Ban somebody

POST

/staff/people/{id}/ban

curl --request POST \
  --url https://api.sloose.com/staff/people/c1d2e3f4/ban \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '{ "reason": "example", "expiresAt": "example" }'

• Production

Backoffice route: a staff session, or ADMIN_TOKEN. A ban is on the person, not on a membership: every session they hold in every organisation answers 403 BANNED at once, and so does a new sign-in. Their existing sessions are ended too, so nothing keeps working until it expires. Staff cannot be banned — take the role away first, which is a deliberate second step. Written down as user.ban.

Authorizations

• sessionAuth
• adminToken

Parameters

Path Parameters

id

required

The person

string

Example

c1d2e3f4

The person

Request Body^required

Media typeapplication/json

object

reason

required

Why. Required, and shown to nobody but staff.

string

>= 1 characters <= 500 characters

expiresAt

When the ban lifts itself: an ISO date (midnight UTC) or an ISO timestamp with Z or an offset. Omitted means it does not.

string

Example^generated

{
  "reason": "example",
  "expiresAt": "example"
}

Responses

200

Banned, and signed out.

Media typeapplication/json

object

banned

required

boolean

sessionsRevoked

required

Browsers signed out, as sessions/revoke counts them: a CRM tab’s own session is its browser’s.

integer

Example

{
  "banned": true
}

400

The request — its body or its query — did not match the schema. issues carries the Zod issue list.

Media typeapplication/json

The error envelope every non-2xx answer uses.

object

error

required

Human-readable explanation.

string

code

Machine-readable reason. Absent on a few legacy 400s.

string

key

additional properties

Example^generated

{
  "error": "example",
  "code": "example"
}

401

A bearer that is neither the token nor a live session (code: AUTH_REQUIRED).

Media typeapplication/json

The error envelope every non-2xx answer uses.

object

error

required

Human-readable explanation.

string

code

Machine-readable reason. Absent on a few legacy 400s.

string

key

additional properties

Example^generated

{
  "error": "example",
  "code": "example"
}

403

A customer’s session, an API token, or no bearer at all — not staff, and not the ADMIN_TOKEN (code: ADMIN_REQUIRED).

Media typeapplication/json

The error envelope every non-2xx answer uses.

object

error

required

Human-readable explanation.

string

code

Machine-readable reason. Absent on a few legacy 400s.

string

key

additional properties

Example^generated

{
  "error": "example",
  "code": "example"
}

404

No such person, or it is not visible to this session.

Media typeapplication/json

The error envelope every non-2xx answer uses.

object

error

required

Human-readable explanation.

string

code

Machine-readable reason. Absent on a few legacy 400s.

string

key

additional properties

Example^generated

{
  "error": "example",
  "code": "example"
}

409

That person is staff (code: STAFF_CANNOT_BE_BANNED).

Media typeapplication/json

The error envelope every non-2xx answer uses.

object

error

required

Human-readable explanation.

string

code

Machine-readable reason. Absent on a few legacy 400s.

string

key

additional properties

Example^generated

{
  "error": "example",
  "code": "example"
}

503

The restore switch is on (code: MAINTENANCE): every route but /health and /robots.txt is refused before anything is read, except the operator’s own POST /staff/people/{id}/delete with the ADMIN_TOKEN. Sloose is down for maintenance. Please try again in a few minutes.

Media typeapplication/json

object

error

required

string

code

required

string

Allowed value: MAINTENANCE

Example

{
  "code": "MAINTENANCE"
}

Headers

Retry-After

integer

Seconds until asking again is worth it (300 while the switch is on).