1
Every operation is one POST
The operation name is the path:
email.send is POST /email/send, auth.signin.start is POST /auth/signin/start. The body is the input object. There is no other shape to learn.The reply is { activityId, result }. A refusal is { error: { code, message, fix } } with a meaningful status.2
Generate a client from the OpenAPI document
The document is generated from the same operation registry as the REST routes, so a generated client is as current as the API.
openapi-generator covers most languages; most people need nothing more than this.3
The two things you would have had for free
Idempotency. Anything not retry-safe takes an
Idempotency-Key header. The reference marks which operations those are, and a key reused with different input is refused rather than quietly accepted.Webhook signatures. Lath-Signature is t=<unix seconds>,v1=<hex HMAC-SHA256 of "<t>.<raw body>">. Compare in constant time and reject anything older than five minutes. The webhooks guide has the whole scheme in about ten lines, in a form that ports to any language.4
And the CLI works anywhere
npx @trylath/cli needs Node on the machine but nothing in your project, which makes it a reasonable way to script Lath from a Makefile, a CI job or a language with no client.
