REST

REST endpoints live under https://api.lumio.vision/v1. Request and response JSON fields use snake_case. Send JSON mutations with Content-Type: application/json; clients should send Accept: application/json.

curl https://api.lumio.vision/v1/events \
  -H "Authorization: Bearer lm_svc_your_key" \
  -H "Accept: application/json"

Most resource responses use a data field and a _links.self link. Paginated responses include data, _links, and _meta.

Errors

REST errors use this envelope:

{
  "error": "UNAUTHORIZED",
  "message": "Unauthorized: missing token",
  "details": null
}

Code	HTTP status	Meaning
DATABASE_ERROR	500	Database failure. Message detail is scrubbed.
REDIS_ERROR	500	Cache or Redis failure. Message detail is scrubbed.
NOT_FOUND	404	Resource not found.
UNAUTHORIZED	401	Missing authentication, anonymous credential, expired key, or invalid key on a guarded route.
FORBIDDEN	403	Authenticated but missing permission, feature, account access, developer ownership, or first-party/admin class bar.
BAD_REQUEST	400	Invalid request shape or invalid parameter.
CONFLICT	409	Resource state conflict.
INTERNAL_SERVER_ERROR	500	Unexpected server failure. Message detail is scrubbed.
VALIDATION_ERROR	400	Validation failure, including unknown API-key scopes.
RATE_LIMIT_EXCEEDED	429	Request bucket exhausted.
PLAN_LIMIT_REACHED	403	Plan limit blocks the requested write.
FEATURE_DISABLED	403	Required feature flag or plan feature is disabled.
CREDENTIAL_DECRYPTION_FAILED	422	Stored OAuth app credentials cannot be decrypted and must be re-entered.
RATE_LIMIT_UNAVAILABLE	503	Redis-backed rate limiting is unavailable on an expensive path.

Rate Limits

API keys use a flat 1200 requests per minute per key bucket. The window is 60 seconds. There are no endpoint-specific public API-key limits.

Successful and failed requests include:

Header	Meaning
X-RateLimit-Limit	Maximum requests in the current window.
X-RateLimit-Remaining	Remaining requests in the current window.
X-RateLimit-Reset	Unix timestamp when the current window resets.
Retry-After	Present on 429; seconds until retry.

Most routes fail open if Redis is unavailable for rate limiting. Expensive paths fail closed with 503 RATE_LIMIT_UNAVAILABLE; these include font proxying, uploads, bundles, screenshots, source downloads, previews, API-key routes, token routes, WebSocket-token minting, popout exchange, OAuth authorize, and OAuth token exchange.

API-Key Management Endpoints

Operation	REST path	Scope and class bar
List personal keys	GET /v1/api-keys	First-party user or personal key with apikeys:read; not plan-gated
Create personal key	POST /v1/api-keys	First-party user or personal key with apikeys:create; requires feature:apikeys
Assignable scopes	`GET /v1/api-keys/permissions?kind=personal	service
Rename personal key	PATCH /v1/api-keys/{id}	First-party user or personal key with apikeys:edit; requires feature:apikeys
Rotate personal key	POST /v1/api-keys/{id}/rotate	First-party user or personal key with apikeys:edit; requires feature:apikeys
Delete personal key	DELETE /v1/api-keys/{id}	First-party user or personal key with apikeys:delete; not plan-gated
List service keys	GET /v1/service-keys	First-party user or personal key with apikeys:read; not plan-gated
Create service key	POST /v1/service-keys	Interactive user session with apikeys:create; requested scopes must be within the caller's grants; requires feature:apikeys
Rename service key	PATCH /v1/service-keys/{id}	First-party user or personal key with apikeys:edit; requires feature:apikeys
Rotate service key	POST /v1/service-keys/{id}/rotate	Interactive user session with apikeys:edit; every existing key scope must be within the caller's grants; requires feature:apikeys
Delete service key	DELETE /v1/service-keys/{id}	First-party user or personal key with apikeys:delete; not plan-gated
List developer keys	GET /v1/developer/api-keys	First-party approved developer or personal key
Create developer key	POST /v1/developer/api-keys	Interactive session of an approved developer; requested scopes must be extension-dev:* and within the caller's grants; team keys require team-secrets:edit
Rename developer key	PATCH /v1/developer/api-keys/{id}	First-party approved developer or personal key; a team key needs team-secrets:edit on that team
Revoke developer key	DELETE /v1/developer/api-keys/{id}	First-party approved developer or personal key; a team key needs team-secrets:edit on that team

Endpoint Index

This index lists selected operations from the generated OpenAPI document at apps/api/openapi.json. Download /v1/openapi.json for the complete operation list and schemas.

Health

Method	Path	Operation	Access
GET	/v1	v1_index	Public
GET	/v1/health	health_check	Public

Abuse Reports

Method	Path	Operation	Access
POST	/v1/abuse-reports	submit_abuse_report	Public
GET	/v1/admin/abuse-reports	list_abuse_reports	Admin only; API keys cannot reach
PATCH	/v1/admin/abuse-reports/{id}	resolve_abuse_report	Admin only; API keys cannot reach

Audit

Method	Path	Operation	Access
GET	/v1/account/audit-log	account_audit_log	Personal or service key with audit-log:read
POST	/v1/internal/audit-ingest	ingest_audit_event	System key with audit:ingest; API keys cannot reach
GET	/v1/me/audit-log	my_audit_log	First-party user or personal key

Accounts

Method	Path	Operation	Access
POST	/v1/accounts	create_account	First-party user or personal key
GET	/v1/accounts/login-assignments	list_login_assignments	First-party user or personal key with login-assignments:read
POST	/v1/accounts/login-assignments	assign_login_connection	First-party user or personal key with login-assignments:create
DELETE	/v1/accounts/login-assignments/{provider}	remove_login_assignment	First-party user or personal key with login-assignments:delete
GET	/v1/accounts/{id}	get_account	First-party user or personal key
DELETE	/v1/accounts/{id}	dissolve_account	First-party user or personal key with account:delete
GET	/v1/accounts/{id}/enabled-features	get_account_enabled_features	First-party user or personal key
GET	/v1/accounts/{id}/feature-statuses	get_account_feature_statuses	First-party user or personal key
POST	/v1/accounts/{id}/leave	leave_account	First-party user or personal key
DELETE	/v1/login-connections/{id}	delete_login_connection	First-party user or personal key

Members

Method	Path	Operation	Access
GET	/v1/accounts/{id}/members	list_members	First-party user or personal key with members:read
DELETE	/v1/accounts/{id}/members/{membership_id}	remove_member	First-party user or personal key with members:delete
PATCH	/v1/accounts/{id}/members/{membership_id}/role	update_member_role	First-party user or personal key with members:edit
GET	/v1/invites	list_invites	Personal or service key with members:read
POST	/v1/invites	create_invite	Personal or service key with members:create
POST	/v1/invites/{code}/accept	accept_invite	Authenticated
GET	/v1/invites/{code}/info	get_invite_by_code	Public
DELETE	/v1/invites/{id}	delete_invite	Personal or service key with members:delete

Admin

Method	Path	Operation	Access
GET	/v1/admin/accounts	list_accounts	Admin only; API keys cannot reach
GET	/v1/admin/accounts/{account_id}/api-keys	admin_list_account_api_keys	Admin only; API keys cannot reach
GET	/v1/admin/accounts/{id}	get_account_detail	Admin only; API keys cannot reach
GET	/v1/admin/accounts/{id}/bot-connections	admin_list_bot_connections	Admin only; API keys cannot reach
DELETE	/v1/admin/accounts/{id}/bot-connections/{platform}	admin_delete_bot_connection	Admin only; API keys cannot reach
DELETE	/v1/admin/accounts/{id}/connections/{platform}	admin_delete_connection	Admin only; API keys cannot reach
GET	/v1/admin/accounts/{id}/features	get_account_features	Admin only; API keys cannot reach
PUT	/v1/admin/accounts/{id}/features	set_account_feature	Admin only; API keys cannot reach
DELETE	/v1/admin/accounts/{id}/features/{feature_id}	clear_account_feature	Admin only; API keys cannot reach
GET	/v1/admin/accounts/{id}/limits	get_account_limits	Admin only; API keys cannot reach
PUT	/v1/admin/accounts/{id}/limits	upsert_account_limits	Admin only; API keys cannot reach
PATCH	/v1/admin/accounts/{id}/plan	update_account_plan	Admin only; API keys cannot reach
PUT	/v1/admin/accounts/{id}/resolved-limits	set_account_resolved_limits	Admin only; API keys cannot reach
GET	/v1/admin/accounts/{id}/se-tokens	admin_list_se_tokens	Admin only; API keys cannot reach
DELETE	/v1/admin/accounts/{id}/se-tokens/{token_id}	admin_delete_se_token	Admin only; API keys cannot reach
GET	/v1/admin/admin-permissions	list_admin_permissions	Admin only; API keys cannot reach
GET	/v1/admin/admin-roles	list_admin_roles	Admin only; API keys cannot reach
POST	/v1/admin/admin-roles	create_admin_role	Admin only; API keys cannot reach
GET	/v1/admin/admin-roles/{id}	get_admin_role	Admin only; API keys cannot reach
DELETE	/v1/admin/admin-roles/{id}	delete_admin_role_route	Admin only; API keys cannot reach
PATCH	/v1/admin/admin-roles/{id}	patch_admin_role	Admin only; API keys cannot reach
GET	/v1/admin/admin-roles/{id}/members	list_admin_role_members	Admin only; API keys cannot reach
PUT	/v1/admin/admin-roles/{id}/members/{userId}	assign_admin_role_member	Admin only; API keys cannot reach
DELETE	/v1/admin/admin-roles/{id}/members/{userId}	unassign_admin_role_member	Admin only; API keys cannot reach
DELETE	/v1/admin/api-keys/{kind}/{id}	admin_delete_api_key	Admin only; API keys cannot reach
PATCH	/v1/admin/api-keys/{kind}/{id}	admin_update_api_key	Admin only; API keys cannot reach
POST	/v1/admin/api-keys/{kind}/{id}/rotate	admin_rotate_api_key	Admin only; API keys cannot reach
GET	/v1/admin/audit-log	list_audit_events	Admin only; API keys cannot reach
GET	/v1/admin/bot-commands	admin_list_bot_commands	Admin only; API keys cannot reach
POST	/v1/admin/bot-commands	admin_create_global_bot_command	Admin only; API keys cannot reach
PUT	/v1/admin/bot-commands/{id}	admin_update_bot_command	Admin only; API keys cannot reach
DELETE	/v1/admin/bot-commands/{id}	admin_delete_bot_command	Admin only; API keys cannot reach
GET	/v1/admin/bot-connections	list_global_bot_connections	Admin only; API keys cannot reach
DELETE	/v1/admin/bot-connections/{platform}	delete_global_bot_connection	Admin only; API keys cannot reach
GET	/v1/admin/bot-connections/{platform}/authorize	authorize_global_bot	Admin only; API keys cannot reach
POST	/v1/admin/bot-connections/{platform}/exchange	exchange_global_bot_oauth	Admin only; API keys cannot reach
GET	/v1/admin/bot-control/statuses	admin_bot_statuses	Admin only; API keys cannot reach
PUT	/v1/admin/bot-control/{account_id}/{platform}	admin_toggle_bot	Admin only; API keys cannot reach
GET	/v1/admin/coupons	list_coupons	Admin only; API keys cannot reach
POST	/v1/admin/coupons	create_coupon	Admin only; API keys cannot reach
GET	/v1/admin/coupons/{id}	get_coupon	Admin only; API keys cannot reach
PUT	/v1/admin/coupons/{id}	update_coupon	Admin only; API keys cannot reach
DELETE	/v1/admin/coupons/{id}	deactivate_coupon	Admin only; API keys cannot reach
GET	/v1/admin/discord-guilds	admin_discord_guilds	Admin only; API keys cannot reach
DELETE	/v1/admin/discord-guilds/{guild_id}	admin_delete_discord_guild	Admin only; API keys cannot reach
GET	/v1/admin/feature-flags	list_feature_flags	Admin only; API keys cannot reach
GET	/v1/admin/feature-flags/detail	list_feature_flags_detail	Admin only; API keys cannot reach
PATCH	/v1/admin/feature-flags/{id}	update_feature_flag	Admin only; API keys cannot reach
PUT	/v1/admin/feature-flags/{id}/detail	update_feature_flag_detail	Admin only; API keys cannot reach
GET	/v1/admin/oauth-clients	list_oauth_clients	Admin only; API keys cannot reach
POST	/v1/admin/oauth-clients	create_oauth_client	Admin only; API keys cannot reach
GET	/v1/admin/oauth-clients/{id}	get_oauth_client	Admin only; API keys cannot reach
DELETE	/v1/admin/oauth-clients/{id}	delete_oauth_client	Admin only; API keys cannot reach
PATCH	/v1/admin/oauth-clients/{id}	update_oauth_client	Admin only; API keys cannot reach
POST	/v1/admin/plans	create_plan	Admin only; API keys cannot reach
DELETE	/v1/admin/plans/{id}	delete_plan	Admin only; API keys cannot reach
PATCH	/v1/admin/plans/{id}	update_plan	Admin only; API keys cannot reach
PUT	/v1/admin/plans/{id}/features	set_plan_feature	Admin only; API keys cannot reach
POST	/v1/admin/privacy/chat/erase	erase_chat_subject	Admin only; API keys cannot reach
DELETE	/v1/admin/privacy/youtube/member/{member_channel_id}	erase_member	Admin only; API keys cannot reach
GET	/v1/admin/providers	list_providers	Admin only; API keys cannot reach
PATCH	/v1/admin/providers/{platform}/enabled	set_provider_enabled	Admin only; API keys cannot reach
PATCH	/v1/admin/providers/{platform}/toggle	toggle_provider	Admin only; API keys cannot reach
PATCH	/v1/admin/providers/{platform}/{subtype}/enabled	set_provider_subtype_enabled	Admin only; API keys cannot reach
PATCH	/v1/admin/providers/{platform}/{subtype}/toggle	toggle_provider_subtype	Admin only; API keys cannot reach
GET	/v1/admin/system-connections	list_system_connections	Admin only; API keys cannot reach
PUT	/v1/admin/system-connections/{platform}	upsert_system_connection	Admin only; API keys cannot reach
DELETE	/v1/admin/system-connections/{platform}	delete_system_connection	Admin only; API keys cannot reach
GET	/v1/admin/system-key-permissions	list_system_key_permissions	Admin only; API keys cannot reach
GET	/v1/admin/system-keys	list_system_keys	Admin only; API keys cannot reach
POST	/v1/admin/system-keys	create_system_key	Admin only; API keys cannot reach
DELETE	/v1/admin/system-keys/{id}	delete_system_key	Admin only; API keys cannot reach
GET	/v1/admin/users	list_users	Admin only; API keys cannot reach
GET	/v1/admin/users/{id}	get_user_detail	Admin only; API keys cannot reach
PATCH	/v1/admin/users/{id}	patch_user	Admin only; API keys cannot reach
DELETE	/v1/admin/users/{id}/login-connections/{provider}	admin_delete_login_connection	Admin only; API keys cannot reach
GET	/v1/admin/users/{user_id}/api-keys	admin_list_user_api_keys	Admin only; API keys cannot reach

CSP Reports

Method	Path	Operation	Access
GET	/v1/admin/csp-reports	list_csp_reports	Admin only; API keys cannot reach
POST	/v1/csp-report-ingest	ingest_csp_report	Public

AdminDeveloperApplications

Method	Path	Operation	Access
GET	/v1/admin/developer-applications	list_applications	Admin only; API keys cannot reach
GET	/v1/admin/developer-applications/{id}	get_application_detail	Admin only; API keys cannot reach
POST	/v1/admin/developer-applications/{id}/approve	approve_application	Admin only; API keys cannot reach
POST	/v1/admin/developer-applications/{id}/reject	reject_application	Admin only; API keys cannot reach

AdminDeveloperTeams

Method	Path	Operation	Access
GET	/v1/admin/developer-teams	list_teams	Admin only; API keys cannot reach
GET	/v1/admin/developer-teams/{id}	get_team	Admin only; API keys cannot reach
DELETE	/v1/admin/developer-teams/{id}	delete_team	Admin only; API keys cannot reach
POST	/v1/admin/developer-teams/{id}/members	add_team_member	Admin only; API keys cannot reach
DELETE	/v1/admin/developer-teams/{id}/members/{member_id}	remove_team_member	Admin only; API keys cannot reach
PATCH	/v1/admin/developer-teams/{id}/members/{member_id}/role	update_team_member_role	Admin only; API keys cannot reach
GET	/v1/admin/developers	list_developers	Admin only; API keys cannot reach
GET	/v1/admin/developers/{id}	get_developer	Admin only; API keys cannot reach
DELETE	/v1/admin/developers/{id}	delete_developer	Admin only; API keys cannot reach
GET	/v1/admin/developers/{id}/limit-requests	get_developer_limit_requests	Admin only; API keys cannot reach
GET	/v1/admin/developers/{id}/limits	get_developer_limits	Admin only; API keys cannot reach
PUT	/v1/admin/developers/{id}/limits	set_developer_limit	Admin only; API keys cannot reach
PATCH	/v1/admin/developers/{id}/revenue-split	set_revenue_split	Admin only; API keys cannot reach
PATCH	/v1/admin/extensions/{id}/limits	set_extension_limits	Admin only; API keys cannot reach
GET	/v1/admin/limit-requests	list_all_limit_requests	Admin only; API keys cannot reach
PUT	/v1/admin/limit-requests/{id}	review_limit_request	Admin only; API keys cannot reach
GET	/v1/admin/limit-requests/{id}/events	get_limit_request_events	Admin only; API keys cannot reach

DeveloperVerifications

Method	Path	Operation	Access
GET	/v1/admin/developer-verifications	list_pending_verifications	Admin only; API keys cannot reach
GET	/v1/admin/developer-verifications/{id}	get_verification_detail	Admin only; API keys cannot reach
POST	/v1/admin/developer-verifications/{id}/approve	approve_verification	Admin only; API keys cannot reach
POST	/v1/admin/developer-verifications/{id}/reject	reject_verification	Admin only; API keys cannot reach
GET	/v1/developer/verification	get_my_verification	First-party user or personal key; developer keys cannot manage applications
POST	/v1/developer/verification	submit_my_verification	First-party user or personal key; developer keys cannot manage applications

ExtensionReviews

Method	Path	Operation	Access
GET	/v1/admin/extension-reviews	list_review_queue	Admin only; API keys cannot reach
GET	/v1/admin/extensions	list_admin_extensions	Admin only; API keys cannot reach
POST	/v1/admin/extensions/{id}/suspend	suspend_extension	Admin only; API keys cannot reach
GET	/v1/extensions/reviews/{id}	get_review_detail	Admin only; API keys cannot reach
POST	/v1/extensions/reviews/{id}/approve	approve_version	Admin only; API keys cannot reach
POST	/v1/extensions/reviews/{id}/reject	reject_version	Admin only; API keys cannot reach
GET	/v1/extensions/reviews/{id}/source	download_source	Admin only; API keys cannot reach

Tokens

Method	Path	Operation	Access
GET	/v1/api-keys	list_api_keys	First-party user or personal key with apikeys:read
POST	/v1/api-keys	create_api_key	First-party user or personal key with apikeys:create
GET	/v1/api-keys/permissions	available_api_key_permissions	First-party user or personal key with apikeys:read
DELETE	/v1/api-keys/{id}	delete_api_key	First-party user or personal key with apikeys:delete
PATCH	/v1/api-keys/{id}	update_api_key	First-party user or personal key with apikeys:edit
POST	/v1/api-keys/{id}/rotate	rotate_api_key	First-party user or personal key with apikeys:edit
GET	/v1/service-keys	list_service_keys	First-party user or personal key with apikeys:read
POST	/v1/service-keys	create_service_key	Interactive user session with apikeys:create; requested scopes must be within the caller's grants
DELETE	/v1/service-keys/{id}	delete_service_key	First-party user or personal key with apikeys:delete
PATCH	/v1/service-keys/{id}	update_service_key	First-party user or personal key with apikeys:edit
POST	/v1/service-keys/{id}/rotate	rotate_service_key	Interactive user session with apikeys:edit; every existing key scope must be within the caller's grants
GET	/v1/tokens	list_tokens	First-party user or personal key with tokens:read
POST	/v1/tokens	create_token	First-party user or personal key with tokens:create
GET	/v1/tokens/me	get_my_permissions	First-party user or personal key
DELETE	/v1/tokens/{id}	delete_token	First-party user or personal key with tokens:delete
PATCH	/v1/tokens/{id}	update_token	First-party user or personal key with tokens:edit

Auth

Method	Path	Operation	Access
POST	/v1/auth/authorize	authorize	Public
POST	/v1/auth/link	link_provider	First-party user or personal key
POST	/v1/auth/logout	logout	Authenticated
POST	/v1/auth/popout/exchange	exchange_popout_token	Public
POST	/v1/auth/popout/ws-token	issue_popout_ws_token	Authenticated
POST	/v1/auth/refresh	refresh_token	Public
POST	/v1/auth/token	exchange_token	Public
POST	/v1/auth/token/exchange	token_exchange	Public
POST	/v1/auth/ws-token	issue_ws_token	First-party user or personal key

AutomationNodes

Method	Path	Operation	Access
GET	/v1/automation/extension-nodes	list_installed_automation_nodes	Personal or service key with automations:read
POST	/v1/automation/webhooks/{extension_id}/{install_id}	receive_automation_webhook	Public
GET	/v1/automation/webhooks/{install_id}/{automation_id}	get_automation_webhook_url	Personal or service key with automations:read

Automations

Method	Path	Operation	Access
GET	/v1/automations	list_automations	Personal or service key with automations:read; feature feature:automation
POST	/v1/automations	create_automation	Personal or service key with automations:create; feature feature:automation
GET	/v1/automations/{id}	get_automation	Personal or service key with automations:read; feature feature:automation
DELETE	/v1/automations/{id}	delete_automation	Personal or service key with automations:delete; feature feature:automation
PATCH	/v1/automations/{id}	update_automation	Personal or service key with automations:edit; feature feature:automation
PUT	/v1/automations/{id}/edges	save_edges	Personal or service key with automations:edit; feature feature:automation
POST	/v1/automations/{id}/execute	execute_automation	Personal or service key with automations:execute; feature feature:automation
PUT	/v1/automations/{id}/nodes	save_nodes	Personal or service key with automations:edit; feature feature:automation

Billing

Method	Path	Operation	Access
GET	/v1/billing/account-limits	get_account_limits	First-party user or personal key with plan:read
POST	/v1/billing/cancel	cancel_subscription	Interactive user session with plan:edit
POST	/v1/billing/checkout	create_checkout	Interactive user session
GET	/v1/billing/invoices	get_invoices	First-party user or personal key with plan:read
POST	/v1/billing/portal	create_portal	Interactive user session with plan:edit
GET	/v1/billing/status	get_billing_status	First-party user or personal key with plan:read
GET	/v1/billing/validate-coupon	validate_coupon	First-party user or personal key
POST	/v1/webhooks/stripe	stripe_webhook	Public

Bot Commands

Method	Path	Operation	Access
GET	/v1/bot-commands	list_bot_commands	Personal or service key with bot-commands:read; feature feature:bot_commands
POST	/v1/bot-commands	create_bot_command	Personal or service key with bot-commands:create; feature feature:bot_commands
PUT	/v1/bot-commands/{id}	update_bot_command	Personal or service key with bot-commands:edit; feature feature:bot_commands
DELETE	/v1/bot-commands/{id}	delete_bot_command	Personal or service key with bot-commands:delete; feature feature:bot_commands
POST	/v1/bot-commands/{id}/override	upsert_bot_command_override	Personal or service key with bot-commands:edit; feature feature:bot_commands
DELETE	/v1/bot-commands/{id}/override	delete_bot_command_override	Personal or service key with bot-commands:delete; feature feature:bot_commands

Bot Connections

Method	Path	Operation	Access
GET	/v1/bot-connections	list_bot_connections	Personal or service key with bot-connections:read; feature feature:bots
DELETE	/v1/bot-connections/{platform}	delete_bot_connection	Personal or service key with bot-connections:delete; feature feature:bots
GET	/v1/bot-connections/{platform}/authorize	authorize	Interactive session with bot-connections:create and feature:bots; discord returns a verified global-bot server invite
POST	/v1/bot-connections/{platform}/exchange	oauth_exchange	Interactive session bound to the authorize state; legacy account-source bot exchange, rejects discord
POST	/v1/bot-rejoin	bot_rejoin	Personal or service key with bot-connections:create; feature feature:bots
GET	/v1/bot-status	bot_status	Personal or service key with bot-connections:read; feature feature:bots
POST	/v1/bot-toggle	bot_toggle	Personal or service key with bot-connections:create; feature feature:bots

Bot Modules

Method	Path	Operation	Access
GET	/v1/bot-modules	list_bot_modules	Personal or service key with bot-modules:read; feature feature:bot_modules
PUT	/v1/bot-modules/{module_name}	save_bot_module	Personal or service key with bot-modules:edit; feature feature:bot_modules
DELETE	/v1/bot-modules/{module_name}	delete_bot_module	Personal or service key with bot-modules:edit; feature feature:bot_modules

BotModuleExtensions

Method	Path	Operation	Access
POST	/v1/bot-modules/kill	kill_switch	Personal or service key with bot-modules:edit
GET	/v1/developer/extensions/{id}/errors	get_extension_errors	Developer key, personal key, or user session with extension-dev:read
GET	/v1/developer/extensions/{id}/metrics	get_extension_metrics	Developer key, personal key, or user session with extension-dev:read
GET	/v1/extension-installs/{id}/logs	get_extension_install_logs	Personal or service key with bot-modules:read (bot-module install) or automations:read (automation-node install)
GET	/v1/internal/bot-modules/{account_id}/triggers	get_triggers	Authenticated

Connections

Method	Path	Operation	Access
GET	/v1/channel-info	get_channel_info	Personal or service key with connections:read; feature feature:connections
GET	/v1/connections/channel	list_connections	Personal or service key with connections:read; feature feature:connections
DELETE	/v1/connections/channel/{platform}	delete_connection	Personal or service key with connections:delete; feature feature:connections
GET	/v1/connections/channel/{platform}/authorize	authorize	Personal or service key with connections:create; feature feature:connections
GET	/v1/connections/channel/{platform}/callback	oauth_callback	Public
POST	/v1/connections/channel/{platform}/exchange	oauth_exchange	Public
GET	/v1/connections/credential-modes	credential_modes	Authenticated
GET	/v1/connections/credentials	list_credentials	Personal or service key with connections:read; feature feature:connections
PUT	/v1/connections/credentials/{platform}	save_credentials	Personal key or user session with connections:create; feature feature:connections
DELETE	/v1/connections/credentials/{platform}	delete_credentials	Personal or service key with connections:delete; feature feature:connections
POST	/v1/connections/oauth/{platform}/exchange	oauth_exchange_unified	Public
GET	/v1/connections/status	connection_statuses	Personal key or user session with connections:read; feature feature:connections

Channel Status

Method	Path	Operation	Access
GET	/v1/channel-status	get_channel_status	Personal or service key with spotify:read

Chat

Method	Path	Operation	Access
GET	/v1/chat/history	get_chat_history	Personal or service key with chat:read; feature feature:multichat
POST	/v1/chat/message	send_chat_message	Personal or service key with chat:write; feature feature:multichat
POST	/v1/chat/moderate	moderate_chat	Personal or service key with chat:ban, chat:timeout, chat:delete; feature feature:multichat
DELETE	/v1/chat/poll	end_poll_endpoint	Personal or service key with chat:poll; feature feature:multichat
DELETE	/v1/chat/prediction	end_prediction_endpoint	Personal or service key with chat:prediction; feature feature:multichat
DELETE	/v1/chat/raid	cancel_raid_endpoint	Personal or service key with chat:raid; feature feature:multichat
POST	/v1/chat/send	send_chat_to_platform	Personal key or user session with chat:write; service keys lack the user id this route requires; feature feature:multichat
GET	/v1/chat/users/search	search_chat_users	Personal or service key with chat:userinfo; feature feature:multichat
GET	/v1/chat/users/{platform}/{platform_user_id}	get_chat_user_profile	Personal or service key with chat:userinfo; feature feature:multichat
GET	/v1/chat/users/{platform}/{platform_user_id}/moderation-log	get_moderation_log_endpoint	Personal or service key with chat:userinfo; feature feature:multichat
GET	/v1/chat/users/{platform}/{platform_user_id}/notes	list_chat_user_notes	Personal key or user session with chat:notes; feature feature:multichat
POST	/v1/chat/users/{platform}/{platform_user_id}/notes	create_chat_user_note	Personal or service key with chat:notes; feature feature:multichat
DELETE	/v1/chat/users/{platform}/{platform_user_id}/notes/{note_id}	delete_chat_user_note	Personal key or user session with chat:notes; feature feature:multichat
PATCH	/v1/chat/users/{platform}/{platform_user_id}/notes/{note_id}	update_chat_user_note_endpoint	Personal key or user session with chat:notes; feature feature:multichat
POST	/v1/chat/users/{platform}/{platform_user_id}/refresh	refresh_user_profile	Personal or service key with chat:refresh_user; feature feature:multichat
PUT	/v1/chat/users/{platform}/{platform_user_id}/treatment	update_user_treatment_endpoint	Personal or service key with chat:ban; feature feature:multichat
GET	/v1/youtube/memberships/tiers	list_tiers	Personal or service key with chat:read

POST /v1/chat/send returns a send outcome with HTTP 200, including sent, platform and, when available, message_id. A refused outcome has error_code: login_reconnect_required for a dead personal login grant, internal_error for a scrubbed internal failure, or send_failed for a platform refusal. A classified send_failed response also has reject_reason: rate_limited (Twitch/Kick HTTP 429 or YouTube rateLimitExceeded), message_too_long (Twitch HTTP 422), not_permitted (Twitch/Kick HTTP 403 or YouTube HTTP 403 forbidden), or chat_ended (YouTube liveChatEnded, liveChatDisabled or liveChatNotFound). An unclassified response omits reject_reason. platform_message is the provider's own sentence without the HTTP/JSON wrapper; it is present only when the provider refused the send and its answer carried one (with or without a reject_reason), and omitted otherwise. Show platform_message to users. error is a diagnostic text: the provider's sentence when there is one, otherwise a diagnostic such as Platform API error (503): <body> or a transport error. Login and internal failures never expose crypto/DB details. GraphQL sendChatToPlatform exposes the corresponding error, errorCode, rejectReason and platformMessage fields.

Copyright

Method	Path	Operation	Access
GET	/v1/copyright/blocked-songs	list_blocked	Personal or service key with copyright:read; feature feature:copyright_detection
POST	/v1/copyright/blocked-songs	add_blocked	Personal or service key with copyright:edit; feature feature:copyright_detection
DELETE	/v1/copyright/blocked-songs/{id}	delete_blocked	Personal or service key with copyright:delete; feature feature:copyright_detection
GET	/v1/copyright/check	check_song	Personal or service key with copyright:read; feature feature:copyright_detection
POST	/v1/copyright/import-playlist	import_playlist	Personal or service key with copyright:edit; feature feature:copyright_detection
GET	/v1/copyright/playlist-syncs	list_syncs	Personal or service key with copyright:read; feature feature:copyright_detection
DELETE	/v1/copyright/playlist-syncs/{id}	delete_sync	Personal or service key with copyright:delete; feature feature:copyright_detection
GET	/v1/copyright/safe-songs	list_safe	Personal or service key with copyright:read; feature feature:copyright_detection
POST	/v1/copyright/safe-songs	add_safe	Personal or service key with copyright:edit; feature feature:copyright_detection
DELETE	/v1/copyright/safe-songs/{id}	delete_safe	Personal or service key with copyright:delete; feature feature:copyright_detection
POST	/v1/copyright/vote	cast_vote	Personal or service key with copyright:vote; feature feature:copyright_detection
GET	/v1/copyright/vote-candidates	list_vote_candidates	Personal or service key with copyright:read; feature feature:copyright_detection
POST	/v1/copyright/vote-candidates/{track_id}/approve	approve_vote_candidate	Admin only; API keys cannot reach
POST	/v1/copyright/vote-candidates/{track_id}/dismiss	dismiss_vote_candidate	Admin only; API keys cannot reach

Crawler

Method	Path	Operation	Access
GET	/v1/crawler/scope	get_scope	Admin only; API keys cannot reach
PUT	/v1/crawler/scope	set_scope	Admin only; API keys cannot reach
GET	/v1/crawler/watchlist	list_watchlist	Admin only; API keys cannot reach
POST	/v1/crawler/watchlist	add_watchlist	Admin only; API keys cannot reach
DELETE	/v1/crawler/watchlist/{platform}/{platform_channel_id}	remove_watchlist	Admin only; API keys cannot reach

DeveloperExtensions

Method	Path	Operation	Access
GET	/v1/developer/api-keys	list_developer_keys	First-party user or personal key; developer keys cannot manage keys or applications
POST	/v1/developer/api-keys	create_developer_key	Interactive user session; team keys also require team-secrets:edit on that team
DELETE	/v1/developer/api-keys/{id}	revoke_developer_key	First-party user or personal key; team keys also require team-secrets:edit on that team; developer keys cannot manage keys or applications
PATCH	/v1/developer/api-keys/{id}	update_developer_key	First-party user or personal key; team keys also require team-secrets:edit on that team; developer keys cannot manage keys or applications
GET	/v1/developer/extensions	list_developer_extensions	Developer access; owner/profile/team guard applies
POST	/v1/developer/extensions	create_developer_extension	First-party user with extension-dev:create; team creation also requires team-extensions:create
GET	/v1/developer/extensions/{id}	get_developer_extension	Developer access; owner/profile/team guard applies
DELETE	/v1/developer/extensions/{id}	delete_developer_extension	Developer access; owner/profile/team guard applies
PATCH	/v1/developer/extensions/{id}	update_developer_extension	Developer access; owner/profile/team guard applies
GET	/v1/developer/extensions/{id}/analytics	get_extension_analytics	Developer access; owner/profile/team guard applies
POST	/v1/developer/extensions/{id}/deletion-request	request_extension_deletion	First-party user with extension-dev:delete; team-owned extensions require team-extensions:delete
POST	/v1/developer/extensions/{id}/icon	upload_extension_icon	Developer key, personal key, or user session with extension-dev:edit; feature feature:extension_development
GET	/v1/developer/extensions/{id}/limits	get_extension_limits	Developer access; owner/profile/team guard applies
GET	/v1/developer/extensions/{id}/purchases	list_extension_purchases_for_developer	Developer access; owner/profile/team guard applies. Lists records within the 8-year retention only
GET	/v1/developer/extensions/{id}/screenshots	list_extension_screenshots	Developer key, personal key, or user session with extension-dev:read; feature feature:extension_development
POST	/v1/developer/extensions/{id}/screenshots	upload_extension_screenshot	Developer key, personal key, or user session with extension-dev:edit; feature feature:extension_development
DELETE	/v1/developer/extensions/{id}/screenshots/{screenshot_id}	delete_extension_screenshot	Developer key, personal key, or user session with extension-dev:edit; feature feature:extension_development
GET	/v1/developer/extensions/{id}/secrets	list_extension_secrets	Developer access (developer keys allowed); owner/profile/team guard; team extensions need team-secrets:read
PUT	/v1/developer/extensions/{id}/secrets/{key}	set_extension_secret	Developer access (developer keys allowed); owner/profile/team guard; team extensions need team-secrets:edit
DELETE	/v1/developer/extensions/{id}/secrets/{key}	delete_extension_secret	Developer access (developer keys allowed); owner/profile/team guard; team extensions need team-secrets:edit
GET	/v1/developer/extensions/{id}/versions	list_extension_versions	Developer access; owner/profile/team guard applies
POST	/v1/developer/extensions/{id}/versions	create_extension_version	Owner/profile/team guard; team-owned extensions require team-versions:create; manifest is validated
POST	/v1/developer/extensions/{id}/versions/upload	upload_extension_version	Developer key, personal key, or user session with extension-dev:edit; team-owned extensions require team-versions:create
POST	/v1/developer/extensions/{id}/versions/{vid}/submit	submit_extension_version	First-party user with extension-dev:publish; team-owned extensions require team-extensions:publish; stored manifest is revalidated
POST	/v1/developer/extensions/{id}/versions/{vid}/request-publish	request_extension_publish	Same as submit; testing → pending_publish, removes the version's test installs
POST	/v1/developer/extensions/{id}/versions/{vid}/abandon	abandon_extension_version	Same as submit; testing or pending_publish → abandoned (final), removes the version's test installs, keeps the tester list
GET	/v1/developer/extensions/{id}/versions/{vid}/testers	list_extension_testers	Developer access; owner/profile/team guard applies
POST	/v1/developer/extensions/{id}/versions/{vid}/testers	invite_extension_tester	First-party user with extension-dev:edit; team-owned extensions require team-testers:invite
DELETE	/v1/developer/extensions/{id}/versions/{vid}/testers/{uid}	remove_extension_tester	Developer access; owner/profile/team guard applies
GET	/v1/developer/limit-requests	list_developer_limit_requests	Developer key, personal key, or user session with extension-dev:read
POST	/v1/developer/limit-requests	create_developer_limit_request	Developer key, personal key, or user session with extension-dev:read
GET	/v1/developer/limit-requests/{id}/events	get_developer_limit_request_events	Developer key, personal key, or user session with extension-dev:read
GET	/v1/developer/limits	get_developer_limits	Developer key, personal key, or user session with extension-dev:read
GET	/v1/developer/payout-history	list_developer_payouts	First-party user session or personal key with extension-dev:payouts
GET	/v1/developer/payout-settings	get_developer_payout_settings	First-party user session or personal key with extension-dev:payouts
POST	/v1/developer/payouts	update_developer_payout_settings	Interactive user session with extension-dev:payouts
POST	/v1/developer/payouts/request	request_developer_payout	Interactive user session with extension-dev:payouts
GET	/v1/developer/profile	get_developer_profile	Developer access; owner/profile/team guard applies
GET	/v1/developer/revenue	get_developer_revenue	First-party user session or personal key with extension-dev:payouts

Create and update accept only private, unlisted, public, or paid visibility. Developer slugs beginning with system- and a developer-supplied system visibility return 400. JSON version creation and multipart upload validate the manifest schema, extension ID, and version; submission validates the stored manifest again. A manifest error returns 400 Manifest validation failed: ..., while a team member missing the action grant gets 403 Missing team permission: <permission>. Bundle and source storage keys are generated by the server.

DeveloperApplications

Method	Path	Operation	Access
GET	/v1/developer/application	get_my_application	First-party user or personal key; developer keys cannot manage keys or applications
POST	/v1/developer/application	submit_application	First-party user or personal key; developer keys cannot manage keys or applications

ExtensionAccess

Method	Path	Operation	Access
GET	/v1/developer/extensions/{id}/access	list_access_grants	Developer key, personal key, or user session with extension-dev:read
POST	/v1/developer/extensions/{id}/access	grant_access	Developer key, personal key, or user session with extension-dev:edit
GET	/v1/developer/extensions/{id}/access/invites	list_access_invites	Developer key, personal key, or user session with extension-dev:read
POST	/v1/developer/extensions/{id}/access/invites	create_access_invite	Developer key, personal key, or user session with extension-dev:edit
DELETE	/v1/developer/extensions/{id}/access/invites/{invite_id}	delete_access_invite	Developer key, personal key, or user session with extension-dev:edit
DELETE	/v1/developer/extensions/{id}/access/{grant_id}	revoke_access	Developer key, personal key, or user session with extension-dev:edit
GET	/v1/extension-access-invites/{code}	get_access_invite	Public
POST	/v1/extension-access-invites/{code}/accept	accept_access_invite	Personal or service key with extension-store:read; feature feature:extensions

On team-owned extensions, access and tester lists require team-testers:read; grants and invites require team-testers:invite; revocations and removals require team-testers:remove.

DeveloperStoreProfiles

Method	Path	Operation	Access
GET	/v1/developer/profiles/{slug}	get_developer_profile	Public
GET	/v1/developer/teams/{slug}/profile	get_team_profile	Public

StripeConnect

Method	Path	Operation	Access
POST	/v1/developer/stripe-connect/onboard	create_onboarding_link	Interactive user session with extension-dev:payouts; feature feature:extension_development
GET	/v1/developer/stripe-connect/status	get_connect_status	First-party user session or personal key with extension-dev:payouts; feature feature:extension_development

DeveloperTeams

Method	Path	Operation	Access
GET	/v1/developer/team-invites/{code}	get_invite_by_code	Public
POST	/v1/developer/team-invites/{code}/accept	accept_invite	First-party user or personal key
GET	/v1/developer/teams	list_teams	First-party user or personal key
POST	/v1/developer/teams	create_team	First-party user or personal key
GET	/v1/developer/teams/permissions	available_permissions	First-party user or personal key
GET	/v1/developer/teams/{id}	get_team	First-party user or personal key
DELETE	/v1/developer/teams/{id}	delete_team	First-party user or personal key
PATCH	/v1/developer/teams/{id}	update_team	First-party user or personal key
GET	/v1/developer/teams/{id}/invites	list_invites	First-party user or personal key
POST	/v1/developer/teams/{id}/invites	create_invite	First-party user or personal key
DELETE	/v1/developer/teams/{id}/invites/{invite_id}	delete_invite	First-party user or personal key
GET	/v1/developer/teams/{id}/members	list_members	First-party user or personal key
DELETE	/v1/developer/teams/{id}/members/{member_id}	remove_member	First-party user or personal key
PATCH	/v1/developer/teams/{id}/members/{member_id}/role	update_member_role	First-party user or personal key
GET	/v1/developer/teams/{id}/roles	list_roles	First-party user or personal key
POST	/v1/developer/teams/{id}/roles	create_role	First-party user or personal key
DELETE	/v1/developer/teams/{id}/roles/{rid}	delete_role	First-party user or personal key
PATCH	/v1/developer/teams/{id}/roles/{rid}	update_role	First-party user or personal key

Discord Guilds

Method	Path	Operation	Access
GET	/v1/discord-guilds	list_guilds	Active account with bot-connections:read; rows include bot_removed and missing_permissions
DELETE	/v1/discord-guilds/{guild_id}	disconnect_guild	Active account with bot-connections:delete; deletes the server settings

Discord server installation begins with GET /v1/bot-connections/discord/authorize and completes through /api/connections/oauth/discord/callback, which exchanges and verifies Discord's code. POST /v1/discord-guilds/exchange is not an endpoint.

Emotes

Method	Path	Operation	Access
GET	/v1/emotes/user	get_user_emotes	Authenticated
GET	/v1/emotes/{platform}/{channel_id}	get_emotes	Authenticated

Events

Method	Path	Operation	Access
GET	/v1/events	list_events	Personal or service key with events:read; feature feature:events
POST	/v1/events/emit	emit_event	Personal or service key with events:create
POST	/v1/events/test	broadcast_test_event	Personal or service key with events:create; feature feature:events
GET	/v1/events/{id}	get_event	Personal or service key with events:read; feature feature:events

POST /v1/events/test accepts show_on_stream (Boolean, default false) and an object raw. The server stamps raw.isTest and raw.showOnStream, broadcasts the test without storing it, and lets bots and automations configured for test events react. OBS overlay and widget sources receive it only with show_on_stream: true. POST /v1/events/emit stores a manual event after removing any isTest, is_test and showOnStream markers from raw.

ExtensionBundles

Method	Path	Operation	Access
GET	/v1/extension-bundles/{extension_id}/{version}/bundle.js	serve_bundle_legacy	Authentication required (anonymous: 401); published: any authenticated caller; draft/testing: developer, extension token, or system key with bots:internal
GET	/v1/extension-bundles/{extension_id}/{version}/{path}	serve_bundle_file	Authentication required (anonymous: 401); published: any authenticated caller; draft/testing: developer, extension token, or system key with bots:internal

Every bundle response has X-Content-Type-Options: nosniff. HTML, SVG, JSON, source maps, Lottie, and other non-passive content also have Content-Security-Policy: sandbox and Content-Disposition: attachment. Legacy file keys are accepted only within the owning extension version's storage namespace.

ExtensionStore

Method	Path	Operation	Access
GET	/v1/extension-installs	list_installs	Personal or service key with extension-store:read; feature feature:extensions
POST	/v1/extension-installs	install_extension	extension-store:install and feature:extensions; feature:extension_paid only for a non-free extension
POST	/v1/extension-installs/test-version	install_extension_test_version	Interactive sign-in session only (no API, service or developer key, no popout/overlay/widget/extension token, no MCP) with extension-store:install and feature:extensions; feature:extension_paid only for a non-free extension; a tester invitation of the signed-in user for exactly this testing version
GET	/v1/me/extension-test-invitations	list_my_test_invitations	First-party user or personal key; always the caller's own invitations
DELETE	/v1/extension-installs/{id}	uninstall_extension	Personal or service key with extension-store:uninstall; feature feature:extensions
PATCH	/v1/extension-installs/{id}	configure_extension	Personal or service key with extension-store:configure; feature feature:extensions
GET	/v1/extensions	list_extensions	Authenticated
GET	/v1/extensions/{id}/versions/{version}/files	list_extension_version_files	Authentication required (anonymous: 401); published: any authenticated caller; draft/testing: owning developer/team member or system key with bots:internal
GET	/v1/extensions/{slug}	get_extension	Authenticated
GET	/v1/extensions/{slug}/reviews	list_reviews	Personal or service key with extension-store:read; feature feature:extensions
POST	/v1/extensions/{slug}/reviews	review_extension	Personal or service key with extension-store:review; feature feature:extensions
GET	/v1/store/extensions/{slug}/icon	get_extension_icon	Public
GET	/v1/store/extensions/{id}/icon-data	get_extension_icon_data	Public; 404 unless the extension is store-visible and has an icon
GET	/v1/store/extensions/{slug}/screenshots	get_extension_screenshots	Public

Installation requires a published extension. A private extension additionally requires an account access grant or a tester invitation for the acting user; an ineligible target returns 404 Extension not found. Revoking an access grant prevents reinstalling through that grant. The GraphQL installExtension mutation applies the same check.

POST /v1/extension-installs/test-version with { "version_id": "…" } installs one testing version for an invited tester (Testing phase). Every guard miss (no interactive session, no invitation for this user and version, version not in testing, extension suspended) returns the same 404 Extension version not found. The install is pinned (auto_update: false, test_install: true on the install object), cannot be re-pinned or switched to auto-update, never counts towards install_count, never creates or delivers a purchase, and is removed through the regular uninstall when the invitation ends or the version leaves testing. GET /v1/me/extension-test-invitations lists the caller's invitations newest first with version_status and the active account's install state (installed_in_account, is_test_install, installed_version_id; filled only with extension-store:read in that account). The GraphQL twins are installExtensionTestVersion and myExtensionTestInvitations.

Installing an extension the account already has returns 409 Extension is already installed. After DELETE /v1/extension-installs/{id}, the install is gone from every read at once, and its per-install action, function and storage endpoints return 404 Extension install not found. Unless the data was deleted immediately, installing the same extension again within 30 days restores the install with its saved configuration and stored data.

ExtensionActions

Method	Path	Operation	Access
POST	/v1/extension-installs/{install_id}/actions/{action}	execute_extension_action	The install's extension token, or a personal or service key with extension-store:configure; feature feature:extensions plus the action's own feature (feature:music / feature:obs_remote / feature:multichat); the manifest must declare the action

The GraphQL twin executeExtensionAction uses the same gates and returns the same error codes and messages. A rejected request (unknown action, invalid params, undeclared permission, missing feature) is an HTTP error; an action that was accepted but could not run returns 200 with success: false, error and, for chat actions, a stable error_code (bot_not_connected, bot_scope_missing, moderation_forbidden, moderation_failed, platform_not_supported, internal_error). Chat actions run as the account's bot. The action list and payloads are on the useLumioAction page.

ExtensionFunctions

Method	Path	Operation	Access
POST	/v1/extension-installs/{install_id}/execute/{function_name}	execute_handler	Authenticated
POST	/v1/extension-installs/{install_id}/mutate/{function_name}	execute_mutate	Personal key with extension-data:edit, a System key with bots:internal, or a token bound to the install (extension, overlay or widget token; editorOnly functions refused)
POST	/v1/extension-installs/{install_id}/query/{function_name}	execute_query	Personal key with extension-data:read, a System key with bots:internal, or a token bound to the install (extension, overlay or widget token; editorOnly functions refused)

query / mutate run the declarative function function_name from the installed version's functions.json with the body { "params": { … } } (the arg() values). A personal or System key may send a raw operation (table, …) instead; tokens may not. The GraphQL twins extensionQuery / extensionMutate use the same checks and messages.

ExtensionStorage

Method	Path	Operation	Access
GET	/v1/extension-installs/{install_id}/storage	get_storage	Personal or service key with extension-store:read, or the install's extension token; feature feature:extensions
POST	/v1/extension-installs/{install_id}/storage	set_storage	Personal or service key with extension-store:configure, or the install's extension token; feature feature:extensions

Storage limits per install: key ≤ 256 bytes, value ≤ 64 KiB, ≤ 1 000 keys, ≤ 1 MiB in total. See Shared Storage.

ExtensionPurchases

Method	Path	Operation	Access
POST	/v1/extension-purchases	create_purchase	Personal or service key with extension-store:install; feature feature:extensions, feature:extension_paid

ExtensionUploads

Method	Path	Operation	Access
POST	/v1/extensions/{extension_id}/uploads	upload_extension_file	Authenticated
GET	/v1/extensions/{extension_id}/uploads/{filename}	serve_extension_upload	Public

Features

Method	Path	Operation	Access
GET	/v1/features/enabled	public_feature_enabled	Public
GET	/v1/providers/enabled	list_enabled_providers	Public

Fonts

Method	Path	Operation	Access
GET	/v1/fonts/{family}/css	get_font_css	Authenticated
GET	/v1/fonts/{family}/{weight}.woff2	get_font_woff2	Authenticated

Stream History

Method	Path	Operation	Access
GET	/v1/history	list_history	Authenticated
GET	/v1/history/filter-options	list_filter_options	Authenticated
GET	/v1/history/reports/{id}	get_report	Authenticated
DELETE	/v1/history/reports/{id}	delete_history	Authenticated
GET	/v1/history/reports/{id}/export	export_report	Authenticated
GET	/v1/history/reports/{id}/shared-links	list_report_links	Authenticated
POST	/v1/history/reports/{id}/shared-links	create_report_link	Authenticated
GET	/v1/history/reports/{id}/stats	get_report_stats	Authenticated
DELETE	/v1/history/shared-links/{id}	revoke_report_link	Authenticated
PATCH	/v1/history/shared-links/{id}	extend_report_link	Authenticated
GET	/v1/history/shared/{token}	get_public_share	Public
GET	/v1/history/shared/{token}/export	export_public_share	Public

Ideas

Method	Path	Operation	Access
GET	/v1/ideas	list_ideas	Public
POST	/v1/ideas	create_idea	Personal key or user session with ideas:create
GET	/v1/ideas/categories	list_categories	Public
POST	/v1/ideas/categories	create_category	Admin only; API keys cannot reach
DELETE	/v1/ideas/categories/{id}	delete_category	Admin only; API keys cannot reach
PATCH	/v1/ideas/categories/{id}	update_category	Admin only; API keys cannot reach
DELETE	/v1/ideas/comments/{id}	delete_comment	Personal key or user session with ideas:comment_delete
PATCH	/v1/ideas/comments/{id}	update_comment	Personal key or user session with ideas:comment_edit
POST	/v1/ideas/comments/{id}/vote	vote_comment	Personal key or user session with ideas:comment_vote
DELETE	/v1/ideas/comments/{id}/vote	remove_comment_vote	Personal key or user session with ideas:comment_vote
GET	/v1/ideas/tags	list_tags	Public
POST	/v1/ideas/tags	create_tag	Personal key or user session with ideas:create
DELETE	/v1/ideas/tags/{id}	delete_tag	Admin only; API keys cannot reach
GET	/v1/ideas/{id}	get_idea	Public
DELETE	/v1/ideas/{id}	delete_idea	Personal key or user session with ideas:delete
PATCH	/v1/ideas/{id}	update_idea	Personal key or user session with ideas:edit
GET	/v1/ideas/{id}/comments	list_idea_comments	Public
POST	/v1/ideas/{id}/comments	create_comment	Personal key or user session with ideas:comment_create
GET	/v1/ideas/{id}/participants	list_participants	Public
PATCH	/v1/ideas/{id}/status	update_idea_status	Personal key or user session with a user-scoped permission
POST	/v1/ideas/{id}/vote	vote_idea	Personal key or user session with ideas:vote
DELETE	/v1/ideas/{id}/vote	remove_vote	Personal key or user session with ideas:vote
GET	/v1/ideas/{id}/voters	list_voters	Public

OBS

Method	Path	Operation	Access
GET	/v1/integrations/obs	get_obs_config	Personal or service key with obs:read; feature feature:obs_remote
PUT	/v1/integrations/obs	save_obs_config	Personal or service key with obs:edit; feature feature:obs_remote, integration:obs_websocket
DELETE	/v1/integrations/obs	delete_obs_config	Personal or service key with obs:delete; feature feature:obs_remote, integration:obs_websocket
GET	/v1/integrations/obs/credentials	get_obs_credentials	Personal or service key with obs:read; feature feature:obs_remote
GET	/v1/integrations/obs/status	get_obs_status	Personal or service key with obs:read; feature feature:obs_remote
POST	/v1/integrations/obs/test	test_obs_connection	Personal or service key with obs:edit; feature feature:obs_remote
POST	/v1/obs-remote/recording	recording_control	Personal or service key with obs:edit; feature feature:obs_remote
POST	/v1/obs-remote/scene	switch_scene	Personal or service key with obs:edit; feature feature:obs_remote
GET	/v1/obs-remote/status	get_status	Personal or service key with obs:read; feature feature:obs_remote
POST	/v1/obs-remote/stream	stream_control	Personal or service key with obs:edit; feature feature:obs_remote

Marketplace

Method	Path	Operation	Access
GET	/v1/marketplace/categories	get_categories_public	Public
GET	/v1/marketplace/extensions	list_extensions_public	Public
GET	/v1/marketplace/extensions/{slug}	get_extension_public	Public
GET	/v1/marketplace/extensions/{slug}/reviews	get_extension_reviews_public	Public
GET	/v1/marketplace/featured	get_featured_public	Public

Notifications

Method	Path	Operation	Access
GET	/v1/notifications	list_notifications	First-party user or personal key
POST	/v1/notifications/delete-all	delete_all_notifications	First-party user or personal key
GET	/v1/notifications/preferences	get_notification_preferences	First-party user or personal key
PATCH	/v1/notifications/preferences/{notification_type}	update_notification_preference	First-party user or personal key
POST	/v1/notifications/read-all	mark_all_notifications_read	First-party user or personal key
POST	/v1/notifications/{id}/action	execute_notification_action	First-party user or personal key
PATCH	/v1/notifications/{id}/read	mark_notification_read	First-party user or personal key

Overlay Folders

Method	Path	Operation	Access
GET	/v1/overlay-folders	list_folders	Personal or service key with overlays:read; feature feature:overlay_folders
POST	/v1/overlay-folders	create_folder	Personal or service key with overlays:create; feature feature:overlay_folders
DELETE	/v1/overlay-folders/{id}	delete_folder	Personal or service key with overlays:delete; feature feature:overlay_folders
PATCH	/v1/overlay-folders/{id}	rename_folder	Personal or service key with overlays:edit; feature feature:overlay_folders

Overlays

Method	Path	Operation	Access
GET	/v1/overlays	list_overlays	Personal or service key with overlays:read; feature feature:overlays
POST	/v1/overlays	create_overlay	Personal or service key with overlays:create; feature feature:overlays
GET	/v1/overlays/{id}	get_overlay	Personal or service key with overlays:read; feature feature:overlays
DELETE	/v1/overlays/{id}	delete_overlay	Personal or service key with overlays:delete; feature feature:overlays
PATCH	/v1/overlays/{id}	update_overlay	Personal or service key with overlays:edit; feature feature:overlays
POST	/v1/overlays/{id}/move	move_overlay	Personal or service key with overlays:edit; feature feature:overlay_folders

Platforms

Method	Path	Operation	Access
GET	/v1/platforms/metadata	get_platform_metadata	Public

Playlists

Method	Path	Operation	Access
GET	/v1/playlists	list_playlists	Public; feature:copyright_detection
GET	/v1/playlists/{id}	get_playlist	Public; feature:copyright_detection

Public Stats

Method	Path	Operation	Access
GET	/v1/public-stats/browse	browse_channels	Public
GET	/v1/public-stats/channels	list_channel_settings	Personal or service key with public-stats:read
PUT	/v1/public-stats/channels/{platform}	set_channel_settings	Personal key or user session with public-stats:edit
GET	/v1/public-stats/channels/{platform}/{channel}	get_channel_stats	Public
GET	/v1/public-stats/channels/{platform}/{channel}/panel-history	get_channel_panel_history	Public
GET	/v1/public-stats/channels/{platform}/{channel}/profile-history	get_channel_profile_history	Public
GET	/v1/public-stats/channels/{platform}/{channel}/trends	get_channel_trends	Public
GET	/v1/public-stats/emotes	list_public_emotes	Public
GET	/v1/public-stats/games	browse_games	Public
GET	/v1/public-stats/streams/{platform}/{broadcast_id}	get_stream_stats	Public
GET	/v1/public-stats/streams/{platform}/{broadcast_id}/metadata-history	get_stream_metadata_history	Public

Roles

Method	Path	Operation	Access
GET	/v1/roles	list_roles	Personal or service key with roles:read
POST	/v1/roles	create_role	Personal or service key with roles:edit
GET	/v1/roles/permissions	available_permissions	Personal or service key with roles:read
GET	/v1/roles/{id}	get_role	Personal or service key with roles:read
DELETE	/v1/roles/{id}	delete_role	Personal or service key with roles:delete
PATCH	/v1/roles/{id}	update_role	Personal or service key with roles:edit

SE Tokens

Method	Path	Operation	Access
GET	/v1/se-tokens	list_se_tokens	Personal or service key with se-tokens:read; feature feature:streamelements
POST	/v1/se-tokens	create_se_token	Personal key or user session with se-tokens:create; feature feature:streamelements
DELETE	/v1/se-tokens/{id}	delete_se_token	Personal key or user session with se-tokens:delete; feature feature:streamelements

Setting Presets

Method	Path	Operation	Access
GET	/v1/setting-presets	list_setting_presets	First-party user or personal key
POST	/v1/setting-presets	create_setting_preset	First-party user or personal key
GET	/v1/setting-presets/{id}	get_setting_preset	First-party user or personal key
DELETE	/v1/setting-presets/{id}	delete_setting_preset	First-party user or personal key
PATCH	/v1/setting-presets/{id}	update_setting_preset	First-party user or personal key
POST	/v1/setting-presets/{id}/default	set_default_setting_preset	First-party user or personal key

Songs

Method	Path	Operation	Access
GET	/v1/songs	list_songs	Public; feature:copyright_detection
GET	/v1/songs/check	check_song_status	Public; feature:copyright_detection
GET	/v1/songs/sitemap	song_sitemap	Public; feature:copyright_detection
GET	/v1/songs/{id}	get_song	Public; feature:copyright_detection

These routes return 403 FEATURE_DISABLED when the gate is off. GET /v1/songs/sitemap accepts an exclusive after UUID cursor and limit (default and maximum 5,000). Its data contains items with id and nullable lastmod, and has_more; pass the last ID as after while has_more is true. Song detail exposes only a global safe or blocked row; an unknown or account-owned ID returns 404. Playlist detail includes tracks and returns 404 for an unknown ID.

Sounds

Method	Path	Operation	Access
GET	/v1/sounds	list_sounds	Personal or service key with sounds:read; feature feature:sounds
POST	/v1/sounds	upload_sound	Personal key or user session with sounds:create; feature feature:sounds
GET	/v1/sounds/{id}	get_sound	Personal or service key with sounds:read; feature feature:sounds
DELETE	/v1/sounds/{id}	delete_sound	Personal or service key with sounds:delete; feature feature:sounds
PATCH	/v1/sounds/{id}	update_sound	Personal or service key with sounds:edit; feature feature:sounds
POST	/v1/sounds/{id}/play	play_sound	Personal or service key with sounds:play; feature feature:sounds
POST	/v1/sounds/{id}/stop	stop_sound	Personal or service key with sounds:play; feature feature:sounds
GET	/v1/sounds/{id}/stream	stream_sound	Session, personal or service key with sounds:read, or an overlay (lm_overlay_*) / widget (lm_widget_*) token; other tokens get 403; feature feature:sounds

Spotify

Method	Path	Operation	Access
GET	/v1/spotify/devices	get_devices	Personal or service key with spotify:read; feature feature:music
POST	/v1/spotify/devices	transfer_device	Personal key or user session with spotify:device; feature feature:music
GET	/v1/spotify/manual-connect	get_manual_connect	Personal or service key with spotify:read
POST	/v1/spotify/manual-connect	start_manual_connect	Authenticated
DELETE	/v1/spotify/manual-connect	stop_manual_connect	Authenticated
POST	/v1/spotify/playback	playback_action	Personal key or user session with spotify:playback, spotify:volume; feature feature:music
GET	/v1/spotify/playlists	get_playlists	Personal or service key with spotify:read; feature feature:music
POST	/v1/spotify/playlists	playlist_action	Personal key or user session with spotify:playlist; feature feature:music
GET	/v1/spotify/queue	get_queue	Personal or service key with spotify:read; feature feature:music
POST	/v1/spotify/queue	add_to_queue	Personal key or user session with spotify:queue; feature feature:music
GET	/v1/spotify/search	search_tracks	Personal or service key with spotify:read; feature feature:music
GET	/v1/spotify/state	get_state	Personal or service key with spotify:read; feature feature:music

Uploads

Method	Path	Operation	Access
GET	/v1/uploads	list_uploads	Personal or service key with uploads:read; feature feature:uploads
POST	/v1/uploads	upload_file	Personal or service key with uploads:create; feature feature:uploads
GET	/v1/uploads/{id}	get_upload	Personal or service key with uploads:read; feature feature:uploads
DELETE	/v1/uploads/{id}	delete_upload	Personal or service key with uploads:delete; feature feature:uploads
GET	/v1/widget-images/{id}	read_widget_image	Session, personal or service key with uploads:read, or an overlay (lm_overlay_*) / widget (lm_widget_*) token; other tokens get 403; feature feature:uploads

GET /v1/uploads takes an optional purpose query parameter (exact match) and returns at most 200 uploads, newest first. Upload purpose widget_image accepts only PNG, JPEG, GIF, WebP or AVIF, detected from the file's bytes (the detected type is stored; SVG is refused), up to min(5 MiB, storage.max_upload_size_bytes, plan max_upload_size_bytes); anything else is 400. GET /v1/widget-images/{id} serves only widget_image uploads of the token's account (others 404) with the stored type, X-Content-Type-Options: nosniff, ETag and Cache-Control: private, no-cache, and answers 304 to a matching If-None-Match.

User Roles

Method	Path	Operation	Access
GET	/v1/user-roles	list_user_roles	Admin only; API keys cannot reach
POST	/v1/user-roles	create_user_role	Admin only; API keys cannot reach
DELETE	/v1/user-roles/{id}	delete_user_role	Admin only; API keys cannot reach
PATCH	/v1/user-roles/{id}	update_user_role	Admin only; API keys cannot reach
GET	/v1/users/{user_id}/permission-overrides	get_user_permission_overrides	Admin only; API keys cannot reach
PUT	/v1/users/{user_id}/permission-overrides	set_user_permission_override	Admin only; API keys cannot reach
DELETE	/v1/users/{user_id}/permission-overrides/{permission}	remove_user_permission_override	Admin only; API keys cannot reach
GET	/v1/users/{user_id}/permissions/resolved	get_resolved_user_permissions	Admin only; API keys cannot reach
GET	/v1/users/{user_id}/roles	get_user_role_assignments	Admin only; API keys cannot reach
POST	/v1/users/{user_id}/roles	assign_user_role	Admin only; API keys cannot reach
DELETE	/v1/users/{user_id}/roles/{role_id}	remove_user_role	Admin only; API keys cannot reach

Users

Method	Path	Operation	Access
GET	/v1/users/me	get_current_user	Personal key or user session with a user-scoped permission
PATCH	/v1/users/me	patch_current_user	Personal key or user session with a user-scoped permission
GET	/v1/users/me/login-connections	get_login_connections	First-party user or personal key
GET	/v1/users/me/sessions	get_sessions	First-party user or personal key
DELETE	/v1/users/me/sessions	delete_all_other_sessions	First-party user or personal key
DELETE	/v1/users/me/sessions/{id}	delete_session	First-party user or personal key

Watchlist

Method	Path	Operation	Access
GET	/v1/watchlist	list_watchlist	Public
POST	/v1/watchlist	add_to_watchlist	Public
DELETE	/v1/watchlist	remove_from_watchlist	Public

Webhooks

Method	Path	Operation	Access
POST	/v1/webhooks/kick	kick_webhook	Public
POST	/v1/webhooks/shopify	shopify_webhook	Public
GET	/v1/webhooks/youtube	youtube_verify	Public
POST	/v1/webhooks/youtube	youtube_webhook	Public

Widgets

Method	Path	Operation	Access
GET	/v1/widgets	list_widgets	Personal or service key with widgets:read; feature feature:widgets
POST	/v1/widgets	create_widget	Personal or service key with widgets:create; feature feature:widgets
GET	/v1/widgets/{id}	get_widget	Personal or service key with widgets:read; feature feature:widgets
DELETE	/v1/widgets/{id}	delete_widget	Personal or service key with widgets:delete; feature feature:widgets
PATCH	/v1/widgets/{id}	update_widget	Personal or service key with widgets:edit; feature feature:widgets
GET	/v1/widgets/{id}/access	list_widget_access	Personal or service key with widgets:access-read; feature feature:widgets
GET	/v1/widgets/{id}/access/candidates	list_widget_access_candidates	Personal or service key with widgets:access-read; feature feature:widgets
PUT	/v1/widgets/{id}/access/{user_id}	set_widget_access_route	Personal or service key with widgets:access-grant; feature feature:widgets
DELETE	/v1/widgets/{id}/access/{user_id}	remove_widget_access_route	Personal key or user session with widgets:access-revoke; feature feature:widgets
POST	/v1/widgets/{id}/copy-url	copy_widget_url	Personal key or user session with widgets:edit; feature feature:widgets
POST	/v1/widgets/{id}/duplicate	duplicate_widget_route	Personal key or user session with widgets:create; feature feature:widgets
POST	/v1/widgets/{id}/preview-config	preview_config	Personal or service key with widgets:edit; feature feature:widgets
POST	/v1/widgets/{id}/revoke-token	revoke_widget_token	Personal or service key with widgets:edit; feature feature:widgets

YouTube

Method	Path	Operation	Access
GET	/v1/youtube/active-streams	list_active_streams	Personal or service key with chat:read