Integration essentials
Authentication
The public API needs no authentication. Every endpoint documented here is open, so a plain request without credentials works:
curl https://api.lmaa.space/api/v1/categories
Endpoints that require an account (the dashboard and all write operations) are deliberately left out of this reference.
Requests
All responses are JSON and wrap their payload in a data envelope:
{ "data": { "…": "…" } }
Read the payload from data rather than from the response root, so added top-level fields never break your client.
Errors
Errors use the HTTP status code plus an error object with a human-readable message:
{ "error": { "message": "Shop not found" } }
Treat any non-2xx status as a failure and surface error.message; do not parse the message text itself, as its wording can change.
Rate limits
Read endpoints allow 100 requests per minute per IP address.
Every rate-limited response carries X-RateLimit-* headers with your current allowance. When you exceed it, the API answers with 429 Too Many Requests, so wait for the window to reset before retrying.
Versioning
The API is versioned in the path. Everything documented here lives under /api/v1, and that prefix keeps its current behaviour.
Additive changes (new endpoints, new fields) can land at any time, so ignore unknown fields instead of rejecting them. Breaking changes would ship as a new path prefix.
OpenAPI contract
The public OpenAPI contract is available at /docs/openapi.json.