Public API and webhooks

Most of the time you do not need the API to use LoraLook with your own systems:

• To pull products from your store and send generated photos back: Connecting your store.
• To generate hundreds of products at once and get back a file with updated image URLs: Bulk generation with Excel.
• If you have an enterprise API need, open a support request (opens in a new tab) and choose Public API and webhooks as the category.

• Authentication: Every request carries an Authorization: Bearer sk_live_… header. The key is shown only once; the server keeps only its hash. The Public API does not accept session cookies.
• Scopes: catalog:read, products:read, products:write, generations:read, generations:write, credits:read. A call without the right scope returns INSUFFICIENT_SCOPE (403).
• Idempotency: POST /v1/generations requires an Idempotency-Key header (at least 8 characters). A second call with the same key does not open a new job; it returns the existing one.
• Rate limit: 600 requests per window. Every response carries X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset; beyond the limit you get RATE_LIMITED (429).

1. 1

   Step 1: Get an upload address

   POST /v1/uploads returns a signed upload address; you upload the file to it with PUT.

2. 2

   Step 2: Create the product

   POST /v1/products registers the product and queues preprocessing.

3. 3

   Step 3: Pick a mannequin and poses

   GET /v1/mannequins, then GET /v1/poses?mannequin_id=… (only poses that are ready for that mannequin).

4. 4

   Step 4: Get the cost

   POST /v1/generations/estimate returns the amount without spending credits.

5. 5

   Step 5: Start the generation

   POST /v1/generations opens the job; credits are held up front.

6. 6

   Step 6: Fetch the result

   When the webhook arrives, get a fresh signed download address with GET /v1/generations/{id}.

• Signature: The X-Signature header is the HMAC-SHA256 of <X-Timestamp>.<raw body> with your signing secret. Verify it on the raw body, without parsing it as JSON first.
• Timestamp: Check X-Timestamp too (recommended tolerance 5 minutes); the signature alone does not prevent replays.
• Delivery: Any non-2xx response counts as a failure and is retried for up to 24 hours. After 50 consecutive failures the endpoint is disabled. A redelivered event keeps the same id.
• No image URL in the payload: signed addresses are short-lived. When you receive the event, request the address with GET /v1/generations/{id} and do not store it.

Errors always come in the same envelope: error.code (e.g. INSUFFICIENT_CREDITS), a translated error.message and error.request_id. Branch on code; messages can change. Share the request_id in a support request. Accessing another organization’s resource returns 404.