Refresh a session

POST

/auth/session/refresh

curl --request POST \
  --url https://api.sloose.com/auth/session/refresh \
  --header 'Authorization: Bearer <token>'

• Production
• Staging

Confirms the session is still good and returns it with the member’s current role and expiry. A session is a row, not a claim: the role is re-read on every request and the expiry slides with use, so there is no new token to hand out — this answers what the bearer is now. A staff member’s read-only view of the org answers with impersonation set and an expiry that does not slide.

Session only. An API token is refused with 403 SESSION_REQUIRED.

Authorizations

• sessionAuth

Responses

200

The session as it stands.

Media typeapplication/json

object

token

required

The session token. Send it as Authorization: Bearer.

string

orgId

required

string

userId

required

string

role

required

string

Allowed values: owner admin builder operator

dc

required

The org’s Zoho data centre.

string

exp

required

Expiry, seconds since the epoch.

number

impersonation

Present when this session is a staff member’s view of the org as one of its members. Read-only unless write is true, in which case it acts as the member for real. The widget shows it as a banner, coloured differently for the two.

object

by

required

The staff member looking, by name.

string

until

required

When the view ends, seconds since the epoch.

number

write

required

Whether this view may write. When true it acts as the member for real, and the widget says so.

boolean

Example

{
  "role": "owner"
}

401

The session is unknown, expired, signed out, or you are no longer a member of its org (code: AUTH_REQUIRED).

Media typeapplication/json

The error envelope every non-2xx answer uses.

object

error

required

Human-readable explanation.

string

code

Machine-readable reason. Absent on a few legacy 400s.

string

key

additional properties

Example^generated

{
  "error": "example",
  "code": "example"
}

403

An API token was used (code: SESSION_REQUIRED), or an administrator has revoked your access to the org (code: ACCESS_REVOKED).

Media typeapplication/json

The error envelope every non-2xx answer uses.

object

error

required

Human-readable explanation.

string

code

Machine-readable reason. Absent on a few legacy 400s.

string

key

additional properties

Example^generated

{
  "error": "example",
  "code": "example"
}