API documentation
OpenAPI description of the public API and webhook signing.
The machine-readable description is at /openapi.json (OpenAPI 3.1). It covers the API-key endpoints under /api/v1/ only. Routes that are not listed are not part of the public API and carry no stability promise.
Authentication
Send a customer API key as Authorization: Bearer <key>. Keys are created by an organization owner and carry scopes (sites:read, domains:read, analytics:read, usage:read); a key may also be limited to one site. Repeated invalid keys from one address are rate limited and answered with 429.
Webhook signing
Each outgoing delivery is a JSON POST carrying Lummet-Signature: t=<unix seconds>,v1=<hex>, Lummet-Delivery-Id and Lummet-Delivery-Attempt. Compute HMAC-SHA256, keyed with the endpoint secret, over the exact string {t}.{raw request body}, hex-encode it and compare it with v1 in constant time. Reject timestamps outside a replay window you choose. A retry is signed again with a new timestamp and carries the same delivery id, so use the delivery id to ignore duplicates. Event types: site.created, site.provisioned, site.deployed, site.failed, domain.verified, subscription.changed, payment.failed.
[OPEN] API support policy, versioning policy and a recommended replay window are owner decisions and are not stated here.