Leni developers

HTTP API quickstart

Create a project key, make an authenticated request, and build a production-safe analysis lifecycle without installing an SDK.

1. Create and protect a project key

Sign in to Leni and open the API-key workspace.
Create a key in an environment available to your account.
Copy the secret once and store it in a server-side secret manager as LENI_API_KEY.
Never ship the key in browser or mobile code, a URL, source control, analytics, or support messages.

One hostname, three key environments

Sandbox, development, and production keys use https://api.prod.ca-central-1.leni.co. The key determines its own environment, request allowance, quota, and billing behavior. The dashboard is authoritative for which environments your account may create.

2. Verify the connection

curl --fail-with-body --silent --show-error \
  "https://api.prod.ca-central-1.leni.co/users/custom-analysts" \
  -H "X-Api-Key: $LENI_API_KEY"

A successful request returns JSON. HTTP 401 means the key is missing, invalid, or revoked. Project keys are accepted only in X-Api-Key or a Bearer authorization header; URL query parameters are rejected.

3. Start an analysis

curl --fail-with-body --silent --show-error \
  -X POST "https://api.prod.ca-central-1.leni.co/users/run-models" \
  -H "X-Api-Key: $LENI_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "question": "Summarize current portfolio occupancy and its main drivers.",
    "user": { "modelType": "leniq-pro" },
    "tone": "professional",
    "wait": false
  }'

This example omits fastMode and uses the Fast default. Add fastMode: false to select Normal mode. wait controls response waiting separately.

Save the returned runId, messageId, and sessionId as separate opaque values. HTTP 202 means Leni durably accepted the work. Do not repeat that POST; poll the returned message.

4. Poll and retrieve the result

curl --fail-with-body --silent --show-error \
  "https://api.prod.ca-central-1.leni.co/users/me/chat-messages/$MESSAGE_ID" \
  -H "X-Api-Key: $LENI_API_KEY"

curl --fail-with-body --silent --show-error \
  -X POST "https://api.prod.ca-central-1.leni.co/users/me/chat-sessions/message-responses" \
  -H "X-Api-Key: $LENI_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"sessionId":"<session-uuid>","messageId":"<message-uuid>"}'

Production checklist	Required behavior
Secrets	Keep project keys server-side and rotate or revoke them through Leni when exposed.
Timeouts	Set an HTTP timeout, but treat an ambiguous POST timeout differently from a known rejection.
Async state	Persist all returned identifiers and poll the exact message until completed or failed.
Retries	Retry safe reads with bounded exponential backoff and jitter; never blindly replay writes.
Rate limits	Budget below the published per-key limit and obey Retry-After after HTTP 429.
Schemas	Branch on HTTP status and stable error codes; tolerate additive response fields.
Tenant safety	Do not accept user or organization identifiers as authorization; the key owner is authoritative.

No public idempotency-key contract

Leni does not currently document an Idempotency-Key header. If a mutation or analysis POST times out before you receive a response, do not automatically replay it. Reconcile existing message or session state when possible, or require an explicit retry decision.