Connect the org for server-side work

POST

/auth/orgs/{org}/connect

curl --request POST \
  --url https://api.sloose.com/auth/orgs/org_9f3c/connect \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '{ "return": "example" }'

• Production
• Staging

Returns a URL that starts Zoho’s offline-scope grant. Signing in gives us an access token for one browser session; connecting gives us a refresh token so the server can read the CRM on its own — which is what discovery and, later, scheduled runs need.

Only an administrator can connect, and only with the same Zoho user they are signed in as. The refresh token is encrypted at rest and never leaves the server. The popup ends by posting { type: "sloose:connected", orgId } to the opener, or { type: "sloose:auth-error", message }.

Authorizations

• sessionAuth
• apiTokenAuth

Parameters

Path Parameters

org

required

The org id the session was issued for. A token for one org can never read another.

string

Example

org_9f3c

The org id the session was issued for. A token for one org can never read another.

Query Parameters

return

Alternative to the body field.

string

Alternative to the body field.

Request Body

Media typeapplication/json

object

return

Where to post the outcome. Must be the widget origin. Also accepted as a ?return= query parameter.

string

Example^generated

{
  "return": "example"
}

Responses

200

Where to send the administrator.

Media typeapplication/json

object

url

required

Open this in a popup.

string

Example^generated

{
  "url": "example"
}

400

The request body did not match the schema. issues carries the Zod issue list.

Media typeapplication/json

The error envelope every non-2xx answer uses.

object

error

required

Human-readable explanation.

string

code

Machine-readable reason. Absent on a few legacy 400s.

string

key

additional properties

Example^generated

{
  "error": "example",
  "code": "example"
}

401

No bearer, or one that is expired, revoked or no longer resolves to a member.

Media typeapplication/json

The error envelope every non-2xx answer uses.

object

error

required

Human-readable explanation.

string

code

Machine-readable reason. Absent on a few legacy 400s.

string

key

additional properties

Example^generated

{
  "error": "example",
  "code": "example"
}

403

The bearer’s role is too low, or it was issued for a different org.

Media typeapplication/json

The error envelope every non-2xx answer uses.

object

error

required

Human-readable explanation.

string

code

Machine-readable reason. Absent on a few legacy 400s.

string

key

additional properties

Example^generated

{
  "error": "example",
  "code": "example"
}

409

The session’s data centre is unknown, or ZOHO_CLIENT_ID is not configured.

Media typeapplication/json

The error envelope every non-2xx answer uses.

object

error

required

Human-readable explanation.

string

code

Machine-readable reason. Absent on a few legacy 400s.

string

key

additional properties

Example^generated

{
  "error": "example",
  "code": "example"
}