Who this bearer is

GET

/auth/me

curl --request GET \
  --url https://api.sloose.com/auth/me \
  --header 'Authorization: Bearer <token>'

• Production

The organisation, the user and the role behind the bearer, plus whether the organisation holds a connected CRM. via says whether you authenticated with a session token or an organisation API token — the same route answers both, which is what makes a token a drop-in for a session.

Authorizations

• sessionAuth
• apiTokenAuth

Responses

200

The identity behind the bearer.

Media typeapplication/json

object

org

required

object

id

required

string

name

required

string

connected

required

Whether the organisation holds a connection the server can use with nobody present. Which one a request uses is always the one it names.

boolean

user

required

object

id

required

string

email

required

string

displayName

required

string | null

role

required

string

Allowed values: owner admin builder operator

via

required

string

Allowed values: session token

exp

required

Seconds since the epoch. For a session, when it ends unless it is used again (it slides with use). For an API token (via: "token"), an hour from this answer and NOT the token’s own expiry: a token lives until revoked or until the expiry it was made with, which GET /orgs/{org}/tokens lists as expiresAt (#1589).

number

Example

{
  "role": "owner",
  "via": "session"
}

401

The session is unknown or expired (code: AUTH_REQUIRED). An API token that was revoked or expired says so (code: TOKEN_REVOKED, TOKEN_EXPIRED); one whose organisation has been deleted answers ORG_NOT_FOUND; one whose member or user row has gone answers MEMBERSHIP_GONE.

Media typeapplication/json

The error envelope every non-2xx answer uses.

object

error

required

Human-readable explanation.

string

code

Machine-readable reason. Absent on a few legacy 400s.

string

key

additional properties

Example^generated

{
  "error": "example",
  "code": "example"
}

403

The organisation has been closed (code: ORG_CLOSED), this person is banned (code: BANNED), or the session is signed in but in no organisation — it never joined one, or was taken out of or left the one it was in (code: NO_ORG).

Media typeapplication/json

The error envelope every non-2xx answer uses.

object

error

required

Human-readable explanation.

string

code

Machine-readable reason. Absent on a few legacy 400s.

string

key

additional properties

Example^generated

{
  "error": "example",
  "code": "example"
}

503

The restore switch is on (code: MAINTENANCE): every route but /health and /robots.txt is refused before anything is read, except the operator’s own POST /staff/people/{id}/delete with the ADMIN_TOKEN. Sloose is down for maintenance. Please try again in a few minutes.

Media typeapplication/json

object

error

required

string

code

required

string

Allowed value: MAINTENANCE

Example

{
  "code": "MAINTENANCE"
}

Headers

Retry-After

integer

Seconds until asking again is worth it (300 while the switch is on).