Leadtime Public API

Versioned public API.

Authentication:

Personal Access Tokens (PAT): Create/manage in your Profile → API Tokens. Use the raw token once returned to you as Bearer: Authorization: Bearer <pat>.
OAuth 2.0 (Authorization Code + PKCE): Workspace admin creates an OAuth client in Workspace Settings → API & Integrations, then obtain tokens via the standard OAuth flow. Use the access token as Bearer. Refresh tokens are supported at /api/oauth/token.

Dynamic Client Registration (RFC 7591): The API supports RFC 7591 compliant dynamic client registration, allowing applications to register OAuth clients programmatically without requiring workspace admin setup.

Registration Endpoint: POST /api/oauth/register

Features:

Automatically creates OAuth clients with generated client_id and optional client_secret
Clients are auto-installed in workspaces when the API feature is enabled
Supports multiple authentication methods: none (public clients), client_secret_post, client_secret_basic
Idempotent registration: If a client with the same name and redirect URIs already exists, the existing client is updated instead of creating a duplicate
Returns RFC 7591 compliant registration response with client credentials and metadata

Request Body:

redirect_uris (required): Array of redirect URIs for the client
client_name (optional): Display name for the client (defaults to “Dynamically Registered Client”)
client_uri (optional): Homepage URL of the client application
logo_uri (optional): Logo URL for the client
token_endpoint_auth_method (optional): Authentication method (none, client_secret_post, or client_secret_basic, defaults to none)

Response:

client_id: Unique client identifier (format: dcr_<uuid>)
client_secret: Client secret (only returned for confidential clients, not for none auth method)
client_name: Client display name
redirect_uris: Array of allowed redirect URIs
token_endpoint_auth_method: Authentication method used
grant_types: Supported grant types (authorization_code, refresh_token)
response_types: Supported response types (code)
client_id_issued_at: Unix timestamp when client was created
client_secret_expires_at: Expiration timestamp (0 means no expiration)
registration_client_uri: URI for client registration management

Discovery: The registration endpoint URL is available via OAuth 2.0 Authorization Server Metadata at /api/.well-known/oauth-authorization-server (see registration_endpoint field).

Imposter Mode (Testing/Debugging): ⚠️ Permission Required: PublicApi.allowImposterMode

Optional headers for testing and debugging (case-insensitive):

LT_IMPOSTER_USER_ID / lt_imposter_user_id: Override authenticated user with specified user ID. User must exist and belong to the same workspace. Original token permissions are preserved.
LT_CUSTOM_NOW / lt_custom_now: Override current time with custom date (ISO 8601 format). Useful for testing time-sensitive operations.

Rate limiting:

Ingress sheds extreme per-IP floods before they reach API pods (about 100 requests/second per ingress replica).
Every HTTP request that reaches the API also counts against a 60-second Redis window: 3000 requests per client IP and 1200 requests per access token or session.
Application responses include X-RateLimit-Limit and X-RateLimit-Remaining. Excess application requests return HTTP 429 with Retry-After (seconds).
Signup, login, and automation webhook routes keep additional tighter limits.

Mutation response projection:

Create/update endpoints may declare a compact default response, usually identifiers and the primary display field.
Use fieldsToReturn=id,name,... to request exact top-level response fields when the endpoint documents x-lt-response-projection.
Use responseShape=full or header LT-Response-Shape: full to opt into the complete response object.
Validation and error responses are never projected.

OpenAPI specification downloads:

JSON
YAML
Load either specification into Scalar, Postman, Insomnia, or another OpenAPI client for interactive requests.

Example:

curl -X GET "https://api.example.com/api/public/account/info" \
  -H "Authorization: Bearer <token>" \
  -H "LT_IMPOSTER_USER_ID: user-123" \
  -H "LT_CUSTOM_NOW: 2024-01-15T10:00:00Z"

Base URL: https://leadtime.app/api/public

Version 1.0

Base URLhttps://leadtime.app/api/public