Lunnoa Automate

Public API v1 / Headless Platform

DEV to UAT: what the release enables for corporate and financial services clients

Agenda

01What shipped
02What this enables for clients
03Governance and rollout
04Recommended next steps

Technical summary

What shipped

12

API domains exposed

Bearer + JWT

Auth model

Per key

Rate limiting

Three pieces of engineering work

Machine authentication

Workspace-scoped lna_ keys provision a SERVICE_ACCOUNT user; Bearer auth resolves into the same RBAC-checked shape as JWT login.

Curated public contract

Only @PublicApi() operations are exposed, flagged x-public true, with coverage checks enforcing documentation quality.

Per-key throttling

Machine traffic is rate-limited per key instead of per source IP.

Supporting work

OpenAPI / response contracts

Expanded Swagger DTOs across 12 domains, from agents to workflow apps.

Executions

New execution path computation utility; UI polling extracted into use-execution-polling.

Admin UI

New API Keys page: one-time secret reveal, workspace and role selection, optional expiry.

Agent / Action UI

Shared action UI utilities and output field components.

Database

Migration add_api_keys_service_accounts.

Documentation

api-authentication.md, public-api.md, and OpenAPI updates.

Business value

What this enables for clients

Before this release

Every action requires an interactive session tied to a human user.
Embedding Lunnoa in an internal portal, core banking system, or partner product meant a custom project.
Machine traffic throttled the same way as any other traffic on the same network path.

After this release

Scoped lna_ keys tied to a normal RBAC role and a dedicated service-account user.
A client's own systems call the documented Public API v1 surface directly, same checks as a human user.
Each key's traffic is throttled independently.

Why this matters by function

IT / Security leadership

Scoped, revocable, RBAC-bound service accounts let a CISO approve system-to-system access without approving broad platform access.

Operations leadership

Existing internal tools call Lunnoa workflows directly, lowering the change-management cost of a rollout.

Product and OEM partners

A documented, versioned, workspace-scoped contract lets a partner white-label Lunnoa inside their own product.

Regulated financial institutions

Self-hosted deployment, auditable machine credentials, and a curated contract tend to satisfy architecture and security review.

Rollout

Governance and rollout

Configuration and roadmap

API_KEYS_ENABLED: Master switch; defaults to true in .env.example
Added: plans/BRD_HEADLESS_PLATFORM.md, plans/BRD_APPROVALS.md
Removed: plans/BRD_SURFACES.md (superseded)

Governance and rollout

UAT deployment checklist

Migration applies cleanly on UAT
Admin Space, API Keys: create, list, revoke
API key auth succeeds on a tagged public endpoint within the key's role
Revoked, expired, or unknown key returns 401
JWT session auth still works for the SPA
/docs and public OpenAPI export look correct
Execution polling and path responses behave as before in the UI
Agent chat action UI still renders outputs correctly

Not yet marked complete. Treat the headless platform as UAT-only until this list has been run end to end.

Recommended next steps

DeliverableOwnerStatus

Run the full UAT test plan before referencing this externallyEngineeringNow

Build a headless-integration narrative into financial services pitchesSasaNext

Write a one-page API key governance note for CISO conversationsSasaNext

Evaluate an OEM / white-label pricing motionSasaLater

Full analysis

Where to go deeper

Full written report: /r/2026-07-lunnoa-public-api-v1-headless-platform