Customer portal API

REST endpoints for customer portal in ServFlo: 6 operations with parameters, request and response fields, permissions and curl examples.

Base URL: https://app.servflo.ai/api. Every call needs Authorization: Bearer sfk_… (Authentication); {organizationId} ($ORGANIZATION_ID in the examples) is your business's id.

Operation	Endpoint	Risk
Get the customer's live portal link	`GET /organizations/{organizationId}/customers/{customerId}/portal`	`read`
Create or regenerate the customer's portal link	`POST /organizations/{organizationId}/customers/{customerId}/portal`	`sensitive`
Revoke the customer's portal link	`DELETE /organizations/{organizationId}/customers/{customerId}/portal`	`sensitive`
A customer's signed-in portal devices	`GET /organizations/{organizationId}/customers/{customerId}/portal-sessions`	`read`
Sign a customer out of one device	`DELETE /organizations/{organizationId}/customers/{customerId}/portal-sessions/{sessionId}`	`sensitive`
Sign a customer out everywhere	`POST /organizations/{organizationId}/customers/{customerId}/portal-sessions/revoke-all`	`sensitive`

Get the customer's live portal link

GET /organizations/{organizationId}/customers/{customerId}/portal

The customer's working portal link (/portal/{token}), or null when there is none (never made, revoked or expired), with when it was last opened. Read-only, but the token is a credential: do not share it unless asked.


Permission	`portal.manage` (Owner, Admin, Dispatcher)
Risk	`read`, OAuth scope `servflo.read`. Read: reads only.
MCP tool	`portalLinks_get` (toolset `customers`)

Parameters

Name	In	Type	Required	Description
`customerId`	path	string	Yes

Example

curl "https://app.servflo.ai/api/organizations/$ORGANIZATION_ID/customers/{customerId}/portal" \
  -H "Authorization: Bearer $SERVFLO_API_KEY"

Response

200: the answer's fields

Field	Type	Description
`id`	string
`token`	string	Open the portal at /portal/{token} on the web app.
`createdAt`	string (date-time)
`expiresAt`	string (date-time) or null
`lastViewedAt`	string (date-time) or null
`viewCount`	integer

Create or regenerate the customer's portal link

POST /organizations/{organizationId}/customers/{customerId}/portal

EXPOSES TO THE CUSTOMER / REVOKES: issues a new passwordless portal link for the customer. Any earlier link is revoked in the same step (it stops working), so share the new one. The portal shows only this customer's balance, visits, quotes, invoices, service history and properties. Nothing is emailed.


Permission	`portal.manage` (Owner, Admin, Dispatcher)
Risk	`sensitive`, OAuth scope `servflo.sensitive`. Sensitive: moves money, deletes, sends or shows something to a customer, or grants or revokes access.
MCP tool	`portalLinks_create` (toolset `customers`)
Approval	Over MCP, this tool asks for your OK first (in the AI app when it supports it, otherwise in ServFlo). See Approvals.

Parameters

Name	In	Type	Required	Description
`customerId`	path	string	Yes

Request body

Field	Type	Required	Description
`expiresInDays`	integer or null	No	Days until the link expires; default 365. null means no expiry. 1–3650.

Example

curl -X POST "https://app.servflo.ai/api/organizations/$ORGANIZATION_ID/customers/{customerId}/portal" \
  -H "Authorization: Bearer $SERVFLO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"expiresInDays":1}'

Response

201: the answer's fields

Field	Type	Description
`id`	string
`token`	string	Open the portal at /portal/{token} on the web app.
`createdAt`	string (date-time)
`expiresAt`	string (date-time) or null
`lastViewedAt`	string (date-time) or null
`viewCount`	integer

Revoke the customer's portal link

DELETE /organizations/{organizationId}/customers/{customerId}/portal

Destructive: the customer's portal link stops working at once (404 for anyone who opens it). Create a new one to restore access. Returns how many links were revoked.


Permission	`portal.manage` (Owner, Admin, Dispatcher)
Risk	`sensitive`, OAuth scope `servflo.sensitive`. Sensitive: moves money, deletes, sends or shows something to a customer, or grants or revokes access.
MCP tool	`portalLinks_revoke` (toolset `customers`)
Approval	Over MCP, this tool always waits for your approval in ServFlo. See Approvals.

Parameters

Name	In	Type	Required	Description
`customerId`	path	string	Yes

Example

curl -X DELETE "https://app.servflo.ai/api/organizations/$ORGANIZATION_ID/customers/{customerId}/portal" \
  -H "Authorization: Bearer $SERVFLO_API_KEY"

Response

200: the answer's fields

Field	Type	Description
`revoked`	integer

A customer's signed-in portal devices

GET /organizations/{organizationId}/customers/{customerId}/portal-sessions

The devices where this customer is signed in to their portal (/c/{slug}), newest use first: how they signed in, browser and device, address, when, last use and expiry. Live sessions only. Read-only.


Permission	`portal.manage` (Owner, Admin, Dispatcher)
Risk	`read`, OAuth scope `servflo.read`. Read: reads only.
MCP tool	`customerSessions_list` (toolset `customers`)

Parameters

Name	In	Type	Required	Description
`customerId`	path	string	Yes

Example

curl "https://app.servflo.ai/api/organizations/$ORGANIZATION_ID/customers/{customerId}/portal-sessions" \
  -H "Authorization: Bearer $SERVFLO_API_KEY"

Response

200: the answer's fields

An array of objects:

Field	Type	Description
`id`	string
`method`	enum	How the customer signed in: a code by email or text, or the email's one-tap link. One of `EMAIL_CODE`, `SMS_CODE`, `EMAIL_LINK`.
`device`	string or null	Browser and device, e.g. Safari on iPhone.
`ipAddress`	string or null
`createdAt`	string (date-time)	When they signed in.
`lastSeenAt`	string (date-time)
`expiresAt`	string (date-time)	30 days after last use (sliding).

Sign a customer out of one device

DELETE /organizations/{organizationId}/customers/{customerId}/portal-sessions/{sessionId}

Revokes access: ends one of the customer's portal sessions at once (the device must sign in again with a code). Another customer's session is 404. List them with GET …/portal-sessions first.


Permission	`portal.manage` (Owner, Admin, Dispatcher)
Risk	`sensitive`, OAuth scope `servflo.sensitive`. Sensitive: moves money, deletes, sends or shows something to a customer, or grants or revokes access.
MCP tool	`customerSessions_revoke` (toolset `customers`)
Approval	Over MCP, this tool always waits for your approval in ServFlo. See Approvals.

Parameters

Name	In	Type	Required	Description
`customerId`	path	string	Yes
`sessionId`	path	string	Yes

Example

curl -X DELETE "https://app.servflo.ai/api/organizations/$ORGANIZATION_ID/customers/{customerId}/portal-sessions/{sessionId}" \
  -H "Authorization: Bearer $SERVFLO_API_KEY"

Response

200: the answer's fields

Field	Type	Description
`revoked`	integer

Sign a customer out everywhere

POST /organizations/{organizationId}/customers/{customerId}/portal-sessions/revoke-all

Revokes access: ends every portal session of the customer at once. They can sign in again with a code sent to their email or phone on file. Returns how many sessions ended.


Permission	`portal.manage` (Owner, Admin, Dispatcher)
Risk	`sensitive`, OAuth scope `servflo.sensitive`. Sensitive: moves money, deletes, sends or shows something to a customer, or grants or revokes access.
MCP tool	`customerSessions_revokeAll` (toolset `customers`)
Approval	Over MCP, this tool always waits for your approval in ServFlo. See Approvals.

Parameters

Name	In	Type	Required	Description
`customerId`	path	string	Yes

Example

curl -X POST "https://app.servflo.ai/api/organizations/$ORGANIZATION_ID/customers/{customerId}/portal-sessions/revoke-all" \
  -H "Authorization: Bearer $SERVFLO_API_KEY"

Response

200: the answer's fields

Field	Type	Description
`revoked`	integer

On this page