Skip to main content

Quickstart

This guide uses curl against the production REST API.

Prerequisites​

Before making a protected request, obtain:

  • A Sevah user account associated with an organization.
  • A current Firebase ID token from your approved Sevah sign-in flow.
  • curl or another HTTPS client that can retain secure cookies.

If your integration cannot use an interactive user identity, contact your Sevah representative before implementation. Do not automate a user's password or reuse a session issued to another user.

1. Check API availability​

curl --fail-with-body --silent --show-error \
  https://app.sevah.ai/health

A successful request returns 200 OK with a JSON health response. This endpoint does not require authentication.

2. Create a user session​

Exchange the Firebase ID token for a Sevah session. Replace the placeholder with the token from your sign-in flow.

curl --fail-with-body --silent --show-error \
  --cookie-jar sevah-cookie.txt \
  --header 'Content-Type: application/json' \
  --data '{"id_token":"YOUR_FIREBASE_ID_TOKEN"}' \
  https://app.sevah.ai/api/auth/login

The response identifies the user. The session itself is returned as an HttpOnly cookie and stored by curl in sevah-cookie.txt.

Treat that cookie file as a credential: restrict access to it, never share it, and remove it when the session is no longer needed.

3. Verify the session context​

curl --fail-with-body --silent --show-error \
  --cookie sevah-cookie.txt \
  https://app.sevah.ai/api/auth/me

Confirm that user.org_id and user.role match the organization and permissions expected by your integration. Stop the workflow if they do not.

4. Call a protected endpoint​

List the devices visible to the authenticated organization:

curl --fail-with-body --silent --show-error \
  --cookie sevah-cookie.txt \
  --header 'Accept: application/json' \
  https://app.sevah.ai/api/v1/devices

The response contains an items array. Results are restricted to the organization in the authenticated session.

5. End the session​

curl --fail-with-body --silent --show-error \
  --request POST \
  --cookie sevah-cookie.txt \
  https://app.sevah.ai/api/auth/logout

After logout, delete the local cookie file using your operating system's secure file-management workflow.

Next steps​