Developer REST API

The Lumio Developer REST API allows you to manage extensions, versions, and installs programmatically. It is intended for use in CI/CD pipelines, scripts, and tooling — not in end-user browsers.

Base URL

https://api.lumio.vision/developer/v1

Authentication

All endpoints require a developer API key passed in the Authorization header:

Authorization: Bearer lm_dev_<your_api_key>

API keys are created and revoked in the extension dashboard under Account → Security → API Keys.

Rate limits

Endpoint group	Limit
GET endpoints	120 requests/minute
POST /extensions	10 requests/hour
POST /extensions/:id/versions	30 requests/hour
DELETE endpoints	30 requests/minute

Exceeding a limit returns 429 Too Many Requests with a Retry-After header (seconds to wait).

Errors

All errors use the same JSON envelope:

{
  "error": {
    "code": "extension_not_found",
    "message": "Extension ext_abc123 does not exist or you do not have access to it.",
    "status": 404
  }
}

Common error codes:

Code	HTTP status	Description
unauthorized	401	Missing or invalid API key
forbidden	403	Valid key but insufficient permissions
not_found	404	Resource does not exist
validation_error	422	Request body failed validation
rate_limited	429	Too many requests
internal_error	500	Unexpected server error

---

Extensions

List extensions

GET /extensions

Returns all extensions belonging to your developer account.

curl https://api.lumio.vision/developer/v1/extensions \
  -H "Authorization: Bearer lm_dev_your_key"

Response 200:

{
  "extensions": [
    {
      "id": "ext_01j9k2m3n4p5q6r7",
      "slug": "my-scoreboard",
      "name": "Sports Scoreboard",
      "visibility": "public",
      "status": "approved",
      "installCount": 142,
      "currentVersionId": "ver_abc123",
      "createdAt": "2026-01-15T10:30:00Z",
      "updatedAt": "2026-04-01T08:00:00Z"
    }
  ]
}

Get extension

GET /extensions/:id

curl https://api.lumio.vision/developer/v1/extensions/ext_01j9k2m3n4p5q6r7 \
  -H "Authorization: Bearer lm_dev_your_key"

Response 200 — full extension object including pricing, description, and ratingCount.

Create extension

POST /extensions

curl -X POST https://api.lumio.vision/developer/v1/extensions \
  -H "Authorization: Bearer lm_dev_your_key" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "My New Extension",
    "short_description": "A brief description shown in search results.",
    "description": "Full Markdown description.",
    "pricing": { "type": "free" }
  }'

Response 201:

{
  "extension": {
    "id": "ext_newly_created_id",
    "slug": "my-new-extension",
    "name": "My New Extension",
    "status": "draft",
    "createdAt": "2026-05-01T00:00:00Z"
  }
}

Update extension

PATCH /extensions/:id

Accepts the same fields as POST /extensions. Only provided fields are updated.

curl -X PATCH https://api.lumio.vision/developer/v1/extensions/ext_01j9k2m3n4p5q6r7 \
  -H "Authorization: Bearer lm_dev_your_key" \
  -H "Content-Type: application/json" \
  -d '{ "visibility": "public" }'

Response 200 — updated extension object.

Delete extension

DELETE /extensions/:id

Only allowed for extensions that have never been publicly listed.

curl -X DELETE https://api.lumio.vision/developer/v1/extensions/ext_01j9k2m3n4p5q6r7 \
  -H "Authorization: Bearer lm_dev_your_key"

Response 204 No Content.

---

Versions

List versions

GET /extensions/:id/versions

curl https://api.lumio.vision/developer/v1/extensions/ext_01j9k2m3n4p5q6r7/versions \
  -H "Authorization: Bearer lm_dev_your_key"

Response 200:

{
  "versions": [
    {
      "id": "ver_abc123",
      "version": "1.2.0",
      "status": "approved",
      "bundleSizeBytes": 182400,
      "submittedAt": "2026-04-01T08:00:00Z",
      "approvedAt": "2026-04-02T14:30:00Z"
    }
  ]
}

Submit version

POST /extensions/:id/versions

Uploads a new version bundle. Use multipart/form-data with the compiled output directory as a .tar.gz archive.

curl -X POST https://api.lumio.vision/developer/v1/extensions/ext_01j9k2m3n4p5q6r7/versions \
  -H "Authorization: Bearer lm_dev_your_key" \
  -F "version=1.3.0" \
  -F "changelog=Fixed score display for overtime games." \
  -F "bundle=@dist/bundle.tar.gz"

Response 202 Accepted:

{
  "version": {
    "id": "ver_new_version_id",
    "version": "1.3.0",
    "status": "pending",
    "submittedAt": "2026-05-01T12:00:00Z"
  }
}

The lumio deploy CLI command wraps this endpoint.

---

Installs

List installs for an extension

GET /extensions/:id/installs

Returns aggregate install statistics. Individual user data is not exposed.

curl https://api.lumio.vision/developer/v1/extensions/ext_01j9k2m3n4p5q6r7/installs \
  -H "Authorization: Bearer lm_dev_your_key"

Response 200:

{
  "total": 142,
  "active": 138,
  "byVersion": {
    "ver_abc123": 130,
    "ver_older": 8
  }
}

---

Secrets

Set a secret

PUT /extensions/:id/secrets/:key

curl -X PUT https://api.lumio.vision/developer/v1/extensions/ext_01j9k2m3n4p5q6r7/secrets/API_KEY \
  -H "Authorization: Bearer lm_dev_your_key" \
  -H "Content-Type: application/json" \
  -d '{ "value": "sk_live_abc123" }'

Response 204 No Content.

Delete a secret

DELETE /extensions/:id/secrets/:key

Response 204 No Content.

List secret keys

GET /extensions/:id/secrets

Returns key names only — values are never returned via the API.

{ "keys": ["API_KEY", "WEBHOOK_SECRET"] }