Lunnoa GmbH (internal / GTM) · Public API v1 / Headless Platform: Release Report
DEV to UAT: machine-authenticated backend access, per-key auth, and what it unlocks for corporate and financial services clients
Section 01

Executive summary

The Public API v1 release promotes Lunnoa Automate from an interactively operated platform to a machine authenticated backend. Workspace scoped API keys let a client's own systems call a documented, versioned surface with the same RBAC, ownership, and licensing checks as a logged in user, opening the platform to OEM integrations and system to system automation.

At a glance

API domains exposed
12
Agents, workflows, executions, objects, knowledge, queues, tasks, projects, variables, connections, webhooks, workflow apps
Auth model
Bearer + JWT
Machine keys resolve into the same request-user shape as human login
Rate limiting
Per API key
Machine traffic throttled per key rather than per IP
Key findingHigh impact

Lunnoa Automate becomes an embeddable automation backend, not just a product clients log into

Before this release, every action in Lunnoa required a human to sign in through the SPA. With API keys as service accounts, a client's core system, an internal portal, or an OEM partner product can call the platform directly, unlocking integration patterns that were not previously possible without a custom project.

Key findingMedium impact

Governance model carries over unchanged

Each API key provisions a SERVICE_ACCOUNT user with a normal RBAC role rather than a blanket bypass. Existing ownership and licensing checks apply to machine calls exactly as they do to human ones, so the new surface does not create a parallel, less governed access path.