Skip to main content
1

Every operation is one POST

The operation name is the path: email.send is POST /email/send, auth.signin.start is POST /auth/signin/start. The body is the input object. There is no other shape to learn.The reply is { activityId, result }. A refusal is { error: { code, message, fix } } with a meaningful status.
2

Generate a client from the OpenAPI document

The document is generated from the same operation registry as the REST routes, so a generated client is as current as the API. openapi-generator covers most languages; most people need nothing more than this.
3

The two things you would have had for free

Idempotency. Anything not retry-safe takes an Idempotency-Key header. The reference marks which operations those are, and a key reused with different input is refused rather than quietly accepted.Webhook signatures. Lath-Signature is t=<unix seconds>,v1=<hex HMAC-SHA256 of "<t>.<raw body>">. Compare in constant time and reject anything older than five minutes. The webhooks guide has the whole scheme in about ten lines, in a form that ports to any language.
4

And the CLI works anywhere

npx @trylath/cli needs Node on the machine but nothing in your project, which makes it a reasonable way to script Lath from a Makefile, a CI job or a language with no client.
Last modified on September 13, 2026