Authentication
Base URLs: production https://api.sloose.com, staging https://api-staging.sloose.com.
Send your bearer on every request:
Authorization: Bearer <token>Two kinds of bearer are accepted, and every org route takes either.
Session tokens
Section titled “Session tokens”Issued by Login with Zoho, bound to one org and one user, and valid for eight hours.
This is what the widget uses. A session carries the member’s current role, so refreshing it —
POST /auth/session/refresh — is how a role change in the CRM takes effect without signing in
again.
Org API tokens
Section titled “Org API tokens”A long-lived token (slo_…) minted by an administrator at POST /orgs/{org}/tokens, for the SDK
CLI, CI, and anything else that is not a person sitting at a browser.
- Scoped to one org, with the admin role.
- Acts as the member who created it.
- Never expires unless you give it an expiry.
- Revocable, and revocation takes effect on its next request.
- The secret is shown once, at creation. The server keeps only a hash, so a lost token is replaced rather than recovered.
A revoked or expired token answers 401 with code set to TOKEN_REVOKED or TOKEN_EXPIRED, so
a client can tell “your token was turned off” from “your token is wrong”.
GET /auth/me reports which kind you used, in via.
Routes an API token cannot reach
Section titled “Routes an API token cannot reach”Three routes are session only and refuse a token with 403 SESSION_REQUIRED:
| Route | Why |
|---|---|
POST /auth/session/refresh |
A token that could refresh itself would never expire. |
POST /orgs/{org}/tokens |
A leaked token must not be able to mint more. |
DELETE /orgs/{org}/tokens/{id} |
Nor revoke the ones that would catch it. |
Org scoping
Section titled “Org scoping”Every /orgs/{org}/… route checks that {org} is the org the bearer was issued for. A token for
one org can never read another, whatever its role — this is checked on the server, not chosen by
the client.
Ranked, so a route needing builder also accepts admin and owner:
| Role | Can |
|---|---|
operator |
Run imports, read configuration. |
builder |
Everything above, plus create and edit projects and schedules. |
admin |
Everything above, plus curate modules, annotate fields, manage libraries and tokens, connect the org, and manage billing. |
owner |
Everything above, plus start the trial. The first person to sign in to an org. |
Where an org follows Zoho roles, a member with the CRM’s Administrator profile becomes an admin
at sign-in; everybody else becomes an operator. The first member is always the owner.
Backoffice
Section titled “Backoffice”Operator routes under /billing/admin, /entitlements/admin and /ai/admin take the
ADMIN_TOKEN instead of a session. They are not part of the customer-facing contract and are
documented in the API reference under Backoffice.
The rest
Section titled “The rest”Every route, its parameters and its responses are in the API reference, which is generated from the API’s own route definitions.