372,15 @@ const file_orchestrator_v1_plugin_registry_proto_rawDesc = "" +
 	"\x0eResolveInstall\x12&.orchestrator.v1.ResolveInstallRequest\x1a'.orchestrator.v1.ResolveInstallResponse\x12a\n" +
 	"\x0eListCategories\x12&.orchestrator.v1.ListCategoriesRequest\x1a'.orchestrator.v1.ListCategoriesResponse2y\n" +
 	"\x14PluginPublishService\x12a\n" +
-	"\x0ePublishVersion\x12&.orchestrator.v1.PublishVersionRequest\x1a'.orchestrator.v1.PublishVersionResponse2\xef\x02\n" +
+	"\x0ePublishVersion\x12&.orchestrator.v1.PublishVersionRequest\x1a'.orchestrator.v1.PublishVersionResponse2\xac\x04\n" +
 	"\x11PluginAuthService\x12X\n" +
 	"\vStartDevice\x12#.orchestrator.v1.StartDeviceRequest\x1a$.orchestrator.v1.StartDeviceResponse\x12U\n" +
 	"\n" +
 	"PollDevice\x12\".orchestrator.v1.PollDeviceRequest\x1a#.orchestrator.v1.PollDeviceResponse\x12^\n" +
-	"\rApproveDevice\x12%.orchestrator.v1.ApproveDeviceRequest\x1a&.orchestrator.v1.ApproveDeviceResponse\x12I\n" +
+	"\rApproveDevice\x12%.orchestrator.v1.ApproveDeviceRequest\x1a&.orchestrator.v1.ApproveDeviceResponse\x12U\n" +
+	"\n" +
+	"DenyDevice\x12\".orchestrator.v1.DenyDeviceRequest\x1a#.orchestrator.v1.DenyDeviceResponse\x12d\n" +
+	"\x0fGetDeviceStatus\x12'.orchestrator.v1.GetDeviceStatusRequest\x1a(.orchestrator.v1.GetDeviceStatusResponse\x12I\n" +
 	"\x06Whoami\x12\x1e.orchestrator.v1.WhoamiRequest\x1a\x1f.orchestrator.v1.WhoamiResponseB\xd6\x01\n" +
 	"\x13com.orchestrator.v1B\x13PluginRegistryProtoP\x01ZMgit.dev.alexdunmow.com/block/core/internal/api/orchestrator/v1;orchestratorv1\xa2\x02\x03OXX\xaa\x02\x0fOrchestrator.V1\xca\x02\x0fOrchestrator\\V1\xe2\x02\x1bOrchestrator\\V1\\GPBMetadata\xea\x02\x10Orchestrator::V1b\x06proto3"
 
@@ -2189,48 +2396,52 @@ func file_orchestrator_v1_plugin_registry_proto_rawDescGZIP() []byte {
 	return file_orchestrator_v1_plugin_registry_proto_rawDescData
 }
 
-var file_orchestrator_v1_plugin_registry_proto_msgTypes = make([]protoimpl.MessageInfo, 34)
+var file_orchestrator_v1_plugin_registry_proto_msgTypes = make([]protoimpl.MessageInfo, 38)
 var file_orchestrator_v1_plugin_registry_proto_goTypes = []any{
-	(*Scope)(nil),                  // 0: orchestrator.v1.Scope
-	(*Plugin)(nil),                 // 1: orchestrator.v1.Plugin
-	(*Category)(nil),               // 2: orchestrator.v1.Category
-	(*Version)(nil),                // 3: orchestrator.v1.Version
-	(*Requirement)(nil),            // 4: orchestrator.v1.Requirement
-	(*CreateScopeRequest)(nil),     // 5: orchestrator.v1.CreateScopeRequest
-	(*CreateScopeResponse)(nil),    // 6: orchestrator.v1.CreateScopeResponse
-	(*ListMyScopesRequest)(nil),    // 7: orchestrator.v1.ListMyScopesRequest
-	(*ListMyScopesResponse)(nil),   // 8: orchestrator.v1.ListMyScopesResponse
-	(*GetScopeRequest)(nil),        // 9: orchestrator.v1.GetScopeRequest
-	(*GetScopeResponse)(nil),       // 10: orchestrator.v1.GetScopeResponse
-	(*CreatePluginRequest)(nil),    // 11: orchestrator.v1.CreatePluginRequest
-	(*CreatePluginResponse)(nil),   // 12: orchestrator.v1.CreatePluginResponse
-	(*GetPluginRequest)(nil),       // 13: orchestrator.v1.GetPluginRequest
-	(*GetPluginResponse)(nil),      // 14: orchestrator.v1.GetPluginResponse
-	(*ListPluginsRequest)(nil),     // 15: orchestrator.v1.ListPluginsRequest
-	(*ListPluginsResponse)(nil),    // 16: orchestrator.v1.ListPluginsResponse
-	(*ListCategoriesRequest)(nil),  // 17: orchestrator.v1.ListCategoriesRequest
-	(*ListCategoriesResponse)(nil), // 18: orchestrator.v1.ListCategoriesResponse
-	(*GetVersionRequest)(nil),      // 19: orchestrator.v1.GetVersionRequest
-	(*GetVersionResponse)(nil),     // 20: orchestrator.v1.GetVersionResponse
-	(*ResolveInstallRequest)(nil),  // 21: orchestrator.v1.ResolveInstallRequest
-	(*ResolveInstallResponse)(nil), // 22: orchestrator.v1.ResolveInstallResponse
-	(*PublishVersionRequest)(nil),  // 23: orchestrator.v1.PublishVersionRequest
-	(*PublishVersionResponse)(nil), // 24: orchestrator.v1.PublishVersionResponse
-	(*StartDeviceRequest)(nil),     // 25: orchestrator.v1.StartDeviceRequest
-	(*StartDeviceResponse)(nil),    // 26: orchestrator.v1.StartDeviceResponse
-	(*PollDeviceRequest)(nil),      // 27: orchestrator.v1.PollDeviceRequest
-	(*PollDeviceResponse)(nil),     // 28: orchestrator.v1.PollDeviceResponse
-	(*ApproveDeviceRequest)(nil),   // 29: orchestrator.v1.ApproveDeviceRequest
-	(*ApproveDeviceResponse)(nil),  // 30: orchestrator.v1.ApproveDeviceResponse
-	(*WhoamiRequest)(nil),          // 31: orchestrator.v1.WhoamiRequest
-	(*WhoamiResponse)(nil),         // 32: orchestrator.v1.WhoamiResponse
-	nil,                            // 33: orchestrator.v1.GetPluginResponse.ChannelsEntry
-	(*timestamppb.Timestamp)(nil),  // 34: google.protobuf.Timestamp
+	(*Scope)(nil),                   // 0: orchestrator.v1.Scope
+	(*Plugin)(nil),                  // 1: orchestrator.v1.Plugin
+	(*Category)(nil),                // 2: orchestrator.v1.Category
+	(*Version)(nil),                 // 3: orchestrator.v1.Version
+	(*Requirement)(nil),             // 4: orchestrator.v1.Requirement
+	(*CreateScopeRequest)(nil),      // 5: orchestrator.v1.CreateScopeRequest
+	(*CreateScopeResponse)(nil),     // 6: orchestrator.v1.CreateScopeResponse
+	(*ListMyScopesRequest)(nil),     // 7: orchestrator.v1.ListMyScopesRequest
+	(*ListMyScopesResponse)(nil),    // 8: orchestrator.v1.ListMyScopesResponse
+	(*GetScopeRequest)(nil),         // 9: orchestrator.v1.GetScopeRequest
+	(*GetScopeResponse)(nil),        // 10: orchestrator.v1.GetScopeResponse
+	(*CreatePluginRequest)(nil),     // 11: orchestrator.v1.CreatePluginRequest
+	(*CreatePluginResponse)(nil),    // 12: orchestrator.v1.CreatePluginResponse
+	(*GetPluginRequest)(nil),        // 13: orchestrator.v1.GetPluginRequest
+	(*GetPluginResponse)(nil),       // 14: orchestrator.v1.GetPluginResponse
+	(*ListPluginsRequest)(nil),      // 15: orchestrator.v1.ListPluginsRequest
+	(*ListPluginsResponse)(nil),     // 16: orchestrator.v1.ListPluginsResponse
+	(*ListCategoriesRequest)(nil),   // 17: orchestrator.v1.ListCategoriesRequest
+	(*ListCategoriesResponse)(nil),  // 18: orchestrator.v1.ListCategoriesResponse
+	(*GetVersionRequest)(nil),       // 19: orchestrator.v1.GetVersionRequest
+	(*GetVersionResponse)(nil),      // 20: orchestrator.v1.GetVersionResponse
+	(*ResolveInstallRequest)(nil),   // 21: orchestrator.v1.ResolveInstallRequest
+	(*ResolveInstallResponse)(nil),  // 22: orchestrator.v1.ResolveInstallResponse
+	(*PublishVersionRequest)(nil),   // 23: orchestrator.v1.PublishVersionRequest
+	(*PublishVersionResponse)(nil),  // 24: orchestrator.v1.PublishVersionResponse
+	(*StartDeviceRequest)(nil),      // 25: orchestrator.v1.StartDeviceRequest
+	(*StartDeviceResponse)(nil),     // 26: orchestrator.v1.StartDeviceResponse
+	(*PollDeviceRequest)(nil),       // 27: orchestrator.v1.PollDeviceRequest
+	(*PollDeviceResponse)(nil),      // 28: orchestrator.v1.PollDeviceResponse
+	(*ApproveDeviceRequest)(nil),    // 29: orchestrator.v1.ApproveDeviceRequest
+	(*ApproveDeviceResponse)(nil),   // 30: orchestrator.v1.ApproveDeviceResponse
+	(*DenyDeviceRequest)(nil),       // 31: orchestrator.v1.DenyDeviceRequest
+	(*DenyDeviceResponse)(nil),      // 32: orchestrator.v1.DenyDeviceResponse
+	(*GetDeviceStatusRequest)(nil),  // 33: orchestrator.v1.GetDeviceStatusRequest
+	(*GetDeviceStatusResponse)(nil), // 34: orchestrator.v1.GetDeviceStatusResponse
+	(*WhoamiRequest)(nil),           // 35: orchestrator.v1.WhoamiRequest
+	(*WhoamiResponse)(nil),          // 36: orchestrator.v1.WhoamiResponse
+	nil,                             // 37: orchestrator.v1.GetPluginResponse.ChannelsEntry
+	(*timestamppb.Timestamp)(nil),   // 38: google.protobuf.Timestamp
 }
 var file_orchestrator_v1_plugin_registry_proto_depIdxs = []int32{
-	34, // 0: orchestrator.v1.Scope.created_at:type_name -> google.protobuf.Timestamp
-	34, // 1: orchestrator.v1.Plugin.updated_at:type_name -> google.protobuf.Timestamp
-	34, // 2: orchestrator.v1.Version.published_at:type_name -> google.protobuf.Timestamp
+	38, // 0: orchestrator.v1.Scope.created_at:type_name -> google.protobuf.Timestamp
+	38, // 1: orchestrator.v1.Plugin.updated_at:type_name -> google.protobuf.Timestamp
+	38, // 2: orchestrator.v1.Version.published_at:type_name -> google.protobuf.Timestamp
 	0,  // 3: orchestrator.v1.CreateScopeResponse.scope:type_name -> orchestrator.v1.Scope
 	0,  // 4: orchestrator.v1.ListMyScopesResponse.scopes:type_name -> orchestrator.v1.Scope
 	0,  // 5: orchestrator.v1.GetScopeResponse.scope:type_name -> orchestrator.v1.Scope
@@ -2238,7 +2449,7 @@ var file_orchestrator_v1_plugin_registry_proto_depIdxs = []int32{
 	1,  // 7: orchestrator.v1.CreatePluginResponse.plugin:type_name -> orchestrator.v1.Plugin
 	1,  // 8: orchestrator.v1.GetPluginResponse.plugin:type_name -> orchestrator.v1.Plugin
 	3,  // 9: orchestrator.v1.GetPluginResponse.versions:type_name -> orchestrator.v1.Version
-	33, // 10: orchestrator.v1.GetPluginResponse.channels:type_name -> orchestrator.v1.GetPluginResponse.ChannelsEntry
+	37, // 10: orchestrator.v1.GetPluginResponse.channels:type_name -> orchestrator.v1.GetPluginResponse.ChannelsEntry
 	1,  // 11: orchestrator.v1.ListPluginsResponse.plugins:type_name -> orchestrator.v1.Plugin
 	2,  // 12: orchestrator.v1.ListCategoriesResponse.categories:type_name -> orchestrator.v1.Category
 	3,  // 13: orchestrator.v1.GetVersionResponse.version:type_name -> orchestrator.v1.Version
@@ -2258,23 +2469,27 @@ var file_orchestrator_v1_plugin_registry_proto_depIdxs = []int32{
 	25, // 27: orchestrator.v1.PluginAuthService.StartDevice:input_type -> orchestrator.v1.StartDeviceRequest
 	27, // 28: orchestrator.v1.PluginAuthService.PollDevice:input_type -> orchestrator.v1.PollDeviceRequest
 	29, // 29: orchestrator.v1.PluginAuthService.ApproveDevice:input_type -> orchestrator.v1.ApproveDeviceRequest
-	31, // 30: orchestrator.v1.PluginAuthService.Whoami:input_type -> orchestrator.v1.WhoamiRequest
-	6,  // 31: orchestrator.v1.PluginScopeService.CreateScope:output_type -> orchestrator.v1.CreateScopeResponse
-	8,  // 32: orchestrator.v1.PluginScopeService.ListMyScopes:output_type -> orchestrator.v1.ListMyScopesResponse
-	10, // 33: orchestrator.v1.PluginScopeService.GetScope:output_type -> orchestrator.v1.GetScopeResponse
-	12, // 34: orchestrator.v1.PluginRegistryService.CreatePlugin:output_type -> orchestrator.v1.CreatePluginResponse
-	14, // 35: orchestrator.v1.PluginRegistryService.GetPlugin:output_type -> orchestrator.v1.GetPluginResponse
-	16, // 36: orchestrator.v1.PluginRegistryService.ListPlugins:output_type -> orchestrator.v1.ListPluginsResponse
-	20, // 37: orchestrator.v1.PluginRegistryService.GetVersion:output_type -> orchestrator.v1.GetVersionResponse
-	22, // 38: orchestrator.v1.PluginRegistryService.ResolveInstall:output_type -> orchestrator.v1.ResolveInstallResponse
-	18, // 39: orchestrator.v1.PluginRegistryService.ListCategories:output_type -> orchestrator.v1.ListCategoriesResponse
-	24, // 40: orchestrator.v1.PluginPublishService.PublishVersion:output_type -> orchestrator.v1.PublishVersionResponse
-	26, // 41: orchestrator.v1.PluginAuthService.StartDevice:output_type -> orchestrator.v1.StartDeviceResponse
-	28, // 42: orchestrator.v1.PluginAuthService.PollDevice:output_type -> orchestrator.v1.PollDeviceResponse
-	30, // 43: orchestrator.v1.PluginAuthService.ApproveDevice:output_type -> orchestrator.v1.ApproveDeviceResponse
-	32, // 44: orchestrator.v1.PluginAuthService.Whoami:output_type -> orchestrator.v1.WhoamiResponse
-	31, // [31:45] is the sub-list for method output_type
-	17, // [17:31] is the sub-list for method input_type
+	31, // 30: orchestrator.v1.PluginAuthService.DenyDevice:input_type -> orchestrator.v1.DenyDeviceRequest
+	33, // 31: orchestrator.v1.PluginAuthService.GetDeviceStatus:input_type -> orchestrator.v1.GetDeviceStatusRequest
+	35, // 32: orchestrator.v1.PluginAuthService.Whoami:input_type -> orchestrator.v1.WhoamiRequest
+	6,  // 33: orchestrator.v1.PluginScopeService.CreateScope:output_type -> orchestrator.v1.CreateScopeResponse
+	8,  // 34: orchestrator.v1.PluginScopeService.ListMyScopes:output_type -> orchestrator.v1.ListMyScopesResponse
+	10, // 35: orchestrator.v1.PluginScopeService.GetScope:output_type -> orchestrator.v1.GetScopeResponse
+	12, // 36: orchestrator.v1.PluginRegistryService.CreatePlugin:output_type -> orchestrator.v1.CreatePluginResponse
+	14, // 37: orchestrator.v1.PluginRegistryService.GetPlugin:output_type -> orchestrator.v1.GetPluginResponse
+	16, // 38: orchestrator.v1.PluginRegistryService.ListPlugins:output_type -> orchestrator.v1.ListPluginsResponse
+	20, // 39: orchestrator.v1.PluginRegistryService.GetVersion:output_type -> orchestrator.v1.GetVersionResponse
+	22, // 40: orchestrator.v1.PluginRegistryService.ResolveInstall:output_type -> orchestrator.v1.ResolveInstallResponse
+	18, // 41: orchestrator.v1.PluginRegistryService.ListCategories:output_type -> orchestrator.v1.ListCategoriesResponse
+	24, // 42: orchestrator.v1.PluginPublishService.PublishVersion:output_type -> orchestrator.v1.PublishVersionResponse
+	26, // 43: orchestrator.v1.PluginAuthService.StartDevice:output_type -> orchestrator.v1.StartDeviceResponse
+	28, // 44: orchestrator.v1.PluginAuthService.PollDevice:output_type -> orchestrator.v1.PollDeviceResponse
+	30, // 45: orchestrator.v1.PluginAuthService.ApproveDevice:output_type -> orchestrator.v1.ApproveDeviceResponse
+	32, // 46: orchestrator.v1.PluginAuthService.DenyDevice:output_type -> orchestrator.v1.DenyDeviceResponse
+	34, // 47: orchestrator.v1.PluginAuthService.GetDeviceStatus:output_type -> orchestrator.v1.GetDeviceStatusResponse
+	36, // 48: orchestrator.v1.PluginAuthService.Whoami:output_type -> orchestrator.v1.WhoamiResponse
+	33, // [33:49] is the sub-list for method output_type
+	17, // [17:33] is the sub-list for method input_type
 	17, // [17:17] is the sub-list for extension type_name
 	17, // [17:17] is the sub-list for extension extendee
 	0,  // [0:17] is the sub-list for field type_name
@@ -2291,7 +2506,7 @@ func file_orchestrator_v1_plugin_registry_proto_init() {
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
 			RawDescriptor: unsafe.Slice(unsafe.StringData(file_orchestrator_v1_plugin_registry_proto_rawDesc), len(file_orchestrator_v1_plugin_registry_proto_rawDesc)),
 			NumEnums:      0,
-			NumMessages:   34,
+			NumMessages:   38,
 			NumExtensions: 0,
 			NumServices:   4,
 		},
diff --git a/proto/orchestrator/v1/plugin_registry.proto b/proto/orchestrator/v1/plugin_registry.proto
index a04607c..4859514 100644
--- a/proto/orchestrator/v1/plugin_registry.proto
+++ b/proto/orchestrator/v1/plugin_registry.proto
@@ -33,6 +33,8 @@ service PluginAuthService {
   rpc StartDevice(StartDeviceRequest) returns (StartDeviceResponse);
   rpc PollDevice(PollDeviceRequest) returns (PollDeviceResponse);
   rpc ApproveDevice(ApproveDeviceRequest) returns (ApproveDeviceResponse);
+  rpc DenyDevice(DenyDeviceRequest) returns (DenyDeviceResponse);
+  rpc GetDeviceStatus(GetDeviceStatusRequest) returns (GetDeviceStatusResponse);
   rpc Whoami(WhoamiRequest) returns (WhoamiResponse);
 }
 
@@ -190,6 +192,17 @@ message PollDeviceResponse {
 message ApproveDeviceRequest { string user_code = 1; }
 message ApproveDeviceResponse {}
 
+message DenyDeviceRequest { string user_code = 1; }
+message DenyDeviceResponse {}
+
+message GetDeviceStatusRequest { string user_code = 1; }
+message GetDeviceStatusResponse {
+  bool valid = 1;
+  bool authorized = 2;
+  bool denied = 3;
+  string client_id = 4;
+}
+
 message WhoamiRequest {}
 message WhoamiResponse {
   string user_id = 1;