Lumio API Overview
The Lumio API is the public HTTP and WebSocket surface for account automation, integrations, extension publishing, and real-time subscribers. It is separate from the extension runtime APIs documented elsewhere in these developer docs: the extension platform runs inside Lumio surfaces, while the Lumio API is called by external services, CI jobs, backends, CLIs, and trusted scripts.
Protocols
| Protocol | Production endpoint | Shape | Primary use |
|---|---|---|---|
| REST | https://api.lumio.vision/v1/... | JSON request and response bodies use snake_case | Scripts, backend integrations, generated OpenAPI clients |
| GraphQL | POST https://api.lumio.vision/v1/gql | Query and mutation fields use camelCase | Typed clients that want graph-shaped reads and mutations |
| WebSocket | wss://api.lumio.vision/v1/ws | Custom JSON frames with a type discriminator and snake_case frame names | Live events, chat, presence, history refresh, and other subscriptions |
The generated REST specification is available at GET https://api.lumio.vision/v1/openapi.json. Production does not serve the interactive Swagger UI — load the spec into your own OpenAPI tooling instead. The GraphQL SDL is available at GET https://api.lumio.vision/v1/schema, and GraphiQL is mounted at GET https://api.lumio.vision/v1/graphiql where enabled.
Environments
Use the production API host for live integrations:
https://api.lumio.vision/v1
wss://api.lumio.vision/v1/ws
Use the staging API host for non-production testing:
https://lumio.api.staging.zaflun.dev/v1
wss://lumio.api.staging.zaflun.dev/v1/ws
API Keys
The public API accepts three API-key classes:
| Prefix | Scope boundary | Carries user identity? | Typical caller |
|---|---|---|---|
lm_usr_ | One user in one account | Yes | Personal scripts, local tools, user-owned automations |
lm_svc_ | One account | No | Account service jobs and server-side integrations |
lm_dev_ | One developer profile or developer team | No | Extension publishing and CI |
Every API key is sent with Authorization: Bearer <key>. There is no X-API-Key header and API keys are not accepted in ?token= query parameters.
Reference Pages
- Authentication explains key kinds, creation surfaces, headers, rotation, expiry, and revocation.
- Scopes lists the complete assignable scope registry.
- Capabilities shows which key kind can reach which class of route.
- REST, GraphQL, and WebSocket document protocol-specific conventions.
- Quickstart has copyable
curlandwscatexamples.