> ## Documentation Index > Fetch the complete documentation index at: https://docs.trylath.com/llms.txt > Use this file to discover all available pages before exploring further. > ## Agent Instructions > Every Lath operation is POST https://platform.trylath.com/, with a JSON body and `Authorization: Bearer `. `email.send` is POST /email/send. > Branch on `error.code`, never on `error.message`. Every refusal also carries `error.fix`, which names the next step. > Send an `Idempotency-Key` header on any operation that is not retry-safe, so a retry cannot run it twice. > A `lath_test_` key emails only the account's own members and sends no SMS; a `lath_live_` key reaches real recipients and is billed. > The OpenAPI document, generated from the same registry as the routes, is at https://platform.trylath.com/openapi.json. # auth.settings.set > Changes sign-in settings for this environment. Objects merge key by key; redirect.allowedOrigins replaces the whole list. Takes effect on the next request. Ranges: code.length 4–8, code.ttlSeconds 60–1800, code.maxAttempts 3–10, link.ttlSeconds 60–3600, session.accessTtlSeconds 300–3600, session.refreshTtlSeconds 3600–31536000. ## OpenAPI ````yaml /api-reference/openapi.json post /auth/settings/set openapi: 3.1.0 info: title: Lath API version: 0.1.0 description: >- Every operation is one POST. The same set is reachable over MCP, the SDK and the CLI; nothing is dashboard-only. servers: - url: https://platform.trylath.com description: This deployment security: [] paths: /auth/settings/set: post: tags: - auth summary: auth.settings.set description: >- Changes sign-in settings for this environment. Objects merge key by key; redirect.allowedOrigins replaces the whole list. Takes effect on the next request. Ranges: code.length 4–8, code.ttlSeconds 60–1800, code.maxAttempts 3–10, link.ttlSeconds 60–3600, session.accessTtlSeconds 300–3600, session.refreshTtlSeconds 3600–31536000. operationId: auth.settings.set parameters: - name: Idempotency-Key in: header required: false schema: type: string description: >- Replays the stored response for the same key and input; refuses different input. requestBody: required: true content: application/json: schema: $schema: https://json-schema.org/draft/2020-12/schema type: object properties: methods: type: object properties: emailCode: type: boolean emailLink: type: boolean smsCode: type: boolean google: type: boolean microsoft: type: boolean github: type: boolean passkey: type: boolean password: type: boolean additionalProperties: false code: type: object properties: length: type: integer minimum: 4 maximum: 8 ttlSeconds: type: integer minimum: 60 maximum: 1800 maxAttempts: type: integer minimum: 3 maximum: 10 additionalProperties: false link: type: object properties: ttlSeconds: type: integer minimum: 60 maximum: 3600 additionalProperties: false session: type: object properties: accessTtlSeconds: type: integer minimum: 300 maximum: 3600 refreshTtlSeconds: type: integer minimum: 3600 maximum: 31536000 additionalProperties: false redirect: type: object properties: allowedOrigins: description: Replaces the whole list maxItems: 50 type: array items: type: string maxLength: 300 additionalProperties: false passkey: type: object properties: rpId: description: >- The WebAuthn relying party id; null derives it from the first allowed redirect origin anyOf: - type: string maxLength: 253 pattern: ^[a-z0-9.-]+$ - type: 'null' origins: description: >- Origins allowed to create and use passkeys; empty means the redirect origins maxItems: 50 type: array items: type: string maxLength: 300 additionalProperties: false password: type: object properties: minLength: type: integer minimum: 8 maximum: 64 maxLength: type: integer minimum: 64 maximum: 256 breachCheck: type: boolean additionalProperties: false mfa: type: object properties: required: type: boolean additionalProperties: false signup: type: object properties: allow: type: boolean additionalProperties: false botProtection: type: object properties: enabled: type: boolean blockDisposableEmail: type: boolean blockedDomains: maxItems: 200 type: array items: type: string pattern: >- ^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)+$ signupPerIp: type: object properties: max: type: integer minimum: 1 maximum: 100 windowSeconds: type: integer minimum: 60 maximum: 86400 additionalProperties: false minChallengeAgeSeconds: type: integer minimum: 0 maximum: 60 additionalProperties: false rateLimits: type: object properties: startPerIdentifier: type: object properties: max: type: integer minimum: 1 maximum: 100 windowSeconds: type: integer minimum: 60 maximum: 86400 additionalProperties: false startPerIp: type: object properties: max: type: integer minimum: 1 maximum: 100 windowSeconds: type: integer minimum: 60 maximum: 86400 additionalProperties: false completePerIp: type: object properties: max: type: integer minimum: 1 maximum: 100 windowSeconds: type: integer minimum: 60 maximum: 86400 additionalProperties: false additionalProperties: false additionalProperties: false responses: '200': description: '{ activityId, result }. activityId is empty for reads.' content: application/json: schema: type: object properties: activityId: type: string description: The activity this call created, or empty for a read. result: $schema: https://json-schema.org/draft/2020-12/schema type: object properties: settings: {} customised: type: array items: type: string updatedAt: anyOf: - type: string format: date-time pattern: >- ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d:[0-5]\d(?:\.\d+)?(?:Z|([+-](?:[01]\d|2[0-3]):[0-5]\d)))$ - type: 'null' defaults: {} methods: type: object propertyNames: type: string additionalProperties: type: object properties: enabled: type: boolean available: type: boolean reason: type: - string - 'null' offered: type: boolean required: - enabled - available - reason - offered additionalProperties: {} public: {} required: - settings - customised - updatedAt - defaults - methods - public additionalProperties: {} required: - activityId - result '400': description: invalid_input or invalid_json '401': description: unauthenticated '403': description: forbidden '404': description: not_found '409': description: 'conflict: idempotency_mismatch, email_taken, last_key' '413': description: body_too_large '429': description: rate_limited security: - bearer: [] components: securitySchemes: bearer: type: http scheme: bearer description: >- A Lath API key: lath_live_sk… or lath_test_sk… on a server, lath_live_pk… or lath_test_pk… in a browser. ````