What staff did

GET

/staff/actions

curl --request GET \
  --url 'https://api.sloose.com/staff/actions?limit=100' \
  --header 'Authorization: Bearer <token>'

• Production

Backoffice route: a staff session, or ADMIN_TOKEN. Staff actions, newest first, a page at a time (limit and cursor, answering nextCursor): who, what, to which organisation or person, and why when a reason was given.

Authorizations

• sessionAuth
• adminToken

Parameters

Query Parameters

orgId

Only actions on this organisation.

string

Only actions on this organisation.

without

Actions to leave out, comma-separated (org.view, which every page visit writes, buries what was changed). Absent: every action.

string

Actions to leave out, comma-separated (org.view, which every page visit writes, buries what was changed). Absent: every action.

limit

How many to return, at most 500; 100 when absent. Anything but a whole number above zero — 0, negative, a fraction, not a number — is the default, never an error.

string

Example

100

How many to return, at most 500; 100 when absent. Anything but a whole number above zero — 0, negative, a fraction, not a number — is the default, never an error.

cursor

The nextCursor of the page before this one; absent for the first page. Opaque: it names a place in the list’s (createdAt, id) order, and a malformed one is 400 INVALID_CURSOR.

string

The nextCursor of the page before this one; absent for the first page. Opaque: it names a place in the list’s (createdAt, id) order, and a malformed one is 400 INVALID_CURSOR.

Responses

200

A page of actions, newest first.

Media typeapplication/json

object

actions

required

Array<object>

object

id

required

string

action

required

string

orgId

required

string | null

orgName

required

string | null

staffUserId

required

The staff member who acted. Null means one of three things, which detail tells apart: the shared admin token acted (nothing in detail says otherwise); somebody who is not staff did, named by detail.by — owner, admin, self, or one of Sloose’s own jobs (cron, purge); or a staff member did who has since been erased, and detail.formerStaff is true.

string | null

staffEmail

required

That staff member’s address. For one whose account was deleted but whose row another organisation’s records still need, the reference stays and this is a placeholder; detail.formerStaff is true for those rows too, so read the mark before the address.

string | null

targetUserId

required

string | null

targetEmail

required

string | null

reason

required

string | null

detail

required

What the action was about, by action. Two keys say who acted where staffUserId alone does not: by (owner, admin, self, cron, purge) and formerStaff (true for an act of a staff member since erased).

object | null

createdAt

required

string

nextCursor

required

Pass as cursor for the next page; null when this was the last.

string | null

Example^generated

{
  "actions": [
    {
      "id": "example",
      "action": "example",
      "orgId": "example",
      "orgName": "example",
      "staffUserId": "example",
      "staffEmail": "example",
      "targetUserId": "example",
      "targetEmail": "example",
      "reason": "example",
      "detail": "example",
      "createdAt": "example"
    }
  ],
  "nextCursor": "example"
}

400

cursor is malformed (code: INVALID_CURSOR).

Media typeapplication/json

The error envelope every non-2xx answer uses.

object

error

required

Human-readable explanation.

string

code

Machine-readable reason. Absent on a few legacy 400s.

string

key

additional properties

Example^generated

{
  "error": "example",
  "code": "example"
}

401

A bearer that is neither the token nor a live session (code: AUTH_REQUIRED).

Media typeapplication/json

The error envelope every non-2xx answer uses.

object

error

required

Human-readable explanation.

string

code

Machine-readable reason. Absent on a few legacy 400s.

string

key

additional properties

Example^generated

{
  "error": "example",
  "code": "example"
}

403

A customer’s session, an API token, or no bearer at all — not staff, and not the ADMIN_TOKEN (code: ADMIN_REQUIRED).

Media typeapplication/json

The error envelope every non-2xx answer uses.

object

error

required

Human-readable explanation.

string

code

Machine-readable reason. Absent on a few legacy 400s.

string

key

additional properties

Example^generated

{
  "error": "example",
  "code": "example"
}

503

The restore switch is on (code: MAINTENANCE): every route but /health and /robots.txt is refused before anything is read, except the operator’s own POST /staff/people/{id}/delete with the ADMIN_TOKEN. Sloose is down for maintenance. Please try again in a few minutes.

Media typeapplication/json

object

error

required

string

code

required

string

Allowed value: MAINTENANCE

Example

{
  "code": "MAINTENANCE"
}

Headers

Retry-After

integer

Seconds until asking again is worth it (300 while the switch is on).