> ## Documentation Index > Fetch the complete documentation index at: https://docs.trylath.com/llms.txt > Use this file to discover all available pages before exploring further. > ## Agent Instructions > Every Lath operation is POST https://platform.trylath.com/, with a JSON body and `Authorization: Bearer `. `email.send` is POST /email/send. > Branch on `error.code`, never on `error.message`. Every refusal also carries `error.fix`, which names the next step. > Send an `Idempotency-Key` header on any operation that is not retry-safe, so a retry cannot run it twice. > A `lath_test_` key emails only the account's own members and sends no SMS; a `lath_live_` key reaches real recipients and is billed. > The OpenAPI document, generated from the same registry as the routes, is at https://platform.trylath.com/openapi.json. # Glossary > The words this documentation uses as though you already know them, each meaning the specific thing the code means by it. ## Account, project, environment An **account** is what somebody signs up for and what gets billed. A **project** sits inside it, and a project has exactly two **environments**: live and test. An environment is what a key belongs to and what every operation acts on — contacts, templates, domains, users and messages are all per environment, and nothing crosses between them. **Live and test** are the two rungs. A test key reaches the same operations against separate data, and what it can send is deliberately limited; see the test mode guide. ## Keys A **secret key** carries named permissions and belongs on a server. A **publishable key** holds one built-in permission, `auth:public`, and is safe in a browser because it reaches only the end-user sign-in operations. A **permission** is a product and a verb, like `email:write`. The **prefix** is the first 18 characters of a key, which is what a lookup matches before the rest is hashed and compared — it is what a list of keys shows you, because the key itself is shown exactly once. ## People: user, identity, contact A **user** is one of *your* customers, signing in to *your* product. A **member** is one of your own team in the Lath dashboard. The two are different tables and never mix. An **identity** is one proved way a user signs in — an address and the provider that proved it. A user can hold several, which is how one person signs in with an email address and a Google account and stays one user. A **contact** is an audience record: somebody you send marketing to. A user and a contact can be the same human and are still separate things, because consent belongs to the contact and sign-in belongs to the user. ## Sign-in words A **challenge** is one sign-in attempt in progress: `auth.signin.start` creates one and returns its id, and the code or link you received is its secret. A **session family** is a sign-in and every refresh token it has rotated into. Revoking a session ends the family, and presenting a spent refresh token revokes the family — that is why the word exists. A **handoff code** is the one-time `lath_code` a hosted sign-in puts in its redirect, exchanged for real tokens. A **second factor** is the extra step after the password or code; an **mfaToken** is what `verify` returns in place of a session when one is owed. ## Sending words A **template** has a **draft** and a **published** version, and only the published one sends. A **variant** is one language's version of a template, drafted and published on its own. A **broadcast** is one message to an audience, sent once. An **automation** is a message that sends itself when an event happens. A **suppression** is an address Lath will not send to, and **consent** is the record of what somebody agreed to receive. A **topic** is the thing consent is about, so unsubscribing from one is not unsubscribing from everything. A **segment** is two different words depending on the product: an audience filter for broadcasts, and a unit of SMS billing. ## Domain and delivery words A **sending domain** is a domain you have proved you own, through DNS records. Its **return path** is the subdomain bounces come back to, which is what the receiving server checks SPF against rather than your From address. A **blocker** is the single sentence an operation gives for why something cannot happen yet — a domain that is not verified, a carrier registration that is not active. It is a field, not a status, because the status says what state a thing is in and the blocker says what to do about it. ## Developer words An **operation** is one thing the API does, named `product.thing.verb`, and it is the same unit on every surface: a REST path, an SDK method, a CLI command and an MCP tool are four spellings of one operation. An **event** is something that happened, which webhooks deliver. **Activity** is the audit trail of operations that were called, attributed to the person or key that called them. An **endpoint** is a URL you registered to receive events, and a **delivery** is one attempt to reach it. An **idempotency key** makes a repeated call return the first call's answer instead of doing the thing twice.