Lunnoa Automate

01

Public API v1 / Headless Platform

DEV to UAT: what the release enables for corporate and financial services clients

Agenda

  1. 01What shipped
  2. 02What this enables for clients
  3. 03Governance and rollout
  4. 04Recommended next steps

Technical summary

What shipped

12

API domains exposed

Bearer + JWT

Auth model

Per key

Rate limiting

Three pieces of engineering work

Machine authentication

Workspace-scoped lna_ keys provision a SERVICE_ACCOUNT user; Bearer auth resolves into the same RBAC-checked shape as JWT login.

Curated public contract

Only @PublicApi() operations are exposed, flagged x-public true, with coverage checks enforcing documentation quality.

Per-key throttling

Machine traffic is rate-limited per key instead of per source IP.

Supporting work

OpenAPI / response contracts

Expanded Swagger DTOs across 12 domains, from agents to workflow apps.

Executions

New execution path computation utility; UI polling extracted into use-execution-polling.

Admin UI

New API Keys page: one-time secret reveal, workspace and role selection, optional expiry.

Agent / Action UI

Shared action UI utilities and output field components.

Database

Migration add_api_keys_service_accounts.

Documentation

api-authentication.md, public-api.md, and OpenAPI updates.

Business value

What this enables for clients

Before this release
  • Every action requires an interactive session tied to a human user.
  • Embedding Lunnoa in an internal portal, core banking system, or partner product meant a custom project.
  • Machine traffic throttled the same way as any other traffic on the same network path.
After this release
  • Scoped lna_ keys tied to a normal RBAC role and a dedicated service-account user.
  • A client's own systems call the documented Public API v1 surface directly, same checks as a human user.
  • Each key's traffic is throttled independently.

Why this matters by function

IT / Security leadership

Scoped, revocable, RBAC-bound service accounts let a CISO approve system-to-system access without approving broad platform access.

Operations leadership

Existing internal tools call Lunnoa workflows directly, lowering the change-management cost of a rollout.

Product and OEM partners

A documented, versioned, workspace-scoped contract lets a partner white-label Lunnoa inside their own product.

Regulated financial institutions

Self-hosted deployment, auditable machine credentials, and a curated contract tend to satisfy architecture and security review.

Rollout

Governance and rollout

Configuration and roadmap

API_KEYS_ENABLED
Master switch; defaults to true in .env.example
Added
plans/BRD_HEADLESS_PLATFORM.md, plans/BRD_APPROVALS.md
Removed
plans/BRD_SURFACES.md (superseded)
Governance and rollout

UAT deployment checklist

  • Migration applies cleanly on UAT
  • Admin Space, API Keys: create, list, revoke
  • API key auth succeeds on a tagged public endpoint within the key's role
  • Revoked, expired, or unknown key returns 401
  • JWT session auth still works for the SPA
  • /docs and public OpenAPI export look correct
  • Execution polling and path responses behave as before in the UI
  • Agent chat action UI still renders outputs correctly

Not yet marked complete. Treat the headless platform as UAT-only until this list has been run end to end.

Next

Recommended next steps

Recommended next steps

DeliverableOwnerStatus
Run the full UAT test plan before referencing this externallyEngineeringNow
Build a headless-integration narrative into financial services pitchesSasaNext
Write a one-page API key governance note for CISO conversationsSasaNext
Evaluate an OEM / white-label pricing motionSasaLater
Full analysis

Where to go deeper

Full written report
/r/2026-07-lunnoa-public-api-v1-headless-platform