Lora API

Endpoint

The API is REST over HTTPS. Plain HTTP isn’t accepted.

https://api.uselora.com

Authentication

Send your API key as a Bearer token on every request:

Authorization: Bearer lora_sk_xxxx

API key

Create an API key

Go to your workspace

Open Profile > API Keys in your workspace.

Create the key

Click Create and pick the scopes this key should carry.

Use it

Send the key as a Bearer token on every request:

Authorization: Bearer lora_sk_xxxx

Scopes

A key carries scopes that limit what it can do. Select only the scopes the integration needs to reduce the impact of an exposed key.

Scope	What it grants
`shortcuts.read`	Read shortcuts in the workspace.
`shortcuts.write`	Create, update, and delete shortcuts in the workspace.
`tags.read`	Read tags in the workspace.
`tags.write`	Create, update, and delete tags in the workspace.
`folders.read`	Read folders in the workspace.
`folders.write`	Create, update, and delete folders in the workspace.

Errors

Every error response is JSON with the same shape. error is human-readable. requestId correlates with the X-Lora-Request-Id response header; quote it when filing a support ticket. traceId is a trace identifier when one is available. code is optional, and when present it’s a machine-readable handle you can branch on. Minimum shape:

{
  "error": "Human-readable description of what went wrong.",
  "requestId": "fra1::iad1::abc123"
}

With a machine-readable code:

{
  "error": "One or more fields failed validation.",
  "code": "validation_error",
  "requestId": "fra1::iad1::abc123",
  "traceId": "0123456789abcdef0123456789abcdef"
}

What a 401 means

Missing, malformed, unknown, and expired keys return the same generic 401 body:

{ "error": "Unauthorized", "requestId": "fra1::iad1::abc123" }

There’s no code field on the generic 401. A disabled key returns the same status with code: "apikey_disabled". Treat any 401 as “your request wasn’t authenticated” and check the key you sent. If the key is valid but lacks the scope an endpoint needs, you get 403 with code: "insufficient_scope" and a required_scope field naming what was missing.

Common error codes

The endpoint reference documents the responses for each operation. These are the shared and frequently returned machine-readable codes. New codes may be added.

Code	Status	When
`validation_error`	400	Schema validation failed. The body includes `fieldErrors` keyed by field name.
`invalid_json`	400	The request body wasn’t valid JSON or wasn’t a JSON object.
`invalid_cursor`	400	A list cursor was malformed.
`reserved_slug`	400	The submitted shortcut slug is reserved.
`masked_requires_https`	400	A masked shortcut used a destination that isn’t HTTPS.
`masked_domain_blocked`	400	A masked shortcut used a destination that Lora doesn’t allow for masking.
`qr_data_too_long`	400	The payload exceeds the capacity of the requested QR error-correction level.
`apikey_disabled`	401	The API key was disabled.
`plan_requires_upgrade`	402/403	The workspace plan doesn’t include API access or a requested capability. Anonymous QR logo removal returns 403; plan gates return 402.
`quota_exceeded`	402	The workspace reached a plan limit for the resource being created.
`insufficient_scope`	403	The key lacks the endpoint’s required scope. The body includes `required_scope`.
`no_permission`	403	The key owner is not allowed to access the resource or workspace.
`system_folder`	403	The operation isn’t allowed on a system folder.
`not_found`	404	The requested resource wasn’t found or isn’t visible to the caller.
`folder_not_found`	404	The requested primary folder wasn’t found or isn’t visible.
`additional_folder_not_found`	404	An additional folder wasn’t found or isn’t visible.
`tag_not_found`	404	A requested tag wasn’t found or isn’t visible.
`slug_conflict`	409	A shortcut already uses the requested slug.
`tag_name_exists`	409	A tag already uses the requested name.
`folder_name_exists`	409	A folder already uses the requested name.
`already_primary`	409	The shortcut already uses the target as its primary folder.
`too_many_folders`	409	The shortcut has reached its additional-folder limit.
`folder_not_empty`	409	The folder still contains shortcuts that prevent the operation.
`rate_limit_exceeded`	429	The request budget is exhausted. See `Retry-After` and Rate limits.
`internal_error`	500	The server failed unexpectedly.

Retry safety

Retry idempotent operations with exponential backoff. A write that returns 500 may already have applied. Read the resource or otherwise reconcile its state before retrying the write.

Shortcuts

Tags

Folders

QR Codes

Lora API — Getting started

Endpoint

Authentication

API key

Create an API key

Scopes

Errors

What a 401 means

Common error codes

Retry safety

​Endpoint

​Authentication

​API key

​Create an API key

​Scopes

​Errors

​What a 401 means

​Common error codes

​Retry safety

Endpoint

Authentication

API key

Create an API key

Scopes

Errors

What a 401 means

Common error codes

Retry safety