Skip to main content
Every operation is one POST to its name, with a JSON body and a bearer key. There are no path parameters, no query strings and no other verbs, so this page is the whole shape and the pages after it are the operations.

Base URL

The path is the operation name with its dots turned into slashes: email.send is POST /email/send. A /v1 prefix is still accepted on every operation and is not needed.

Authentication

Send a key as Authorization: Bearer <key>. A secret key (lath_live_…, lath_test_…) belongs on a server; a publishable key (lath_live_pk…, lath_test_pk…) reaches only the operations an end user performs for themselves, each marked auth:public. The key decides the environment, live or test. Keys and permissions covers both.

A request and its response

Every success is { activityId, result }. activityId names the audit record the call wrote and is empty for a read; result is the operation’s own output, described on its page.
200

Errors

A refusal is { error: { code, message, fix, requestId } } with a status that matches its class. Branch on code; fix names the next step. The error codes page lists every one.

Retries, paging and limits

Send an Idempotency-Key header on a write you might retry, and a repeat returns the first answer instead of acting twice. Lists page with before and nextBefore. Each key may make 600 requests a minute. API conventions has the detail, and rate limits the per-operation ceilings.

The OpenAPI document

The document these pages are built from is served at https://platform.trylath.com/openapi.json, generated from the same operation registry as the routes. Point a client generator at it, or read Any other language.
Last modified on September 23, 2026