> ## Documentation Index > Fetch the complete documentation index at: https://uselora.dev/llms.txt > Use this file to discover all available pages before exploring further. # Getting started > Learn how to use Lora's API to manage resources in your Lora workspace programmatically. ## Endpoint The API is REST over HTTPS. Plain HTTP isn't accepted. ```text theme={null} https://api.uselora.com ``` ## Authentication Send your API key as a Bearer token on every request: ```text theme={null} Authorization: Bearer lora_sk_xxxx ``` ## API key ### Create an API key Open **Profile > API Keys** in your workspace. Click **Create** and pick the scopes this key should carry. Send the key as a Bearer token on every request: ```text theme={null} Authorization: Bearer lora_sk_xxxx ``` ## Scopes A key carries scopes that limit what it can do. Select only the scopes the integration needs to reduce the impact of an exposed key. | Scope | What it grants | | ----------------- | ------------------------------------------------------ | | `shortcuts.read` | Read shortcuts in the workspace. | | `shortcuts.write` | Create, update, and delete shortcuts in the workspace. | | `tags.read` | Read tags in the workspace. | | `tags.write` | Create, update, and delete tags in the workspace. | | `folders.read` | Read folders in the workspace. | | `folders.write` | Create, update, and delete folders in the workspace. | ## Errors Every error response is JSON with the same shape. `error` is human-readable. `requestId` correlates with the `X-Lora-Request-Id` response header; quote it when filing a support ticket. `traceId` is a trace identifier when one is available. `code` is optional, and when present it's a machine-readable handle you can branch on. Minimum shape: ```json theme={null} { "error": "Human-readable description of what went wrong.", "requestId": "fra1::iad1::abc123" } ``` With a machine-readable code: ```json theme={null} { "error": "One or more fields failed validation.", "code": "validation_error", "requestId": "fra1::iad1::abc123", "traceId": "0123456789abcdef0123456789abcdef" } ``` ### What a 401 means Missing, malformed, unknown, and expired keys return the same generic 401 body: ```json theme={null} { "error": "Unauthorized", "requestId": "fra1::iad1::abc123" } ``` There's no `code` field on the generic 401. A disabled key returns the same status with `code: "apikey_disabled"`. Treat any 401 as "your request wasn't authenticated" and check the key you sent. If the key is valid but lacks the scope an endpoint needs, you get `403` with `code: "insufficient_scope"` and a `required_scope` field naming what was missing. ### Common error codes The endpoint reference documents the responses for each operation. These are the shared and frequently returned machine-readable codes. New codes may be added. | Code | Status | When | | ----------------------------- | ------- | -------------------------------------------------------------------------------------------------------------------------------------- | | `validation_error` | 400 | Schema validation failed. The body includes `fieldErrors` keyed by field name. | | `invalid_json` | 400 | The request body wasn't valid JSON or wasn't a JSON object. | | `invalid_cursor` | 400 | A list cursor was malformed. | | `reserved_slug` | 400 | The submitted shortcut slug is reserved. | | `masked_requires_https` | 400 | A masked shortcut used a destination that isn't HTTPS. | | `masked_domain_blocked` | 400 | A masked shortcut used a destination that Lora doesn't allow for masking. | | `qr_data_too_long` | 400 | The payload exceeds the capacity of the requested QR error-correction level. | | `apikey_disabled` | 401 | The API key was disabled. | | `plan_requires_upgrade` | 402/403 | The workspace plan doesn't include API access or a requested capability. Anonymous QR logo removal returns 403; plan gates return 402. | | `quota_exceeded` | 402 | The workspace reached a plan limit for the resource being created. | | `insufficient_scope` | 403 | The key lacks the endpoint's required scope. The body includes `required_scope`. | | `no_permission` | 403 | The key owner is not allowed to access the resource or workspace. | | `system_folder` | 403 | The operation isn't allowed on a system folder. | | `not_found` | 404 | The requested resource wasn't found or isn't visible to the caller. | | `folder_not_found` | 404 | The requested primary folder wasn't found or isn't visible. | | `additional_folder_not_found` | 404 | An additional folder wasn't found or isn't visible. | | `tag_not_found` | 404 | A requested tag wasn't found or isn't visible. | | `slug_conflict` | 409 | A shortcut already uses the requested slug. | | `tag_name_exists` | 409 | A tag already uses the requested name. | | `folder_name_exists` | 409 | A folder already uses the requested name. | | `already_primary` | 409 | The shortcut already uses the target as its primary folder. | | `too_many_folders` | 409 | The shortcut has reached its additional-folder limit. | | `folder_not_empty` | 409 | The folder still contains shortcuts that prevent the operation. | | `rate_limit_exceeded` | 429 | The request budget is exhausted. See `Retry-After` and [Rate limits](/essentials/rate-limits). | | `internal_error` | 500 | The server failed unexpectedly. | ### Retry safety Retry idempotent operations with exponential backoff. A write that returns `500` may already have applied. Read the resource or otherwise reconcile its state before retrying the write.