Leni developers

HTTP API quickstart

Create a project key, make an authenticated request, and build a production-safe analysis lifecycle without installing an SDK.

1. Create and protect a project key

Sign in to Leni and open the API-key workspace.
Create a key in an environment available to your account.
Copy the secret once and store it in a server-side secret manager as LENI_API_KEY.
Never ship the key in browser or mobile code, a URL, source control, analytics, or support messages.

One hostname, three key environments

Sandbox, development, and production keys use https://api.prod.ca-central-1.leni.co. The key determines its own environment, request allowance, quota, and billing behavior. The dashboard is authoritative for which environments your account may create.

2. Verify the connection

curl --fail-with-body --silent --show-error \
  "https://api.prod.ca-central-1.leni.co/users/custom-analysts" \
  -H "X-Api-Key: $LENI_API_KEY"

A successful request returns JSON. HTTP 401 means the key is missing, invalid, or revoked. Project keys are accepted only in X-Api-Key or a Bearer authorization header; URL query parameters are rejected.

3. Start an analysis

curl --fail-with-body --silent --show-error \
  -X POST "https://api.prod.ca-central-1.leni.co/users/run-models" \
  -H "X-Api-Key: $LENI_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "question": "Summarize current portfolio occupancy and its main drivers.",
    "user": { "modelType": "leniq-pro" },
    "tone": "professional",
    "wait": false
  }'

Save the returned runId, messageId, and sessionId as separate opaque values. HTTP 202 means Leni durably accepted the work. Do not repeat that POST; poll the returned message.

4. Poll and retrieve the result

curl --fail-with-body --silent --show-error \
  "https://api.prod.ca-central-1.leni.co/users/me/chat-messages/$MESSAGE_ID" \
  -H "X-Api-Key: $LENI_API_KEY"

curl --fail-with-body --silent --show-error \
  -X POST "https://api.prod.ca-central-1.leni.co/users/me/chat-sessions/message-responses" \
  -H "X-Api-Key: $LENI_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"sessionId":"<session-uuid>","messageId":"<message-uuid>"}'

Production checklist	Required behavior
Secrets	Keep project keys server-side and rotate or revoke them through Leni when exposed.
Timeouts	Set an HTTP timeout, but treat an ambiguous POST timeout differently from a known rejection.
Async state	Persist all returned identifiers and poll the exact message until completed or failed.
Retries	Retry safe reads with bounded exponential backoff and jitter; never blindly replay writes.
Rate limits	Budget below the published per-key limit and obey Retry-After after HTTP 429.
Schemas	Branch on HTTP status and stable error codes; tolerate additive response fields.
Tenant safety	Do not accept user or organization identifiers as authorization; the key owner is authoritative.

No public idempotency-key contract

Leni does not currently document an Idempotency-Key header. If a mutation or analysis POST times out before you receive a response, do not automatically replay it. Reconcile existing message or session state when possible, or require an explicit retry decision.