Developers Authentication

Authentication

API keys, permissions, errors, rate limits and paging.

API keys

Keys are made in the LonexOne panel under Developer API, by anyone with the "Create and delete developer API keys" permission. A key starts with lxk_, belongs to one community, and is shown once when it's made; LonexOne only keeps a hash of it. Each key shows when it was last used, and deleting it stops it working straight away.

Send the key on every request, in the Authorization header:

Header HTTP

Authorization: Bearer lxk_your_key

X-API-Key: lxk_your_key works too. Keep keys on your server: anyone who has one can do what it allows.

Permissions

Each key only does what you tick when you make it. You can change a key's permissions later without making a new one. Some need a module the community has installed.

Permission	Lets the key	Needs
`community.read`	Read the community, its members, departments and roster	-
`cad.read`	Look up characters, vehicles, calls, units, BOLOs, warrants, citations and arrests	CAD
`cad.write`	Create calls, BOLOs, warrants, citations and arrests, sync characters and vehicles, set unit status	CAD
`staff.read`	Check staff duty, players, bans and warnings	Staff Panel
`staff.write`	Give and revoke warnings, kicks and bans as a staff member, and update staff comms	Staff Panel
`store.read`	Read store orders	Community Site
`roster.write`	Add people to rosters, change their rank, callsign or status, and remove them	-
`shifts.read`	Read department shifts and hours on duty	Department Panel
`applications.read`	Read applications and their answers	Department Panel
`applications.write`	Interview, accept and deny applications	Department Panel
`leave.read`	Read leave of absence requests	Department Panel
`leave.write`	Ask for, approve, deny and end leave of absence	Department Panel
`training.read`	Read training sessions, test results and certifications	Training
`training.write`	Book people onto sessions, enrol them in training, and award or revoke certifications	Training

Errors

Errors come back as JSON with a status code that says what kind of problem it is, and a message written to be read by a person.

Status	When
401	No key, or the key isn't valid (deleted, or a typo). `error` is `missing` or `invalid`.
403	The key works but can't do this. `error` is `scope` (permission not ticked), `module` (the community doesn't have the module) or `inactive` (the community is suspended).
404	Nothing with that id in this community.
422	Something you sent isn't right. `errors` lists each field and what's wrong with it.
429	Too many requests. Wait for the number of seconds in the `Retry-After` header.

403 JSON

{
    "message": "This API key doesn't have the cad.write permission. Tick it on the key in the LonexOne panel under Developer API.",
    "error": "scope"
}

422 JSON

{
    "message": "The nature field is required.",
    "errors": {
        "nature": [
            "The nature field is required."
        ]
    }
}

Rate limits

Each key can make 600 requests a minute. Responses carry X-RateLimit-Limit and X-RateLimit-Remaining so you can slow down before you hit it. If you need live updates, use webhooks instead of asking every few seconds.

Paging

Lists return 50 items a page. Ask for up to 100 with per_page, and move through pages with page. Each response says where you are in meta and gives ready-made addresses in links; links.next is null on the last page.

A paged response JSON

{
    "data": [
        "…"
    ],
    "links": {
        "first": "https://api.lonexone.com/v1/members?page=1",
        "last": "https://api.lonexone.com/v1/members?page=3",
        "prev": null,
        "next": "https://api.lonexone.com/v1/members?page=2"
    },
    "meta": {
        "current_page": 1,
        "from": 1,
        "last_page": 3,
        "per_page": 50,
        "to": 50,
        "total": 120
    }
}