Login devices

Device binding and login approvals: sign-in rules (approvals for new devices, device limits), members’ devices and the approvals inbox for managers and admins.

GET/v1/login-approvals

Sign-ins waiting for my approval

Admins see every request, managers those of their reporting tree that are not admin-only.

Access: Signed-in members only (web or Android session) — not for API keys.

Parameters

statusquery: "pending" | "decided"

Response · 200

datarequired: array of LoginApproval
metarequired: object

Request

curl -X GET 'https://api.propzolo.com/v1/login-approvals' \
  -H 'Authorization: Bearer pz_live_…'

Response example

{
  "data": [
    {
      "id": "cmusrceel0000q7kaafxqi1om",
      "member": {
        "id": "cmusrceel0000q7kaafxqi1om",
        "name": "string"
      },
      "device": {
        "id": "cmusrceel0000q7kaafxqi1om",
        "kind": "web",
        "label": "string"
      },
      "reason": "new_device",
      "admins_only": true,
      "status": "pending",
      "requested_at": "2026-10-06T05:30:00.000Z",
      "expires_at": "2026-10-06T05:30:00.000Z",
      "ip_address": "string",
      "decided_at": "2026-10-06T05:30:00.000Z",
      "decided_by": "string",
      "decided_via": "string",
      "code": "string",
      "can_decide": true,
      "approved_devices": [
        {
          "id": "cmusrceel0000q7kaafxqi1om",
          "label": "string",
          "last_seen_at": "2026-10-06T05:30:00.000Z"
        }
      ]
    }
  ],
  "meta": {}
}

Errors

401 No valid session or API key (missing, expired or revoked).
403 The caller lacks the permission, API-key scope or support grant this operation needs.
422 Invalid input; `error.fields` maps field paths to messages.
429 Too many requests; retry after the Retry-After header.
500 Unexpected error; quote `error.request_id` to support.

GET/v1/login-approvals/{id}

A sign-in request

Access: Signed-in members only (web or Android session) — not for API keys.

Parameters

idpathrequired: Id
Opaque record id.

Response · 200

datarequired: LoginApproval
metarequired: object

Request

curl -X GET 'https://api.propzolo.com/v1/login-approvals/{id}' \
  -H 'Authorization: Bearer pz_live_…'

Response example

{
  "data": {
    "id": "cmusrceel0000q7kaafxqi1om",
    "member": {
      "id": "cmusrceel0000q7kaafxqi1om",
      "name": "string"
    },
    "device": {
      "id": "cmusrceel0000q7kaafxqi1om",
      "kind": "web",
      "label": "string"
    },
    "reason": "new_device",
    "admins_only": true,
    "status": "pending",
    "requested_at": "2026-10-06T05:30:00.000Z",
    "expires_at": "2026-10-06T05:30:00.000Z",
    "ip_address": "string",
    "decided_at": "2026-10-06T05:30:00.000Z",
    "decided_by": "string",
    "decided_via": "string",
    "code": "string",
    "can_decide": true,
    "approved_devices": [
      {
        "id": "cmusrceel0000q7kaafxqi1om",
        "label": "string",
        "last_seen_at": "2026-10-06T05:30:00.000Z"
      }
    ]
  },
  "meta": {}
}

Errors

401 No valid session or API key (missing, expired or revoked).
403 The caller lacks the permission, API-key scope or support grant this operation needs.
404 Not found — records of another company are reported the same way.
422 Invalid input; `error.fields` maps field paths to messages.
429 Too many requests; retry after the Retry-After header.
500 Unexpected error; quote `error.request_id` to support.

POST/v1/login-approvals/{id}/decision

Approve or reject a sign-in

Approving a device over the member’s limit can remove one of their devices (`replace_device_id`, admins only). Nobody decides their own request. Audited.

Access: Signed-in members only (web or Android session) — not for API keys.

Parameters

idpathrequired: Id
Opaque record id.

Request body

decisionrequired: "approve" | "reject"
replace_device_id: Id or null
Opaque record id.

Response · 200

datarequired: LoginApproval
metarequired: object

Request

curl -X POST 'https://api.propzolo.com/v1/login-approvals/{id}/decision' \
  -H 'Authorization: Bearer pz_live_…' \
  -H 'Content-Type: application/json' \
  -d '{"decision":"approve","replace_device_id":"cmusrceel0000q7kaafxqi1om"}'

Response example

{
  "data": {
    "id": "cmusrceel0000q7kaafxqi1om",
    "member": {
      "id": "cmusrceel0000q7kaafxqi1om",
      "name": "string"
    },
    "device": {
      "id": "cmusrceel0000q7kaafxqi1om",
      "kind": "web",
      "label": "string"
    },
    "reason": "new_device",
    "admins_only": true,
    "status": "pending",
    "requested_at": "2026-10-06T05:30:00.000Z",
    "expires_at": "2026-10-06T05:30:00.000Z",
    "ip_address": "string",
    "decided_at": "2026-10-06T05:30:00.000Z",
    "decided_by": "string",
    "decided_via": "string",
    "code": "string",
    "can_decide": true,
    "approved_devices": [
      {
        "id": "cmusrceel0000q7kaafxqi1om",
        "label": "string",
        "last_seen_at": "2026-10-06T05:30:00.000Z"
      }
    ]
  },
  "meta": {}
}

Errors

401 No valid session or API key (missing, expired or revoked).
403 The caller lacks the permission, API-key scope or support grant this operation needs.
404 Not found — records of another company are reported the same way.
409 A unique value already exists, a concurrent change won, or the Idempotency-Key is still in use or was sent with a different request.
422 Invalid input; `error.fields` maps field paths to messages.
429 Too many requests; retry after the Retry-After header.
500 Unexpected error; quote `error.request_id` to support.

GET/v1/me/devices

My devices in this workspace

Access: Signed-in members only (web or Android session) — not for API keys.

Response · 200

datarequired: array of MemberDevice
metarequired: object

Request

curl -X GET 'https://api.propzolo.com/v1/me/devices' \
  -H 'Authorization: Bearer pz_live_…'

Response example

{
  "data": [
    {
      "id": "cmusrceel0000q7kaafxqi1om",
      "member": {
        "id": "cmusrceel0000q7kaafxqi1om",
        "name": "string"
      },
      "kind": "web",
      "label": "string",
      "status": "approved",
      "approved_via": "string",
      "approved_at": "2026-10-06T05:30:00.000Z",
      "approved_by": "string",
      "revoked_at": "2026-10-06T05:30:00.000Z",
      "first_seen_at": "2026-10-06T05:30:00.000Z",
      "last_seen_at": "2026-10-06T05:30:00.000Z",
      "last_ip": "string",
      "current": true
    }
  ],
  "meta": {}
}

Errors

401 No valid session or API key (missing, expired or revoked).
403 The caller lacks the permission, API-key scope or support grant this operation needs.
429 Too many requests; retry after the Retry-After header.
500 Unexpected error; quote `error.request_id` to support.

DELETE/v1/me/devices/{id}

Remove one of my devices

A lost phone or an old browser: signed out at once; signing in on it again needs an admin’s approval.

Access: Signed-in members only (web or Android session) — not for API keys.

Parameters

idpathrequired: Id
Opaque record id.

Response · 200

datarequired: MemberDevice
metarequired: object

Request

curl -X DELETE 'https://api.propzolo.com/v1/me/devices/{id}' \
  -H 'Authorization: Bearer pz_live_…'

Response example

{
  "data": {
    "id": "cmusrceel0000q7kaafxqi1om",
    "member": {
      "id": "cmusrceel0000q7kaafxqi1om",
      "name": "string"
    },
    "kind": "web",
    "label": "string",
    "status": "approved",
    "approved_via": "string",
    "approved_at": "2026-10-06T05:30:00.000Z",
    "approved_by": "string",
    "revoked_at": "2026-10-06T05:30:00.000Z",
    "first_seen_at": "2026-10-06T05:30:00.000Z",
    "last_seen_at": "2026-10-06T05:30:00.000Z",
    "last_ip": "string",
    "current": true
  },
  "meta": {}
}

Errors

401 No valid session or API key (missing, expired or revoked).
403 The caller lacks the permission, API-key scope or support grant this operation needs.
404 Not found — records of another company are reported the same way.
422 Invalid input; `error.fields` maps field paths to messages.
429 Too many requests; retry after the Retry-After header.
500 Unexpected error; quote `error.request_id` to support.

GET/v1/member-devices

Members’ devices

Access: Signed-in members only (web or Android session) — not for API keys. Permission settings.users.

Parameters

member_idquery: Id
Opaque record id.
statusquery: "approved" | "pending" | "rejected" | "revoked"

Response · 200

datarequired: array of MemberDevice
metarequired: object

Request

curl -X GET 'https://api.propzolo.com/v1/member-devices' \
  -H 'Authorization: Bearer pz_live_…'

Response example

{
  "data": [
    {
      "id": "cmusrceel0000q7kaafxqi1om",
      "member": {
        "id": "cmusrceel0000q7kaafxqi1om",
        "name": "string"
      },
      "kind": "web",
      "label": "string",
      "status": "approved",
      "approved_via": "string",
      "approved_at": "2026-10-06T05:30:00.000Z",
      "approved_by": "string",
      "revoked_at": "2026-10-06T05:30:00.000Z",
      "first_seen_at": "2026-10-06T05:30:00.000Z",
      "last_seen_at": "2026-10-06T05:30:00.000Z",
      "last_ip": "string",
      "current": true
    }
  ],
  "meta": {}
}

Errors

401 No valid session or API key (missing, expired or revoked).
403 The caller lacks the permission, API-key scope or support grant this operation needs.
422 Invalid input; `error.fields` maps field paths to messages.
429 Too many requests; retry after the Retry-After header.
500 Unexpected error; quote `error.request_id` to support.

DELETE/v1/member-devices/{id}

Remove a member’s device

Signs it out at once; a phone also stops call tracking. It needs an admin’s approval to sign in again.

Access: Signed-in members only (web or Android session) — not for API keys. Permission settings.users.

Parameters

idpathrequired: Id
Opaque record id.

Response · 200

datarequired: MemberDevice
metarequired: object

Request

curl -X DELETE 'https://api.propzolo.com/v1/member-devices/{id}' \
  -H 'Authorization: Bearer pz_live_…'

Response example

{
  "data": {
    "id": "cmusrceel0000q7kaafxqi1om",
    "member": {
      "id": "cmusrceel0000q7kaafxqi1om",
      "name": "string"
    },
    "kind": "web",
    "label": "string",
    "status": "approved",
    "approved_via": "string",
    "approved_at": "2026-10-06T05:30:00.000Z",
    "approved_by": "string",
    "revoked_at": "2026-10-06T05:30:00.000Z",
    "first_seen_at": "2026-10-06T05:30:00.000Z",
    "last_seen_at": "2026-10-06T05:30:00.000Z",
    "last_ip": "string",
    "current": true
  },
  "meta": {}
}

Errors

401 No valid session or API key (missing, expired or revoked).
403 The caller lacks the permission, API-key scope or support grant this operation needs.
404 Not found — records of another company are reported the same way.
422 Invalid input; `error.fields` maps field paths to messages.
429 Too many requests; retry after the Retry-After header.
500 Unexpected error; quote `error.request_id` to support.

GET/v1/security/login-policy

Sign-in rules: login approvals and device limits

Access: Signed-in members only (web or Android session) — not for API keys. Permission settings.security or settings.view.

Response · 200

datarequired: LoginPolicyView
metarequired: object

Request

curl -X GET 'https://api.propzolo.com/v1/security/login-policy' \
  -H 'Authorization: Bearer pz_live_…'

Response example

{
  "data": {
    "approval_required": true,
    "max_web_devices": 0,
    "max_mobile_devices": 0,
    "approval_minutes": 5,
    "secure_screens": true,
    "pending_approvals": 0
  },
  "meta": {}
}

Errors

401 No valid session or API key (missing, expired or revoked).
403 The caller lacks the permission, API-key scope or support grant this operation needs.
429 Too many requests; retry after the Retry-After header.
500 Unexpected error; quote `error.request_id` to support.

PUT/v1/security/login-policy

Change the sign-in rules

Only the fields sent change. Owner/Admin sessions confirm with step-up. Audited.

Access: Signed-in members only (web or Android session) — not for API keys. Permission settings.security.

Request body

approval_required: boolean
Sign-ins from devices not yet approved wait for approval.
max_web_devices: integer or null
Approved browsers per member; null: no limit.
max_mobile_devices: integer or null
Approved phones per member; null: no limit.
approval_minutes: integer
secure_screens: boolean
Block screenshots and screen recording on the app’s sensitive screens (Android).

Response · 200

datarequired: LoginPolicyView
metarequired: object

Request

curl -X PUT 'https://api.propzolo.com/v1/security/login-policy' \
  -H 'Authorization: Bearer pz_live_…' \
  -H 'Content-Type: application/json' \
  -d '{"approval_required":true,"max_web_devices":0,"max_mobile_devices":0,"approval_minutes":5,"secure_screens":true}'

Response example

{
  "data": {
    "approval_required": true,
    "max_web_devices": 0,
    "max_mobile_devices": 0,
    "approval_minutes": 5,
    "secure_screens": true,
    "pending_approvals": 0
  },
  "meta": {}
}

Errors

401 No valid session or API key (missing, expired or revoked).
403 The caller lacks the permission, API-key scope or support grant this operation needs.
409 A unique value already exists, a concurrent change won, or the Idempotency-Key is still in use or was sent with a different request.
422 Invalid input; `error.fields` maps field paths to messages.
429 Too many requests; retry after the Retry-After header.
500 Unexpected error; quote `error.request_id` to support.

{ "data": [ { "id": "cmusrceel0000q7kaafxqi1om", "member": { "id": "cmusrceel0000q7kaafxqi1om", "name": "string" }, "device": { "id": "cmusrceel0000q7kaafxqi1om", "kind": "web", "label": "string" }, "reason": "new_device", "admins_only": true, "status": "pending", "requested_at": "2026-10-06T05:30:00.000Z", "expires_at": "2026-10-06T05:30:00.000Z", "ip_address": "string", "decided_at": "2026-10-06T05:30:00.000Z", "decided_by": "string", "decided_via": "string", "code": "string", "can_decide": true, "approved_devices": [ { "id": "cmusrceel0000q7kaafxqi1om", "label": "string", "last_seen_at": "2026-10-06T05:30:00.000Z" } ] } ], "meta": {} }

{ "data": { "id": "cmusrceel0000q7kaafxqi1om", "member": { "id": "cmusrceel0000q7kaafxqi1om", "name": "string" }, "device": { "id": "cmusrceel0000q7kaafxqi1om", "kind": "web", "label": "string" }, "reason": "new_device", "admins_only": true, "status": "pending", "requested_at": "2026-10-06T05:30:00.000Z", "expires_at": "2026-10-06T05:30:00.000Z", "ip_address": "string", "decided_at": "2026-10-06T05:30:00.000Z", "decided_by": "string", "decided_via": "string", "code": "string", "can_decide": true, "approved_devices": [ { "id": "cmusrceel0000q7kaafxqi1om", "label": "string", "last_seen_at": "2026-10-06T05:30:00.000Z" } ] }, "meta": {} }

curl -X POST 'https://api.propzolo.com/v1/login-approvals/{id}/decision' \ -H 'Authorization: Bearer pz_live_…' \ -H 'Content-Type: application/json' \ -d '{"decision":"approve","replace_device_id":"cmusrceel0000q7kaafxqi1om"}'

{ "data": [ { "id": "cmusrceel0000q7kaafxqi1om", "member": { "id": "cmusrceel0000q7kaafxqi1om", "name": "string" }, "kind": "web", "label": "string", "status": "approved", "approved_via": "string", "approved_at": "2026-10-06T05:30:00.000Z", "approved_by": "string", "revoked_at": "2026-10-06T05:30:00.000Z", "first_seen_at": "2026-10-06T05:30:00.000Z", "last_seen_at": "2026-10-06T05:30:00.000Z", "last_ip": "string", "current": true } ], "meta": {} }

{ "data": { "id": "cmusrceel0000q7kaafxqi1om", "member": { "id": "cmusrceel0000q7kaafxqi1om", "name": "string" }, "kind": "web", "label": "string", "status": "approved", "approved_via": "string", "approved_at": "2026-10-06T05:30:00.000Z", "approved_by": "string", "revoked_at": "2026-10-06T05:30:00.000Z", "first_seen_at": "2026-10-06T05:30:00.000Z", "last_seen_at": "2026-10-06T05:30:00.000Z", "last_ip": "string", "current": true }, "meta": {} }

{ "data": { "approval_required": true, "max_web_devices": 0, "max_mobile_devices": 0, "approval_minutes": 5, "secure_screens": true, "pending_approvals": 0 }, "meta": {} }

curl -X PUT 'https://api.propzolo.com/v1/security/login-policy' \ -H 'Authorization: Bearer pz_live_…' \ -H 'Content-Type: application/json' \ -d '{"approval_required":true,"max_web_devices":0,"max_mobile_devices":0,"approval_minutes":5,"secure_screens":true}'

{ "data": { "approval_required": true, "max_web_devices": 0, "max_mobile_devices": 0, "approval_minutes": 5, "secure_screens": true, "pending_approvals": 0 }, "meta": {} }