> ## Documentation Index > Fetch the complete documentation index at: https://developer.mogl.online/llms.txt > Use this file to discover all available pages before exploring further. # Open a CSVBox importer session > Returns what the client needs to open the CSVBox importer. Open one session per upload, right before opening the importer: * * - `license_key`: this environment's CSVBox sheet license key. * - `import_token`: pass it in the importer's `request_headers` under `token_header` (`X-Import-Token`). CSVBox sends it on every delivery to POST /agent/roster-imports/csvbox; it is how MOGL knows the agent. It is encrypted on the server (agent id, session id, environment, expiry) and cannot be read or forged by the client. * - `session_id`: the import's idempotency key. It stays the same across every correction and resubmission, though CSVBox gives each one a new import id. When CSVBox reports success, find the MOGL import with GET /agent/roster-imports?session_id=..., then poll it. * - `env_name`: pass it as the importer's `environment.env_name`, so CSVBox imports are tagged by environment. * * Same approval rule as inviting athletes. Rate limit 30/min. ## OpenAPI ````yaml /storage/api-docs/api-docs.json post /agent/roster-imports/session openapi: 3.0.0 info: title: MOGL Core API description: >- MOGL Platform Core API — powering athlete NIL deals, brand partnerships, agent management, payments, messaging, and more. * * ## Authentication * - **JWT Bearer Token**: Most endpoints require a Bearer token obtained via `/api/login`. * - **Server-to-Server API Key**: Internal/lambda/cron endpoints use an `X-API-KEY` header. * * ## Rate Limiting * - Registration & login endpoints: 4–15 requests per minute * - Public/influencer endpoints: 200 requests per minute * - Authenticated endpoints: standard Laravel throttle version: 1.0.0 servers: - url: http://localhost/mogl/mogl-backend/api description: Local - url: https://dev-api.mogl.online/api description: Dev - url: https://staging-api.mogl.online/api description: Staging - url: https://api.mogl.online/api description: Production security: - bearerAuth: [] tags: - name: Authentication description: Login, registration, password reset - name: User Registration - Common description: Common user registration & email check - name: User Registration - Athlete description: Athlete registration & onboarding steps - name: User Registration - Partner description: Partner/Brand registration & onboarding steps - name: User Registration - Agent description: Agent registration & onboarding steps - name: User Registration - Fan description: Fan registration & onboarding steps - name: User Profile description: User profile management, settings, social media - name: Athlete description: 'Athlete-specific endpoints: search, details, availability' - name: Athlete - Availability Confirmation description: Post-hiring availability confirmation workflow - name: Athlete - NIL Feed description: Athlete NIL feed and partner search - name: Athlete - AI Assistant description: >- AI-powered job assistant for athletes — chat, conversation history, read state, and clarification drafts - name: Athlete - AI Waitlist description: AI Athlete Assistant waitlist status, social proof, and joining - name: Partner description: Partner/Brand-specific endpoints - name: Partner - External Job description: External job link & applicant management - name: Partner - Deliverable Report description: Deliverable detail reports for brands - name: Partner - Screening Questions description: Screening question reports - name: Partner - Contract Management description: Brand contract management with athletes - name: Partner - Content Library description: Brand content library for deliverable assets - name: Agent description: Agent profile, athlete management, contracts - name: Agent - Athletes description: Agent-athlete relationship management - name: Agent - Stripe description: Agent payment methods & billing via Stripe - name: Agent - Pay description: 'Agent-wide payout feed: money MOGL sends the agent through Stripe Express' - name: Agent - Contracts description: Agent athlete contract management - name: Agent - Availability Confirmation description: Agent managing athlete job availability - name: Agent - Roster Import description: >- CSV client list import through CSVBox (ENG-1619 / ENG-1702): session, CSVBox webhook, progress, row results, retry - name: Agent - Roster Pages description: >- ENG-1685: My Roster Link, public roster directory, public roster page, and roster SEO URL resolution. A roster is the agent's current linked athletes; nothing is stored separately. - name: Jobs description: Job/deal CRUD, search, invitations, hiring, deliverables - name: Deals description: Deal listing, my deals, bulk operations - name: Deal Folder description: >- Deal folder file workflow — uploads, replacements, approvals, revisions, comments. Accessible by athlete, partner/brand, agent, and iOS clients (per-action authorisation enforced server-side). - name: Deal Folder iOS API description: >- iOS-only direct-to-S3 multipart upload endpoints for deal folder files (initiate/complete for new uploads and replacements). Web clients should use the standard `Deal Folder` upload/replace endpoints instead. - name: Chat description: Messaging, chat contacts, notifications - name: Notifications description: Notification preferences, in-app notifications - name: Payments description: Stripe payments, payment history, cards, bulk pay - name: Subscription description: Brand subscription plans & management - name: Public Pages description: Public content endpoints (no auth required) - name: Public - Influencer/SEO description: Public influencer discovery, sitemaps, directories - name: Services description: Athlete service marketplace - name: iOS Device description: iOS device tokens, live activities - name: Onboarding Tutorial description: Onboarding tutorial progress - name: MOGL Rosters description: Roster management & display - name: Internal / Cron description: Server-to-server and cron job endpoints - name: Internal / AI Assistant Tools description: >- Server-to-server Athlete Assistant tool gateway used by mogl-ai-service. Eight Laravel tools share POST /internal/ai-assistant/tools/{tool}. search_kb is Python-local and is not in this path enum. - name: Internal / QA Scenario Lab description: >- Feature-flagged DEV/STAGING-only endpoints called by the authorized Back Office QA Scenario Lab. - name: Affiliate description: Athlete affiliate links & tracking - name: Internal description: Internal - name: Public - Social Linking description: Public - Social Linking paths: /agent/roster-imports/session: post: tags: - Agent - Roster Import summary: Open a CSVBox importer session description: >- Returns what the client needs to open the CSVBox importer. Open one session per upload, right before opening the importer: * * - `license_key`: this environment's CSVBox sheet license key. * - `import_token`: pass it in the importer's `request_headers` under `token_header` (`X-Import-Token`). CSVBox sends it on every delivery to POST /agent/roster-imports/csvbox; it is how MOGL knows the agent. It is encrypted on the server (agent id, session id, environment, expiry) and cannot be read or forged by the client. * - `session_id`: the import's idempotency key. It stays the same across every correction and resubmission, though CSVBox gives each one a new import id. When CSVBox reports success, find the MOGL import with GET /agent/roster-imports?session_id=..., then poll it. * - `env_name`: pass it as the importer's `environment.env_name`, so CSVBox imports are tagged by environment. * * Same approval rule as inviting athletes. Rate limit 30/min. operationId: agentRosterImportSession responses: '200': description: Session issued content: application/json: schema: properties: data: properties: license_key: type: string example: aBcD1234EfGh5678 session_id: type: string example: 9b2f6a1e-2c4d-4f7e-9a51-3d8e6c0b7f21 import_token: type: string example: eyJpdiI6IkQ0... token_header: type: string example: X-Import-Token env_name: type: string example: development max_rows: description: Pass as the importer's `max_rows`. type: integer example: 1000 expires_at: description: >- Covers the whole upload, including every correction and resubmission. type: string example: '2026-10-14 22:15:00' type: object type: object '400': description: The agent is not approved. content: application/json: schema: properties: message: type: string example: >- Your agent account must be approved before you can import athletes. error_code: type: string enum: - AGENT_NOT_APPROVED example: AGENT_NOT_APPROVED type: object '503': description: CSVBox is not configured on this environment (license key missing). content: application/json: schema: properties: message: type: string example: Client list import is not available right now. type: object security: - bearerAuth: [] components: securitySchemes: bearerAuth: type: http description: >- JWT Bearer token authentication. Use the /api/login endpoint to obtain a token. scheme: bearer bearerFormat: JWT ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.