API REFERENCE

Developer and webhook endpoints

Applications, API keys, audit events, subscriptions, delivery operations, and safe secret rotation.

POST/api/v1/developer/applications

Register an application with a scoped API key

This operation is part of the public Lucion Identity contract.

Safe request

curl -X POST 'https://identity.lucionglobal.com/api/v1/developer/applications'
  -H 'Authorization: Bearer YOUR_ACCESS_TOKEN'
  -H 'Content-Type: application/json'
  -H 'Idempotency-Key: YOUR_IDEMPOTENCY_KEY'
  --data '{}'

Authentication

bearer + identity.applications.manage + idempotency

Request

No request body documented.

Responses and errors

Request IDs: X-Request-IDFull OpenAPI operation

GET/api/developer/applications

List owned applications

This operation is part of the public Lucion Identity contract.

Safe request

curl -X GET 'https://identity.lucionglobal.com/api/developer/applications'
  -H 'Authorization: Bearer YOUR_ACCESS_TOKEN'

Authentication

session + step-up

Request

No request body documented.

Responses and errors

Request IDs: X-Request-IDFull OpenAPI operation

POST/api/developer/applications

Register an application

This operation is part of the public Lucion Identity contract.

Safe request

curl -X POST 'https://identity.lucionglobal.com/api/developer/applications'
  -H 'Authorization: Bearer YOUR_ACCESS_TOKEN'
  -H 'Content-Type: application/json'
  -H 'Idempotency-Key: YOUR_IDEMPOTENCY_KEY'
  --data '{}'

Authentication

session + step-up + rate limit

Request

No request body documented.

Responses and errors

Request IDs: X-Request-IDFull OpenAPI operation

PATCH/api/developer/applications/{application_id}

Edit application metadata, exact redirects, or scopes

This operation is part of the public Lucion Identity contract.

Safe request

curl -X PATCH 'https://identity.lucionglobal.com/api/developer/applications/{application_id}'
  -H 'Authorization: Bearer YOUR_ACCESS_TOKEN'
  -H 'Content-Type: application/json'
  -H 'Idempotency-Key: YOUR_IDEMPOTENCY_KEY'
  --data '{}'

Authentication

session + step-up + idempotency

Request

No request body documented.

Responses and errors

Request IDs: X-Request-IDFull OpenAPI operation

DELETE/api/developer/applications/{application_id}

Disable application and revoke its credentials and grants

This operation is part of the public Lucion Identity contract.

Safe request

curl -X DELETE 'https://identity.lucionglobal.com/api/developer/applications/{application_id}'
  -H 'Authorization: Bearer YOUR_ACCESS_TOKEN'

Authentication

session + step-up + idempotency

Request

No request body documented.

Responses and errors

Request IDs: X-Request-IDFull OpenAPI operation

POST/api/developer/applications/{application_id}/rotate-secret

Rotate a confidential OIDC client secret

This operation is part of the public Lucion Identity contract.

Safe request

curl -X POST 'https://identity.lucionglobal.com/api/developer/applications/{application_id}/rotate-secret'
  -H 'Authorization: Bearer YOUR_ACCESS_TOKEN'
  -H 'Content-Type: application/json'
  -H 'Idempotency-Key: YOUR_IDEMPOTENCY_KEY'
  --data '{}'

Authentication

session + step-up + idempotency

Request

No request body documented.

Responses and errors

Request IDs: X-Request-IDFull OpenAPI operation

GET/api/developer/applications/{application_id}/certification/status

Read the owned app certification status and approved scopes

This operation is part of the public Lucion Identity contract.

Safe request

curl -X GET 'https://identity.lucionglobal.com/api/developer/applications/{application_id}/certification/status'
  -H 'Authorization: Bearer YOUR_ACCESS_TOKEN'

Authentication

session + owner isolation

Request

No request body documented.

Responses and errors

Request IDs: X-Request-IDFull OpenAPI operation

GET/api/v1/developer/applications

List owned applications with a scoped bearer credential

This operation is part of the public Lucion Identity contract.

Safe request

curl -X GET 'https://identity.lucionglobal.com/api/v1/developer/applications'
  -H 'Authorization: Bearer YOUR_ACCESS_TOKEN'

Authentication

bearer + identity.developer.read

Request

No request body documented.

Responses and errors

Request IDs: X-Request-IDFull OpenAPI operation

GET/api/developer/api-keys

List API-key metadata

This operation is part of the public Lucion Identity contract.

Safe request

curl -X GET 'https://identity.lucionglobal.com/api/developer/api-keys'
  -H 'Authorization: Bearer YOUR_ACCESS_TOKEN'

Authentication

session + step-up

Request

No request body documented.

Responses and errors

Request IDs: X-Request-IDFull OpenAPI operation

POST/api/developer/api-keys

Create a one-time API key

This operation is part of the public Lucion Identity contract.

Safe request

curl -X POST 'https://identity.lucionglobal.com/api/developer/api-keys'
  -H 'Authorization: Bearer YOUR_ACCESS_TOKEN'
  -H 'Content-Type: application/json'
  -H 'Idempotency-Key: YOUR_IDEMPOTENCY_KEY'
  --data '{}'

Authentication

session + step-up

Request

No request body documented.

Responses and errors

Request IDs: X-Request-IDFull OpenAPI operation

GET/api/v1/developer/api-keys

List API-key metadata with a scoped bearer credential

This operation is part of the public Lucion Identity contract.

Safe request

curl -X GET 'https://identity.lucionglobal.com/api/v1/developer/api-keys'
  -H 'Authorization: Bearer YOUR_ACCESS_TOKEN'

Authentication

bearer + identity.developer.read

Request

No request body documented.

Responses and errors

Request IDs: X-Request-IDFull OpenAPI operation

GET/api/developer/audit-events

List owner-scoped activity

This operation is part of the public Lucion Identity contract.

Safe request

curl -X GET 'https://identity.lucionglobal.com/api/developer/audit-events'
  -H 'Authorization: Bearer YOUR_ACCESS_TOKEN'

Authentication

session

Request

No request body documented.

Responses and errors

Request IDs: X-Request-IDFull OpenAPI operation

GET/api/v1/developer/audit-events

List owner-scoped activity with a scoped bearer credential

This operation is part of the public Lucion Identity contract.

Safe request

curl -X GET 'https://identity.lucionglobal.com/api/v1/developer/audit-events'
  -H 'Authorization: Bearer YOUR_ACCESS_TOKEN'

Authentication

bearer + identity.developer.read

Request

No request body documented.

Responses and errors

Request IDs: X-Request-IDFull OpenAPI operation

POST/api/developer/api-keys/revoke

Revoke an owned API key

This operation is part of the public Lucion Identity contract.

Safe request

curl -X POST 'https://identity.lucionglobal.com/api/developer/api-keys/revoke'
  -H 'Authorization: Bearer YOUR_ACCESS_TOKEN'
  -H 'Content-Type: application/json'
  -H 'Idempotency-Key: YOUR_IDEMPOTENCY_KEY'
  --data '{}'

Authentication

session + step-up

Request

No request body documented.

Responses and errors

Request IDs: X-Request-IDFull OpenAPI operation

GET/api/developer/webhooks

List webhook subscriptions

This operation is part of the public Lucion Identity contract.

Safe request

curl -X GET 'https://identity.lucionglobal.com/api/developer/webhooks'
  -H 'Authorization: Bearer YOUR_ACCESS_TOKEN'

Authentication

session + step-up

Request

No request body documented.

Responses and errors

Request IDs: X-Request-IDFull OpenAPI operation

POST/api/developer/webhooks

Create a signed webhook subscription

This operation is part of the public Lucion Identity contract.

Safe request

curl -X POST 'https://identity.lucionglobal.com/api/developer/webhooks'
  -H 'Authorization: Bearer YOUR_ACCESS_TOKEN'
  -H 'Content-Type: application/json'
  -H 'Idempotency-Key: YOUR_IDEMPOTENCY_KEY'
  --data '{}'

Authentication

session + step-up

Request

No request body documented.

Responses and errors

Request IDs: X-Request-IDFull OpenAPI operation

GET/api/v1/developer/webhooks

List webhook subscriptions with a scoped bearer credential

This operation is part of the public Lucion Identity contract.

Safe request

curl -X GET 'https://identity.lucionglobal.com/api/v1/developer/webhooks'
  -H 'Authorization: Bearer YOUR_ACCESS_TOKEN'

Authentication

bearer + identity.developer.read

Request

No request body documented.

Responses and errors

Request IDs: X-Request-IDFull OpenAPI operation

GET/api/developer/webhooks/deliveries

List delivery metadata

This operation is part of the public Lucion Identity contract.

Safe request

curl -X GET 'https://identity.lucionglobal.com/api/developer/webhooks/deliveries'
  -H 'Authorization: Bearer YOUR_ACCESS_TOKEN'

Authentication

session + step-up

Request

No request body documented.

Responses and errors

Request IDs: X-Request-IDFull OpenAPI operation

GET/api/v1/developer/webhooks/deliveries

List delivery metadata with a scoped bearer credential

This operation is part of the public Lucion Identity contract.

Safe request

curl -X GET 'https://identity.lucionglobal.com/api/v1/developer/webhooks/deliveries'
  -H 'Authorization: Bearer YOUR_ACCESS_TOKEN'

Authentication

bearer + identity.developer.read

Request

No request body documented.

Responses and errors

Request IDs: X-Request-IDFull OpenAPI operation

POST/api/developer/webhooks/test

Deliver a signed test event

This operation is part of the public Lucion Identity contract.

Safe request

curl -X POST 'https://identity.lucionglobal.com/api/developer/webhooks/test'
  -H 'Authorization: Bearer YOUR_ACCESS_TOKEN'
  -H 'Content-Type: application/json'
  -H 'Idempotency-Key: YOUR_IDEMPOTENCY_KEY'
  --data '{}'

Authentication

session + step-up

Request

No request body documented.

Responses and errors

Request IDs: X-Request-IDFull OpenAPI operation

POST/api/v1/developer/webhooks/test

Deliver a signed test event with a scoped API key

This operation is part of the public Lucion Identity contract.

Safe request

curl -X POST 'https://identity.lucionglobal.com/api/v1/developer/webhooks/test'
  -H 'Authorization: Bearer YOUR_ACCESS_TOKEN'
  -H 'Content-Type: application/json'
  -H 'Idempotency-Key: YOUR_IDEMPOTENCY_KEY'
  --data '{}'

Authentication

bearer + identity.webhooks.test + idempotency

Request

No request body documented.

Responses and errors

Request IDs: X-Request-IDFull OpenAPI operation

POST/api/developer/webhooks/deliveries/process

Queue due deliveries

This operation is part of the public Lucion Identity contract.

Safe request

curl -X POST 'https://identity.lucionglobal.com/api/developer/webhooks/deliveries/process'
  -H 'Authorization: Bearer YOUR_ACCESS_TOKEN'
  -H 'Content-Type: application/json'
  -H 'Idempotency-Key: YOUR_IDEMPOTENCY_KEY'
  --data '{}'

Authentication

session + step-up

Request

No request body documented.

Responses and errors

Request IDs: X-Request-IDFull OpenAPI operation

POST/api/developer/webhooks/deliveries/retry

Retry an owned delivery

This operation is part of the public Lucion Identity contract.

Safe request

curl -X POST 'https://identity.lucionglobal.com/api/developer/webhooks/deliveries/retry'
  -H 'Authorization: Bearer YOUR_ACCESS_TOKEN'
  -H 'Content-Type: application/json'
  -H 'Idempotency-Key: YOUR_IDEMPOTENCY_KEY'
  --data '{}'

Authentication

session + step-up

Request

No request body documented.

Responses and errors

Request IDs: X-Request-IDFull OpenAPI operation

POST/api/developer/webhooks/rotate

Rotate a signing secret

This operation is part of the public Lucion Identity contract.

Safe request

curl -X POST 'https://identity.lucionglobal.com/api/developer/webhooks/rotate'
  -H 'Authorization: Bearer YOUR_ACCESS_TOKEN'
  -H 'Content-Type: application/json'
  -H 'Idempotency-Key: YOUR_IDEMPOTENCY_KEY'
  --data '{}'

Authentication

session + step-up

Request

No request body documented.

Responses and errors

Request IDs: X-Request-IDFull OpenAPI operation

POST/api/developer/webhooks/disable

Disable a webhook subscription

This operation is part of the public Lucion Identity contract.

Safe request

curl -X POST 'https://identity.lucionglobal.com/api/developer/webhooks/disable'
  -H 'Authorization: Bearer YOUR_ACCESS_TOKEN'
  -H 'Content-Type: application/json'
  -H 'Idempotency-Key: YOUR_IDEMPOTENCY_KEY'
  --data '{}'

Authentication

session + step-up

Request

No request body documented.

Responses and errors

Request IDs: X-Request-IDFull OpenAPI operation

Browser developer mutations remain session, CSRF, and step-up protected. The v1 bearer read surface requires the dedicated identity.developer.read scope, enforces owner filtering, uses bounded opaque cursors, and returns metadata only: credentials, hashes, secrets, payloads, provider bodies, and audit metadata are excluded.

Route	200 response envelope
/api/v1/developer/applications	applications[] + has_more + next_cursor + authentication + scopes
/api/v1/developer/api-keys	api_keys[] + has_more + next_cursor + authentication + scopes
/api/v1/developer/audit-events	audit_events[] + has_more + next_cursor + authentication + scopes
/api/v1/developer/webhooks	webhooks[] + has_more + next_cursor + authentication + scopes
/api/v1/developer/webhooks/deliveries	deliveries[] + has_more + next_cursor + authentication + scopes

Typed collection envelope

{
  "applications": [],
  "has_more": false,
  "next_cursor": null,
  "authentication": "api_key",
  "scopes": ["identity.developer.read"]
}