Refresh a session

POST

/auth/session/refresh

curl --request POST \
  --url https://api.sloose.com/auth/session/refresh \
  --header 'Authorization: Bearer <token>'

• Production

Confirms the session is still good and returns it with the member’s current role and expiry. A session is a row, not a claim: the role is re-read on every request and the expiry slides with use, so there is no new token to hand out — this answers what the bearer is now. A staff member’s read-only view of the organisation answers with impersonation set and an expiry that does not slide.

Session only. An API token is refused with 403 SESSION_REQUIRED.

Authorizations

• sessionAuth

Responses

200

The session as it stands.

Media typeapplication/json

object

token

required

The session token. Send it as Authorization: Bearer.

string

orgId

required

string

userId

required

string

role

required

string

Allowed values: owner admin builder operator

exp

required

Expiry, seconds since the epoch.

number

impersonation

Present when this session is a staff member’s view of the organisation as one of its members. Read-only unless write is true, in which case it acts as the member for real within this organisation (the person’s own writes outside it answer STAFF_VIEW either way). The widget shows it as a banner, coloured differently for the two.

object

by

required

The staff member looking, by name.

string

until

required

When the view ends, seconds since the epoch.

number

write

required

Whether this view may write. When true it acts as the member for real within this organisation — never on the person’s own writes outside it, which answer STAFF_VIEW — and the widget says so.

boolean

staffPage

This organisation’s Plan & credits page in the backoffice, on the app’s own origin — where the staff member’s own session is, and support’s tools for the organisation (credits, the trial). Absent when the server has no app origin configured. Plan and Usage & credits link to it, where a view is told it cannot use the member’s billing controls; a view opens on another origin, so it cannot build this address itself.

string

Example

{
  "role": "owner"
}

401

The session is unknown, expired or signed out (code: AUTH_REQUIRED).

Media typeapplication/json

The error envelope every non-2xx answer uses.

object

error

required

Human-readable explanation.

string

code

Machine-readable reason. Absent on a few legacy 400s.

string

key

additional properties

Example^generated

{
  "error": "example",
  "code": "example"
}

403

An API token was used (code: SESSION_REQUIRED), the organisation has been closed (code: ORG_CLOSED), the person is banned (code: BANNED), or the session is signed in but in no organisation — it never joined one, or its person was taken out of the one it was in, or left it (code: NO_ORG).

Media typeapplication/json

The error envelope every non-2xx answer uses.

object

error

required

Human-readable explanation.

string

code

Machine-readable reason. Absent on a few legacy 400s.

string

key

additional properties

Example^generated

{
  "error": "example",
  "code": "example"
}

503

The restore switch is on (code: MAINTENANCE): every route but /health and /robots.txt is refused before anything is read, except the operator’s own POST /staff/people/{id}/delete with the ADMIN_TOKEN. Sloose is down for maintenance. Please try again in a few minutes.

Media typeapplication/json

object

error

required

string

code

required

string

Allowed value: MAINTENANCE

Example

{
  "code": "MAINTENANCE"
}

Headers

Retry-After

integer

Seconds until asking again is worth it (300 while the switch is on).