Introduction

PREVIEW: This API is in preview and under active development. Endpoints and schemas are subject to breaking changes, and backward compatibility is not guaranteed until the API is promoted to a stable version.

REST API of the Lobster Platform for headless clients. Every operation, schema and member of this document carries a description, and the create operations carry complete examples. Each tag links the page of the Lobster documentation that explains its resources.

Authentication

Four authentication flows are available. All of them produce a bearer token that must be sent as Authorization: Bearer <token> on every request.

1. Authorization code with PKCE (acting as a user; works with Microsoft and other SSO): the steps are in the OAuth2AuthorizationCode security scheme.
2. OAuth2 Client Credentials (machine-to-machine): exchange a client id/secret provisioned in the Lobster administration UI at POST /dw/register/oauth/token with grant_type=client_credentials&client_id=<id>&client_secret=<secret>.
3. UI Session Bearer Token: log in via the Lobster web UI, then exchange the session cookie for a token at GET /auth/sessionBearerToken.
4. Guest User Login Token: append a GuestUser loginToken as a URL query parameter (<host>?loginToken=<token>) to establish a session without a password, then retrieve the bearer token the same way.