REST API reference
Keep runtime evidence and customer management on separate authorization planes.
The versioned REST contract works with any HTTP client. Use a scoped ingestion credential in the monitored runtime and a workspace-bound management API key for allowlisted management operations.
Authentication planes
Ingestion
Bearer workspace or monitor credential
Synchronize definitions and submit queued, started, skipped, heartbeat, success, failure, or log evidence from the runtime.
Management
Bearer lfm_live_... API key
Read redacted customer state and perform only the management actions granted by the key's workspace binding and abilities.
Hosted MCP
OAuth 2.1 with mcp:use
Authorize interactive MCP clients through browser consent. Passport OAuth is not used by management REST.
Runtime ingestion tokens, management API keys, and hosted-MCP OAuth tokens are not interchangeable. Send each credential only to its intended plane.
Ingestion operations
/api/v1/monitors/sync
Synchronize project, environment, and monitor definitions.
/api/v1/runtime/runs/queued
Record a queued logical run by stable slugs.
/api/v1/runtime/runs/start
Start a logical run by stable slugs.
/api/v1/runtime/runs/skipped
Record an intentional scheduler skip without a success.
/api/v1/monitors/{monitorUuid}/runs/start
Start a run for a configured monitor UUID.
/api/v1/runs/{runUuid}/heartbeat
Refresh progress for a running run.
/api/v1/runs/{runUuid}/success
Finish with bounded output or semantic evidence.
/api/v1/runs/{runUuid}/fail
Finish with a safe allowlisted failure category.
/api/v1/runs/{runUuid}/logs
Append one log or a bounded batch.
See Runtime signals for the complete setup, idempotency, retry, redaction, and verification workflow.
Management operations
Workspaces
List accessible workspaces and read one workspace or its operational overview.
Projects and environments
List or read UUID-scoped resources inside an explicit workspace.
Monitors and runs
List or read redacted monitor and run state, and synchronize monitor definitions.
Incidents
List or read incidents; acknowledge, silence, or unsilence one incident with confirmed: true and an operator reason.
Every tenant-scoped management path includes an explicit workspace UUID. Nested project, environment, monitor, run, and incident UUIDs are resolved inside that workspace.
workspaces:read
List the key workspace and read its details or overview.
projects:read
List and read projects.
environments:read
List and read environments.
monitors:read
List and read monitors.
monitors:sync
Synchronize monitor definitions.
runs:read
List and read run summaries.
incidents:read
List and read incidents.
incidents:respond
Acknowledge, silence, and unsilence incidents.
Owners and administrators issue a key from Workspace integration → Management API keys, choose its abilities and 30-, 90-, 180-, or 365-day lifetime, copy its plaintext to the caller's secret store when it is revealed, and revoke it from the same screen when it is replaced or no longer needed. LatidoFlow stores only its hash, and the key also stops authenticating if its verified issuer loses workspace access.
Response and error boundaries
200 / 201
The request was accepted. Read the returned state; asynchronous acceptance is not evidence that later work completed.
401
Credential missing, invalid, expired, revoked, or wrong for this authorization plane.
403
Authenticated identity or token does not have the required ability or workspace policy.
404
Resource was not found inside the credential or workspace scope.
409
The requested lifecycle or management transition conflicts with current state.
422
Payload or confirmation contract failed validation. Correct it instead of retrying unchanged.
429
Rate limit reached. Honor Retry-After and retry only through bounded out-of-band delivery.
Management response redaction
Management JSON is allowlisted. It omits credentials, endpoint URLs, idempotency keys, queue connection details, logs, free-form metadata, raw incident context, deduplication keys, and private failure payloads. Use evidence exports when a customer-safe portable record is required.
Use the schema as the source of truth
The OpenAPI 3.1 document defines request fields, bounds, security schemes, pagination, confirmation rules, response shapes, and all versioned paths. Generate a client if that matches your language, or call the same contract with the native HTTP client.