Lakelyon Cloud

Lakelyon Cloud Developer API

A JSON REST API for orders, resources, billing and your account. This is the first public API release: developer API keys grant read-only access; customer mutations stay session-bound in the dashboard.

Quick start

Create an API key in the dashboard under Developer API. Pick a name, scopes (default read:*) and an optional expiry.
Copy the secret — it starts with lky_live_ and is shown exactly once. Store it securely; it is only ever stored on our side as a SHA-256 digest.
Call any endpoint with the key as a bearer token:

curl https://cloud.lakelyon.com/api/profile \
  -H "Authorization: Bearer lky_live_XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"

The dashboard itself authenticates with its session cookie; the same endpoints accept Authorization: Bearer <key> when the key has the required scope.

Base URL

Production: https://cloud.lakelyon.com — all endpoints live under /api. Machine-readable spec: /api/openapi.json (identical at /openapi.json), OpenAPI 3.0 — drop it into Swagger UI, Redoc, Hoppscotch or any codegen tool.

Endpoints

GET/api/orders

List your orders (newest first, up to 100) with items, history and fulfillment.

Auth: session or key with read:orders

GET/api/orders/{id}

Get one owned order with items, history and recent operations. 404 for non-owned orders.

Auth: session or key with read:orders

POST/api/orders/{id}

Cancel a PENDING_PAYMENT order: { "action": "cancel" }.

Auth: session only

GET/api/resources

List your resources (up to 200). Optional ?q= search over name/hostname/IPs.

Auth: session or key with read:resources

GET/api/billing

Portal URL, active subscription, latest invoices, balance due.

Auth: session or key with read:billing

GET/api/billing/invoices

Full payment history: all invoices for your account, newest first, with number, status, amounts and hosted PDF URL.

Auth: session or key with read:billing

GET/api/profile

Your profile: name, email, role, MFA status.

Auth: session or key with read:profile

PATCH/api/profile

Update your profile fields, e.g. { "name": "…" }.

Auth: session only

GET/api/profile/webhooks

List your outbound webhook endpoints (secrets never returned).

Auth: session only

POST/api/profile/webhooks

Create an endpoint { url, eventTypes?, secret? } → 201 { endpoint, secret }. Secret shown once.

Auth: session only

PATCH/api/profile/webhooks/{id}

Update url/eventTypes/enabled or rotate the secret.

Auth: session only

DELETE/api/profile/webhooks/{id}

Delete an endpoint.

Auth: session only

GET/api/profile/webhooks/{id}/deliveries

Delivery log for an endpoint.

Auth: session only

POST/api/profile/webhooks/{id}/deliveries/{deliveryId}/replay

Re-deliver an existing delivery in place (same eventId/payload, no new row). DELIVERED/FAILED rows are reset first. 200 with status, 409 if the endpoint is disabled.

Auth: session only

GET/api/health

Liveness probe — 200 when the process is alive.

Auth: none

GET/api/health/ready

Readiness probe — 200 ready, 503 not ready.

Auth: none

Scopes

Keys are deny-by-default; grant only what an integration needs.

Scope	Grants
read:*	All read endpoints (orders, resources, billing, profile)
read:orders	GET /api/orders, /api/orders/{id}
read:resources	GET /api/resources
read:billing	GET /api/billing, /api/billing/invoices
read:profile	GET /api/profile

Write access via API keys is not available in this release — mutating endpoints reject bearer keys (403) and must be called with the dashboard session.

Rate limits & errors

Developer API traffic is limited to 120 requests per minute per principal (per API key or session user). Every API response carries X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset (seconds). On a 429, honor Retry-After.

Errors are JSON: { "error": "message" }. Common statuses:

Status	Meaning
400	Malformed body or parameters
401	Missing or invalid credentials
403	Key lacks the scope, is read-only on a mutating route, or the API-key feature is not enabled for your account
404	Resource doesn't exist or isn't yours (no enumeration)
429	Rate limit exceeded — wait for Retry-After
503	Service degraded (e.g. billing portal temporarily unavailable)

Key management

Create, rename-scope, revoke and rotate keys in the dashboard under Developer API.
Keys may carry IP allow-lists (exact IPs / CIDR) and an expiry; expired keys return 401.
Rotation returns a new secret exactly once and keeps the old key usable until revoked.
Last-used time and IP are recorded on every successful request — check the dashboard for unexpected use.

Open Developer API in dashboard

Questions? Open a ticket from Support or email support@lakelyon.com.