Switch the session to another organisation
const url = 'https://api.sloose.com/auth/session/org';const options = { method: 'POST', headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'}, body: '{"orgId":"example"}'};
try { const response = await fetch(url, options); const data = await response.json(); console.log(data);} catch (error) { console.error(error);}curl --request POST \ --url https://api.sloose.com/auth/session/org \ --header 'Authorization: Bearer <token>' \ --header 'Content-Type: application/json' \ --data '{ "orgId": "example" }'Points the session at one of the person’s organisations. Every organisation-scoped call after this runs there, with the role they hold there. Refused for an organisation they are not a member of. A CRM tab’s own session (POST /auth/session/frame) moves alone: the browser’s session and the other tabs’ stay where they are.
Session only, and never a staff member’s view of an organisation, which stays in the organisation it was opened on.
Authorizations
Section titled “Authorizations”Request Bodyrequired
Section titled “Request Bodyrequired”object
Examplegenerated
{ "orgId": "example"}Responses
Section titled “Responses”The session now works in this organisation.
object
Example
{ "role": "owner"}The request — its body or its query — did not match the schema. issues carries the Zod issue list.
The error envelope every non-2xx answer uses.
object
Human-readable explanation.
Machine-readable reason. Absent on a few legacy 400s.
Examplegenerated
{ "error": "example", "code": "example"}No bearer, or one that no longer resolves: a session that is unknown or expired (code: AUTH_REQUIRED), or an API token that was revoked or expired (TOKEN_REVOKED, TOKEN_EXPIRED), whose organisation is gone (ORG_NOT_FOUND) or whose member or user row is (MEMBERSHIP_GONE).
The error envelope every non-2xx answer uses.
object
Human-readable explanation.
Machine-readable reason. Absent on a few legacy 400s.
Examplegenerated
{ "error": "example", "code": "example"}Not a member of that organisation (code: NOT_A_MEMBER), the organisation has been closed (code: ORG_CLOSED), or the session is a staff member’s view of an organisation (code: STAFF_VIEW).
The error envelope every non-2xx answer uses.
object
Human-readable explanation.
Machine-readable reason. Absent on a few legacy 400s.
Examplegenerated
{ "error": "example", "code": "example"}The restore switch is on (code: MAINTENANCE): every route but /health and /robots.txt is refused before anything is read, except the operator’s own POST /staff/people/{id}/delete with the ADMIN_TOKEN. Sloose is down for maintenance. Please try again in a few minutes.
object
Example
{ "code": "MAINTENANCE"}Headers
Section titled “Headers”Seconds until asking again is worth it (300 while the switch is on).