Base URLs: staging https://api-staging.sloose.com, production https://api.sloose.com.
Authenticate with Authorization: Bearer <token>. Two kinds of bearer are accepted everywhere
under /auth, /orgs, /entitlements, /billing, /ai and /mcp:
- A session token, issued by Login with Zoho, lasting eight hours; refresh with
POST /auth/session/refresh.
- An org API token (
slo_…), minted by an org administrator under /orgs/:org/tokens for the
SDK CLI and CI. It is scoped to one org with the admin role, acts as the member who created it,
never expires unless given an expiry, and can be revoked. A revoked or expired token answers
401 with code TOKEN_REVOKED or TOKEN_EXPIRED. Routes marked session only refuse it with
403 SESSION_REQUIRED.
Backoffice routes under /admin take the backoffice token instead.
Errors are JSON { error, code }. Reason codes for limits are a closed set: LIMIT_ROWS,
LIMIT_MODULES, LIMIT_SCHEDULES, FEATURE_<NAME>, CREDITS_EXHAUSTED, STATUS_SUSPENDED,
STATUS_PAST_DUE. A 402 carries the credit balance.
| Method |
Path |
Notes |
| GET |
/auth/zoho/start?dc=&return= |
Redirects to Zoho. The callback posts { type: 'sloose:session', token } to the opener. |
| GET |
/auth/zoho/callback |
Exchanges the code, upserts org and member, issues the session. |
| POST |
/auth/session/refresh |
New token for a valid session. Session only. |
| GET |
/auth/me |
The session’s org, user and role; via is session or token. |
| POST |
/auth/orgs/:org/connect |
Admin. Starts the offline-scope grant that lets the server run discovery. |
| GET |
/auth/orgs/:org/connection |
Admin. Connection health, scopes, active CRM user count. |
| GET |
/orgs/:org/tokens |
Admin. Every API token the org has issued, with prefix, creator, last use, expiry and revocation. Never the secret. |
| POST |
/orgs/:org/tokens |
Admin, session only. { name, expiresAt? } → 201 { token, secret }. The secret is shown once. |
| DELETE |
/orgs/:org/tokens/:id |
Admin, session only. Revoke. Idempotent. |
| Method |
Path |
Notes |
| POST |
/orgs/:org/discovery/run |
Admin. Reads modules and fields from the CRM, preserves annotations, flags removed fields. |
| GET |
/orgs/:org/discovery/latest |
Latest snapshot and diff. |
| GET |
/orgs/:org/config/resolved |
What the widget loads: registry, fields, annotations, libraries. Supports If-None-Match. |
| GET, PUT |
/orgs/:org/config/registry |
The registry document. PUT is admin. |
| GET |
/orgs/:org/config/modules |
Curation state per module. |
| PUT |
/orgs/:org/config/modules/order |
Admin. Creation order. |
| PATCH |
/orgs/:org/config/modules/:module |
Admin. Enable, singular, unique fields, match defaults, exclusions, seed mappings. |
| GET |
/orgs/:org/config/fields/:module |
Fields with annotations. ?all=1 includes removed. |
| PUT |
/orgs/:org/config/fields/:module/annotations |
Admin. Replace the module’s annotations. |
| PATCH |
/orgs/:org/config/fields/:module/:apiName |
Admin. One annotation. |
| GET, PATCH |
/orgs/:org/config/settings |
Date format, expression context, AI sample policy. |
| POST |
/orgs/:org/config/bundle |
Admin. Apply a configuration bundle from the SDK. 422 lists unknown modules or fields. |
| POST |
/config/validate/registry |
No auth. Validates a registry document. |
| Method |
Path |
Notes |
| GET, POST |
/orgs/:org/templates |
Builders create. Row data is never stored server-side. |
| GET, PUT, DELETE |
/orgs/:org/templates/:id |
Creator or admin edits. |
| POST |
/orgs/:org/templates/:id/share |
Share with the org. |
| GET |
/orgs/:org/templates/:id/runs |
Run history. |
| GET, POST, PUT, DELETE |
/orgs/:org/templates/:id/schedules[/:sid] |
Stored now, executed by the V2 runner. |
| GET |
/orgs/:org/libraries |
Helper libraries with manifests. |
| GET, PUT, DELETE |
/orgs/:org/libraries/:namespace |
Admin writes. Manifest validated; org scope only. |
| Method |
Path |
Notes |
| GET |
/entitlements/me |
Plan, status, limits, features, usage, credit balance. |
| GET |
/entitlements/usage |
Current period counters. |
| POST |
/entitlements/runs/authorise |
{ declaredRows, templateId }. Refused with LIMIT_ROWS unless overage is enabled. An authorised run always completes. |
| POST |
/entitlements/runs/:runId/progress |
{ rowsWritten, done, outcome } in batches. |
| POST |
/billing/checkout |
Plan or credit pack. Returns a Stripe Checkout URL, or an invoice for Enterprise. |
| POST |
/billing/portal |
Stripe Customer Portal URL. |
| GET |
/billing/summary |
Plan, balance, usage, notices, packs. |
| GET, POST |
/billing/autotopup |
Threshold and monthly cap. |
| POST |
/billing/overage |
Enable or disable row overage. |
| POST |
/billing/webhook |
Stripe webhooks, signature verified, idempotent per event. |
| Method |
Path |
Notes |
| POST |
/ai/auto-map |
Columns and up to 20 sample rows. Returns a proposal per column with confidence, validated against the org’s fields. |
| POST |
/ai/formula |
A question about one field. The expression is compiled and run on the samples before it is returned. |
| POST |
/ai/chat |
Server-sent events. Tools: schema, propose mapping, test expression, explain issue. |
| GET |
/ai/usage |
Credits and tokens by feature for the billing page. |
| POST |
/mcp |
Remote MCP server (Streamable HTTP). Tools: list_modules, get_fields, propose_mapping, test_expression, validate_template. |
Fields annotated as personal data are masked before any sample leaves the server. An org’s AI sample
policy is allow, masked or deny.