Skip to content
Lamba
Sign In

API details

API Overview

Public customer hosts, request shapes, and core runtime/admin surfaces.

Base URLs

Customer auth

  • Test: https://test.id.uselamba.com
  • Production: https://id.uselamba.com

Customer API

  • Test: https://test.api.uselamba.com
  • Production: https://api.uselamba.com

Public host ownership

  • id.* serves customer auth, OIDC discovery, token exchange, and session operations.
  • api.* serves customer self and admin runtime APIs.
  • The Lamba console configures applications, domains, roles, webhooks, add-ons, and environment settings. Your product runtime should call only id.* and api.*.

Customer public request shape

Authorization: Bearer <customer-session-token-or-management-token>
X-Correlation-Id: <guid-or-string>

Do not send console-only workspace or project headers to the customer surface.

The bearer token comes from the customer auth host:

  • a customer session returned by password, register, magic-link, phone, refresh, or switch-context
  • a scoped customer session after OIDC by calling POST /v1/sessions/switch-context
  • a confidential management token from POST /connect/token with grant_type=client_credentials, workspaceId, projectId, and environment

Use management tokens only for /v1/admin/*. User self-service routes under /v1/me/* require a customer session.

Customer success and error contracts

  • Resource success: plain JSON object
  • List success: { items, nextCursor }
  • Errors: ProblemDetails with errorCode and traceId

Customer core surfaces

SurfaceExamplesHost
Authregister, password login, magic-link, phone OTP, social callback, MFA, refresh, logout, switch-contextid.*
OIDCdiscovery, authorize, token, JWKS, user infoid.*
Selfme/context, me/memberships, me/authorization, me/security, me/linked-identities, me/profileapi.*
Admin membersmembers, invitations, sessions, roles, permissionsapi.*
Admin applications/domainsOAuth/OIDC clients, custom domains, domain bindingsapi.*
Admin webhooks/eventsendpoint CRUD, secret rotation, delivery logs, event catalogapi.*
Billing add-onsSMS add-on status, tiers, subscribe, cancelapi.*

Implementation notes

  • Keep customer auth and customer API clients separate.
  • Always pass correlation IDs for distributed tracing.
  • Build typed adapters around the public contract instead of scattering raw fetch calls.
  • Keep browser tokens in HttpOnly cookies or platform-secure credential storage.
  • Keep management client secrets server-side.
  • Request scoping: /docs/concepts/request-scoping
  • Error contracts: /docs/reference/errors
  • OpenAPI and Postman: /docs/reference/openapi-postman