Authentication

Programmatic clients use a tenant API key as a Bearer token.

curl "$LUCIM_API_URL/v1/changes" \
  --header "Authorization: Bearer $LUCIM_API_KEY" \
  --header "Accept: application/json"

Create and revoke API keys in Settings → API keys. The plaintext is shown once; Lucim stores only a SHA-256 hash.

Scopes

Scope	Grants
`read`	Change, evidence, replay, profile, forecast, and gate reads
`write`	Watches, acknowledgements, replay triggers, scans, and approved run mutations
`observe`	Independently gated minimized live-observation ingestion
`evidence`	Dependency-evidence admission from trusted CI
`credentials`	Secret-bearing sandbox credential administration

Create separate keys for separate workloads. A CI gate normally needs only read; a dependency-evidence uploader should receive only evidence.

Responses

Status	Meaning
`401`	Missing, invalid, or revoked API key
`402`	Workspace machine entitlement is required by the deployment
`403`	The key lacks the endpoint’s scope
`429`	Per-key minute or daily rate limit exceeded

Successful programmatic responses include X-RateLimit-Limit, X-RateLimit-Remaining, and X-RateLimit-Reset. A 429 response also includes Retry-After.

Keep API keys out of URLs, committed files, browser bundles, command history, and logs. Pass them through a secret store or protected environment variable.

API overview Pagination and errors

Essentials

REST v1

Authentication

Scopes

Responses

​Scopes

​Responses

Scopes

Responses