REST API reference

Server endpoints

Authorization: Bearer lx_live_xxxxxxxxxxxx

The key determines the app, so you never send an app ID. Revoked keys return 401. Mint keys under Admin → Apps → Keys & widget.

Widget endpoints

X-Lunax-Widget-Key: lx_w_xxxxxxxx

The key can also travel as a widget_key body field, or you can identify the app with an app field containing its slug.

Create a ticket from your backend. Secret key required.

curl -X POST https://YOUR_LUNAX_HOST/api/v1/tickets \
  -H "Authorization: Bearer lx_live_xxxxxxxxxxxx" \
  -H "Content-Type: application/json" \
  -d '{
    "subject": "Nightly export failed",
    "description": "Job 4417 exited non-zero.",
    "requester_email": "ops@acme.com",
    "priority": "high",
    "category": "bug"
  }'

Response — 201

{
  "id": "0f8c…",
  "app_id": "b21a…",
  "number": 42,
  "subject": "Nightly export failed",
  "description": "Job 4417 exited non-zero.",
  "status": "open",
  "priority": "high",
  "category": "bug",
  "requester_id": "9d3e…",
  "assignee_id": null,
  "created_at": "2026-07-20T09:12:44.201Z",
  "updated_at": "2026-07-20T09:12:44.201Z"
}

Attachments are not supported on this endpoint. Files can only be attached through the portal or the widget.

Create a public feedback post. Secret key required.

curl -X POST https://YOUR_LUNAX_HOST/api/v1/feedback \
  -H "Authorization: Bearer lx_live_xxxxxxxxxxxx" \
  -H "Content-Type: application/json" \
  -d '{
    "title": "Dark mode",
    "description": "Follow the system theme.",
    "category": "feature",
    "requester_email": "jane@acme.com"
  }'

Returns 201 with the full post row. New posts always start at status open with zero votes.

Browser-callable ticket creation. Accepts JSON or multipart/form-data — attachments require multipart.

Response — 201

{
  "id": "0f8c…",
  "number": 42,
  "subject": "Cannot export CSV",
  "status": "open",
  "url": "https://YOUR_LUNAX_HOST/my/tickets/0f8c…",
  "attachments": 2
}

Accepted file types: PNG, JPEG, WebP, GIF, MP4, WebM, MOV, PDF, and plain text. Anything else is rejected.

Browser-callable feedback creation. JSON only — sending multipart here fails with a parse error.

Response — 201

{
  "id": "7c2b…",
  "title": "Dark mode",
  "status": "open",
  "category": "feature",
  "url": "https://YOUR_LUNAX_HOST/b/acme/p/7c2b…"
}

Note this returns a different, smaller shape than the secret-key feedback endpoint, which returns the full row.

Returns an app's public display details and links. The widget calls this on load; you only need it if you're building your own help UI.

curl "https://YOUR_LUNAX_HOST/api/v1/widget/config?app=acme"

{
  "app": {
    "id": "b21a…",
    "slug": "acme",
    "name": "Acme Analytics",
    "description": "…",
    "logo_url": "https://…"
  },
  "widget_key": "lx_w_xxxxxxxx",
  "links": {
    "board":     "https://YOUR_LUNAX_HOST/b/acme",
    "roadmap":   "https://YOUR_LUNAX_HOST/b/acme/roadmap",
    "changelog": "https://YOUR_LUNAX_HOST/b/acme/changelog",
    "myTickets": "https://YOUR_LUNAX_HOST/my",
    "newTicket": "https://YOUR_LUNAX_HOST/my/tickets/new?app=acme",
    "login":     "https://YOUR_LUNAX_HOST/login"
  },
  "features": { "tickets": true, "feedback": true }
}

Cached for 60 seconds. Returns 404if the app doesn't exist or has the widget disabled.

The featuresflags are reserved and currently always true; don't branch on them.

Every error is JSON shaped { "error": "message" } with a matching HTTP status.

Handle 429 by honouring the Retry-After header, in whole seconds, rather than retrying immediately.

• The server endpoints send no CORS headers at all, so calling them from a browser fails at preflight. That's intentional — they need a secret key.
• Widget endpoints accept requests from any origin. There is no domain allow-list tying a key to your site.