Salfio
APIReference

List clients

Returns the authenticated organization's non-deleted clients, ordered by opaque internal ID for a stable cursor anchor. Use the `cursor` returned in `meta.cursor` (if `meta.hasMore` is true) to fetch the next page. **Spec-vs-implementation note (SAL-229).** The v1.0 spec document lists `email`, `phone`, `company`, and `notes` on the Client object. The current Salfio Client model does not carry those fields yet; they are tracked as a follow-up. Today's response includes `id`, `name`, `domain`, `createdAt`, `updatedAt`.

GET
/clients

Authorization

bearerAuth
AuthorizationBearer <token>

Salfio API tokens start with the literal prefix sk_live_ followed by 32 base62 characters (≈190 bits of entropy). Tokens are hashed at rest with argon2id and shown to the user only once at creation.

In: header

Query Parameters

limit?integer

Page size (default 20, max 100).

Default20
Range1 <= value <= 100
cursor?string

Opaque cursor from a previous response's meta.cursor.

Response Body

application/json

application/json

application/json

application/json

curl -X GET "https://api.salfio.com/v1/clients"
{
  "meta": {
    "cursor": "string",
    "hasMore": true
  },
  "data": [
    {
      "id": "8b2d1c4e-3f5a-4e2b-9c8f-1e2d3c4b5a6f",
      "name": "Acme Corp",
      "domain": "acme.com",
      "createdAt": "2019-08-24T14:15:22Z",
      "updatedAt": "2019-08-24T14:15:22Z"
    }
  ]
}
{
  "error": {
    "code": "invalid_argument",
    "message": "limit must be an integer between 1 and 100"
  }
}
{
  "error": {
    "code": "unauthorized",
    "message": "Authentication required"
  }
}
{
  "error": {
    "code": "rate_limited",
    "message": "Rate limit exceeded",
    "details": {
      "retry_after_seconds": 30
    }
  }
}

Authenticated health check

Returns `{"status":"ok"}` when the presented bearer token is valid. Used by callers to verify their token and the end-to-end routing from `api.salfio.com` to the Salfio API service.

Create a client

Creates a new client in the authenticated organization. The server auto-wires any matching integration assignment rules based on the supplied `domain` (same behaviour as the dashboard create flow). **`organizationId` must not be included in the body.** The organization is resolved from the bearer token; a body-borne `organizationId` is rejected with `400 invalid_argument` rather than silently overridden.