Getting started

Authentication

The LifeLoop API uses Bearer token authentication plus an acting-user identity. All requests must include a valid service token in the Authorization header. Tokens are tenant-scoped — a token issued for one tenant cannot access another tenant's data.

Getting your service token

Service tokens are issued through the LifeLoop admin console. Contact your LifeLoop account manager to have a token provisioned for your tenant.

Acting-user identity (required)

As of v1.15, every request must also identify the acting user with X-Acting-User-Id, paired with X-Acting-User-Tenant (which must match the {tenant} path segment). There is no headerless system-scoped mode. The acting user may be:

  • A resident or connection — self-access rules apply: a resident sees only their own data; a connection only residents they are linked to.
  • An Enterprise system-actor account — provisioned by LifeLoop per integration partner, scoped to the whole tenant. Use this when your middleware does its own end-user authorization. Some endpoints (e.g. flat Announcements/Newsletters by-id lookups) accept only this identity.

A missing or unresolvable acting user (absent header, missing tenant pair, tenant mismatch, unknown id, or inactive account) returns 400 or 403.

Making authenticated requests

Include the token and acting-user headers on every request:

curl
curl https://api.lifeloop.com/api/v1/{tenant}/facilities \
  -H "Authorization: Bearer YOUR_SERVICE_TOKEN" \
  -H "X-Acting-User-Id: ACTING_USER_ID" \
  -H "X-Acting-User-Tenant: {tenant}"

Token security

  • Treat your service token like a password — never expose it in client-side code or public repositories
  • Tokens can be rotated via the admin console at any time
  • All API requests are logged with the token identifier for audit purposes

Next steps