Leni developers
Authentication and errors
Authenticate every HTTP API request with a project API key. The key is the user and organization security principal.
| Method | Value |
|---|---|
| Preferred header | X-Api-Key: <project-key> |
| Bearer header | Authorization: Bearer <project-key> |
When both supported headers are present, X-Api-Key is used. Send exactly one credential to avoid ambiguity. All documented request and response bodies use JSON unless an endpoint explicitly describes multipart upload.
Identity is server-owned
Response and error conventions
Successful endpoints return the JSON shape documented on their reference page. Policy failures normally expose a stable error code. Validation and service failures can instead expose message and status. Always branch first on the HTTP status, then on an optional machine-readable error; never parse human-readable message text.
{
"error": "RATE_LIMIT_EXCEEDED",
"message": "...",
"retryAfterSeconds": 42
}{
"message": "Invalid JSON payload",
"status": 400
}Identifiers and timestamps
Common status codes
| Status | Meaning |
|---|---|
| 400 | Invalid path, query, or body fields. |
| 202 | The analysis was durably accepted and is still running. Poll using the returned identifiers. |
| 401 | Missing, invalid, or revoked project API key. |
| 402 | Sandbox quota or funded production credit is unavailable. |
| 403 | The authenticated account or plan is not eligible for the requested scope or feature. |
| 404 | The requested owner-scoped resource does not exist or is not accessible. |
| 429 | Per-key rate limit exceeded. Respect the Retry-After header. |
| 500 / 502 | Leni or an upstream dependency could not complete the request. Retry only idempotent operations. |
| 503 | A required dependency is temporarily unavailable. Retry only safe reads with backoff. |
curl -sS "https://api.prod.ca-central-1.leni.co/users/custom-analysts" \
-H "X-Api-Key: $LENI_API_KEY"GET/users/sdk/me
Diagnostic endpoint for an authenticated project key. It returns a sanitized user object for the key owner and an optional upstreamGet result when that integration is configured. Treat the user object as account metadata, not as a source for constructing authorization claims.