Used by the Sahl console. Not available with partner API keys. Contact Sahl if you need programmatic access.
What this is
The Sahl console at https://app.sahlfinancial.com is a web app. Every screen calls the Sahl API with the session of the person who signed in. This section documents the routes behind the screens a developer or a workspace admin most often asks about: bank connections, cases, documents, webhooks, API keys, scoring policies and flows.
It is a reference of what the console does today, read from the API code on 2026-10-07. It is not an integration surface: Sahl does not promise these routes stay as they are.
Who it is for
- A developer who wants to know exactly what a console screen sends and gets back.
- A workspace admin or auditor who wants to know what each role can do.
- Not for a partner integration. For that, use the Partner API.
How it differs from the Partner API
How the session works
- The token is a JWT in the
Authorization: Bearer header. There is no cookie.
- The console gets it by signing in (
POST /v1/auth/login, with the authenticator code when MFA is on). It lasts 30 minutes. A refresh token, valid 7 days, renews it (POST /v1/auth/refresh). Those sign-in routes are not in this reference.
- Sahl reads the user’s role and status from its record on every call, not from the token. A demoted or deactivated user is refused within about 15 seconds.
- Every call is limited to the workspace of the user. Another workspace’s id is a 404.
- Roles:
tenant_viewer can read; tenant_reviewer and tenant_api_manager can also create and upload; tenant_admin can do everything in the workspace. Each page lists who can call the route.
- Choose the environment with
X-Sahl-Environment: sandbox or production.
- 100 requests per minute and IP, then 429.
What is in this reference
What is left out, and why
Platform administration, billing and the Stripe and Meta signature routes, the hosted widget and scan-link routes (they carry their own token), the partner onboarding routes of one named programme, the sign-in and MFA routes, and the review queue, audit, analytics and export routes. They are internal, or only Sahl staff use them, or no developer needs them. See also Console features and Coverage.
Production behaviour to know
Bank connections: no open-banking provider is live. POST /v1/bank-connections, POST /v1/bank-connections/{connection_id}/refresh, GET .../transactions and GET .../analysis answer 409 with bank_connect_unavailable unless you send X-Sahl-Environment: sandbox. See Bank connections.
Where to start
Open a group in the sidebar. Every page shows the role, the request and response model, an example with fake data and the error codes.
