Overview

The SmileLine API is a JSON HTTP API. Every endpoint in the sidebar is generated from the same contract definitions that validate requests in production, so the reference is always in sync with the running API.

Base URLs

All requests and responses use application/json unless an endpoint says otherwise (file uploads use multipart/form-data, CSV export returns text/csv).

Organization scoping

SmileLine is multi-tenant. Every CRM resource belongs to an organization, and every request runs against the active organization of the authenticated session or API key. You never pass an organization ID in the URL — the server resolves it from your credentials.

Check what the API sees for you:

curl https://api.smileline.io/auth/me \
  -H "Authorization: Bearer $SMILELINE_API_KEY"

The response includes your user, the active organization, and your member role. See Authentication for how roles gate write operations.

Conventions

• IDs are UUIDs.
• Timestamps are ISO 8601 strings in UTC.
• Errors share one envelope everywhere — see Errors.
• Lists are paginated — see Pagination.
• Mutations that "delete" usually archive: the row is kept with an archivedAt timestamp and disappears from default lists. Most resources expose a matching restore endpoint.

Trying requests

Every endpoint page has a playground. Paste an API key into the Authorization field and requests run against the server you pick — staging is a safe place to experiment.