> ## Documentation Index
> Fetch the complete documentation index at: https://docs.sahlfinancial.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Console API

> The routes the Sahl console calls with a signed-in user. Documented for reference. Not the Partner API, and not available with an API key.

<Warning>
  **Used by the Sahl console. Not available with partner API keys. Contact Sahl if you need programmatic access.**
</Warning>

## What this is

The Sahl console at `https://app.sahlfinancial.com` is a web app. Every screen calls the Sahl API with the session of the person who signed in. This section documents the routes behind the screens a developer or a workspace admin most often asks about: bank connections, cases, documents, webhooks, API keys, scoring policies and flows.

It is a reference of what the console does today, read from the API code on 2026-10-07. It is **not** an integration surface: Sahl does not promise these routes stay as they are.

## Who it is for

* A developer who wants to know exactly what a console screen sends and gets back.
* A workspace admin or auditor who wants to know what each role can do.
* Not for a partner integration. For that, use the [Partner API](/api-reference/introduction).

## How it differs from the Partner API

| | Partner API | Console API |
| - | - | - |
| Who calls it | Your server | The console, for a signed-in user |
| Credential | API key with a scope (`Authorization: Bearer sk_...`) | Access token (JWT) of a console user (`Authorization: Bearer <JWT>`) |
| Accepts a partner API key | Yes | No: 401 |
| Access | Documented, supported, versioned | Reference only. Contact Sahl for programmatic access |
| Try it in this site | Yes, with your sandbox key | No: it needs a login session |
| Routes | 6 under `/v1/kyc` | 55 in this reference |
| Permissions | Scope of the key | Role of the user in the workspace |

## How the session works

* The token is a JWT in the `Authorization: Bearer` header. There is no cookie.
* The console gets it by signing in (`POST /v1/auth/login`, with the authenticator code when MFA is on). It lasts 30 minutes. A refresh token, valid 7 days, renews it (`POST /v1/auth/refresh`). Those sign-in routes are not in this reference.
* Sahl reads the user's role and status from its record on every call, not from the token. A demoted or deactivated user is refused within about 15 seconds.
* Every call is limited to the workspace of the user. Another workspace's id is a 404.
* Roles: `tenant_viewer` can read; `tenant_reviewer` and `tenant_api_manager` can also create and upload; `tenant_admin` can do everything in the workspace. Each page lists who can call the route.
* Choose the environment with `X-Sahl-Environment: sandbox` or `production`.
* 100 requests per minute and IP, then 429.

## What is in this reference

| Group | Routes | Notes |
| - | - | - |
| Bank connections | 7 | Simulated in the Sandbox. Everywhere else, `409 bank_connect_unavailable` |
| Cases | 9 | Create, read, decide, score, add documents, merged fields |
| Documents | 9 | Upload, list, status, result, download, reprocess, jobs |
| Webhooks | 9 | Manage endpoints and read deliveries |
| API keys | 7 | Create, rotate, revoke the keys of the Partner API |
| Scoring policies | 5 | Weights and thresholds, one active policy per path |
| Flows | 9 | Verification flows, validation, simulation |

## What is left out, and why

Platform administration, billing and the Stripe and Meta signature routes, the hosted widget and scan-link routes (they carry their own token), the partner onboarding routes of one named programme, the sign-in and MFA routes, and the review queue, audit, analytics and export routes. They are internal, or only Sahl staff use them, or no developer needs them. See also [Console features](/console-features) and [Coverage](/coverage).

## Production behaviour to know

Bank connections: no open-banking provider is live. `POST /v1/bank-connections`, `POST /v1/bank-connections/{connection_id}/refresh`, `GET .../transactions` and `GET .../analysis` answer `409` with `bank_connect_unavailable` unless you send `X-Sahl-Environment: sandbox`. See [Bank connections](/guides/bank-connections).

## Where to start

Open a group in the sidebar. Every page shows the role, the request and response model, an example with fake data and the error codes.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.